Autonomous Control Device

Abstract

To provide an autonomous control device capable of executing a control in a real time while maintaining the high-dimension structure of an operating environment model.SOLUTION: An autonomous control device serving as an operator terminal operated by an operator, is configured to: be connected to the other autonomous control device that has an operation planning and controlling system which accomplishes control instructions by an inter-convex-closed-region transition using a binary vector model constructing function by convex closed region dividing of a state space; construct a binary-vector-set model that has elements which are a binary vector set in which a true-false determination formula with a binary vector as an argument becomes true, and a binary vector set in which such a formula becomes false, presents, to the operator, the state of a physical operation space interpreted by the autonomous control device through a binary vector model; and transmit, to the other control device, the control instruction with an argument that is the binary vector set.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an autonomous control device. [Background technology]

[0002] An autonomous system is composed of systems for external measurement, decision making, and motion planning / control. In autonomous systems for high safety applications, the operator may be held responsible for negligence in the event of a control failure.

[0003] Hazards that are ultimately interpreted as control failures are observed as the result of a variety of causes, including errors in the measurements of the external state received by the external measurement system from sensor devices, design flaws in the process of processing the measurement values ​​of the external state to construct an operating environment model, mistakes in the selection of operating targets in the decision-making system, and functional inconsistency errors in the motion planning and control system that originate from conflicts between safety constraints and the operating targets.

[0004] In the case of autonomous systems for high safety applications, a redundant design is used to ensure that the system is at least fail-safe or fail-operational against a categorized single failure mode in order to eliminate single points of failure (SPF). However, there is a risk of hazards occurring because the system does not have a fault-tolerance function (model repair) for model incompleteness, especially when convenient assumptions about the model structure (time-invariant / uncertain, linear, sparsity, etc.) do not hold.

[0005] On the other hand, when an operator receives a notification of some kind of abnormality detection, it is extremely difficult for the operator to interpret a large amount of external measurement data and set control commands in a timely manner as intended in the process of constructing an operating environment model from the ever-changing external situation. This is because, while actual operations proceed in real time in the physical value space, the interpretation of the abnormality detection results and the determination of control commands are performed in the logical data space expressed in the form of an operating environment model, that is, the behavior interpreted by the operator proceeds within the logical data space.

[0006] One approach is to make the operating environment model more detailed and precise, aiming for a redundant design. However, in a real situation where the reliability of the smallest data unit, which is a component of the data string received by the external measurement system from the sensor device, is not guaranteed, there is no point in pursuing the accuracy of the operating environment model. It is sufficient for the operating environment model to guarantee the boundedness of only the closed space of the state that can actually be reached, which should be assumed by the decision, motion planning and control system, in the state value space, which is its domain.

[0007] As a conventional technique related to autonomous systems, for example, Patent Document 1 discloses an autonomous control device that generates operation control logic that realizes operation adapted to the internal state of its own system and external factors in an open external environment acquired by an external measurement means based on operation control logic stored in a storage device, and instructs a drive device to operate in an open external environment, in which the autonomous control device generates the operation control logic and control logic from constraint conditions corresponding to the external factors acquired from the external measurement means and the internal state of its own system, and constraint conditions related to the expected operation required of its own system and the soundness of the operation each time the operation control logic is successively reconstructed, writes the generated operation control logic and information acquired from the external measurement means to the recording device, and instructs the operation of its own system based on the control logic, and an autonomous control device that includes an expected operation determination unit that instructs the expected operation required of its own system based on the results of the determination by the autonomous operation control device of the expected operation and the soundness of the operation.

[0008] Patent Document 2 also describes a POMDP probability-reward table storage unit that stores in advance a state transition probability P(s'|s,a) of a state s changing to state s' by an action a, and an observation value output probability P(o'|s',a) when an observation value o' is observed in state s' by an action a, a state probability distribution storage unit that stores a probability distribution bt-1(s) of the previous state, assuming that time is t, an action storage unit that stores an action at-1 immediately before, and a memory that acquires an action at-1 immediately before from the action storage unit and stores the action at-1 immediately before. and the current observation value ot', referring to the POMDP probability-reward table storage unit, obtains the corresponding state transition probability P(s'|s,a) and observation value output probability P(o'|s',a), obtains the probability distribution bt-1(s) of the previous state from the state probability distribution storage unit, and calculates the probability distribution bt(s') of the current state; an action duration probability table storage unit which sets the number of consecutive occurrences n of action a as the action duration na and stores the probability of the action duration na as the action duration probability Pa(n); and an action determination unit which uses a function π which takes a probability distribution bt(s') of the current state as an argument to determine a score for each action, and if the previous action and the action corresponding to the best score are different, determines the action corresponding to the best score as the action to be taken by the system and minimizes the real-time action duration updated in the course of behavior control, and if the previous action and the action corresponding to the best score are the same, receives an action duration probability corresponding to the real-time action duration of the action corresponding to the best score from the action duration probability table storage unit, and depending on whether the value obtained from this action duration probability is larger than a uniform random number, determines the action corresponding to the best score as the action to be taken by the system and increases the real-time action duration by one, or determines an action different from the action corresponding to the best score as the action to be taken by the system and minimizes the real-time action duration.

[0009] Furthermore, Patent Document 3 discloses a system analysis device for a system in which an internal state changes due to an input and an output for the input changes according to the change in the internal state, and the system includes a state transition model construction means for constructing a state transition model including a plurality of state values ​​that the system can take and transition paths between each state value based on a state transition rule of the system, an initial state value setting means for setting an initial state value that satisfies a predetermined start condition from among the plurality of state values, a final state value setting means for setting a final state value that satisfies a predetermined end condition from among the plurality of state values, and a state transition path existence determination means for determining whether or not a state transition path that reaches the initial state value from the final state value exists in the state transition model. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] International Publication No. 2014 / 141351 [Patent Document 2] JP 2012-190062 A [Patent Document 3] JP 2017-174471 A Summary of the Invention [Problem to be solved by the invention]

[0011] In the prior art described in the above Patent Document 1, when a closed area in the internal state is defined and operation control is performed by transitioning between partial closed areas divided by overlapping closed areas, the generated control logic is presented to a remote operator and the remote operator performs the processing to realize normal operation. Also, the inside and outside of the closed area are used as the separation criterion, and meaning is assigned from the viewpoint of system control, and an abstraction method is used in which a logical address is assigned to each closed area at the first place.

[0012] However, for the number M of defined closed regions, there are at most 2^M state subspaces that are decomposed without overlap. Therefore, the disclosed approach of expressing control logic as a sequence of transitions between closed subspaces leaves implementation challenges that cause at least a polynomial, and at worst, an exponential increase in computational complexity and data representation volume.

[0013] Even if the definition of each closed region itself can be interpreted by the operator, it is difficult to find meaning in each transition between the fragmented state subspaces resulting from the combination of the closed regions and their adjacent state subspaces.

[0014] The prior art described in Patent Document 2 above discloses a system that automatically determines the system's behavior based on state transition probability, in which the state changes depending on the user's actions. However, the system itself does not move within the operating environment, and the operating environment model is an automatic control system that assigns data collected by an external measurement system to undetermined variables; it does not have an internal model construction function, and since it is not a dynamic environment, it does not require such a function.

[0015] The prior art described in Patent Document 3 above suggests the idea of ​​calculating information that is meaningful to an operator by reducing the problem to a problem of searching for the presence or absence of a state transition sequence that satisfies a hazard condition among the transition sequences between the fragmented state subspace groups mentioned in Patent Document 1. However, there is no mention of a method of associating a presented state transition graph with a partial closed space in a physical value space in which an autonomous system actually operates, and no method of closed region division that addresses the problem of the exponential increase in the number of state subspaces is disclosed.

[0016] It is difficult for an operator to directly visually check the data structure of the large-capacity operation environment model that is updated in real time and set control commands at the appropriate timing. There are several issues for this, including the problem of mathematical computational complexity. If the state variables that change the operation of the autonomous system are increased to make them more precise and complex, and an operation environment model in a high d-dimensional space is constructed, the amount of data D_size [bytes] that represents the model will increase at least polynomial(d) with respect to the dimension d, and in the worst case, exponentially exp(d). There is also a derivative issue that the operation planning system of the autonomous system will no longer be able to satisfy the real-time constraints when performing control calculations during operation using the huge operation environment model.

[0017] As exemplified in the above Patent Document 1, when the physical value space is divided in a manner that allows overlapping of closed regions, the closed regions are fragmented, and there is a similar problem of mathematical computational complexity. Even if the inside / outside determination results of each closed region can be bundled and abstracted into M Boolean values ​​called logical addresses, the number of fragmented closed regions increases at least polynomially by simply adding one closed region. When the logical address length M increases due to the refinement of the closed region, the logical address changes at high speed, making it even more difficult to debug control instructions.

[0018] The present invention has been made in view of the above, and has an object to provide an autonomous control device capable of real-time control while maintaining the high-dimensional structure of an operating environment model. [Means for solving the problem]

[0019] The present application includes multiple means for solving the above-mentioned problems. One example is an autonomous control device as an operator terminal operated by an operator, which is connected to another autonomous control device having an operation planning and control system that realizes control commands by transitions between convex closed regions using a binary vector model construction function by dividing a state space into convex closed regions, constructs a binary vector set model having elements that are binary vector sets for which a truth / false determination equation having a binary vector as an argument is true and binary vector sets for which it is false, presents the state of the physical operation space interpreted by the autonomous control device to the operator via the binary vector model, and transmits a control command having the binary vector set as an argument to the other autonomous control device. Effect of the Invention

[0020] According to the present invention, instead of visually observing the continuously changing state values ​​characterizing the situation in the operating environment of the autonomous system, the autonomous system itself can perform real-time control while maintaining the high-dimensional structure of the operating environment model by mapping them into a binary vector type label value (= logical address) space based on an inside / outside determination of a separation boundary defined from the system perspective. [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 is a diagram illustrating an overall configuration of an autonomous control system. [Diagram 2] FIG. 1 is a diagram showing the processing cycle of an autonomous control device that executes processing for an external measurement system, a motion judgment system, and a motion planning and control system. [Diagram 3] FIG. 1 is a diagram illustrating an example of a binary vector model. [Figure 4] 1 is a diagram showing an example of constructing a binary vector model for a physical value space when an autonomous mobile body travels on a public road; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] Hereinafter, an embodiment of the present invention will be described with reference to FIGS.

[0023] In this embodiment, a case will be considered in which the autonomous control system directly refers to the physical value space and performs autonomous control based on events occurring within the physical value space.

[0024] Fig. 1 is a diagram showing a schematic diagram of an overall configuration of an autonomous control system according to the present embodiment, and Fig. 2 is a diagram showing a processing cycle of an autonomous control device that executes processing of an external measurement system, an action decision system, and an action planning and control system, among the autonomous control devices that constitute the autonomous control system.

[0025] In Figure 1, the autonomous control system is composed of a first autonomous control device 101 that executes the processing of an external measurement system, an action judgment system, and an action planning and control system, and a second autonomous control device 102 that serves as an operation terminal for an operator.

[0026] As shown in Figures 1 and 2, the first autonomous control device 101 has an external measurement processing unit 201 that performs external measurement system processing (step S001) mainly consisting of constructing a binary vector model, a motion judgment processing unit 202 that performs motion judgment system processing (step S002) that interprets a control command and assigns a label value L1, and a motion plan control processing unit 203 that performs motion plan / control system processing (step S003) that calculates an adjacent convex closed region sequence by referring to the binary vector model and performs a specific motion plan.

[0027] In the processing of the outside world measurement system (step S001), the outside world measurement processing unit 201 acquires outside world measurement data from a group of sensor devices, constructs a binary vector model by dividing the data into convex closed regions, and assigns a binary vector type label corresponding to the characteristics of each convex closed region.

[0028] FIG. 3 is a diagram illustrating an example of a binary vector model.

[0029] The binary vector model shown in Figure 3 can be obtained by, for example, arranging a group of 15 data points indicating the presence or absence of an occupant in a state space projected onto a horizontal plane, i.e., a d=2-dimensional state space, and mechanically dividing the space into convex closed regions with a separating half-plane that equally divides each data point and its neighboring points as a boundary surface. When the dimension d of the data points is 2, it is called Voronoi division, and this process can be mechanically performed for any dimension d. Note that in Figure 3, the dimension d of the data points is d=2 for convenience of illustration, but when considering an actual physical value space, a time component must be added to the data points.

[0030] In FIG. 3, each data point is labeled with a 3-bit binary vector.

[0031] The 0th component L0 of the label value is set by processing (step S001) of the outside world measurement system in the outside world measurement processing unit 201. In the label value, the 0th component L0=0 indicates a blank convex closed region with no occupant in the physical value space, and the 0th component L0=1 indicates a convex closed region with an occupant in the physical value space.

[0032] The first component L1 of the label value is set by the processing (step S002) of the motion judgment system in the motion judgment processing unit 202. In the label value, the first component L1=0 indicates a convex closed region that is deemed safe based on rules determined at the time of design, and the first component L1=1 indicates a convex closed region that is deemed unsafe according to rules determined at the time of design.

[0033] The second component L2 of the label value is set by the processing (step S003) of the motion planning and control system in the motion planning control processing unit 203. In the label value, the second component L2=0 indicates a convex closed region that is considered to be transitionable, and the second component L2=1 indicates a convex closed region that should be excluded from transition targets.

[0034] In the above, there is a relationship such that at least the convex closed region with the label value of the 0th component L0=1 has the label value of the 1st component L1=1, but please note that the criteria and subjects for assigning label values ​​are different, and the data points to which label values ​​are assigned are dynamic. The motion planning and control system extracts only the convex closed regions with the label value of the 1st component L1=0 and uses them as dynamic safety constraints. In this example as well, the safety constraints of an autonomous system operating in an open environment are time-varying, high-dimensional functions whose arguments are the external environmental states that characterize surrounding moving objects operating of their own volition.

[0035] In the processing of the operation determination system (step S002), a group of reachable convex closed regions determined by safety constraints is selected, and a convex closed region that includes the control target state indicated by the control command is specified.

[0036] In the processing of the motion planning and control system (step S003), a sequence of convex closed regions that satisfies the control command is calculated. In the binary vector model of FIG. 3, a sequence of adjacent convex closed regions that can reach the convex closed region VD(14) that contains the data point set as the motion target from the convex closed region VD(15) that contains the data point that represents the current state is searched for, and if such a sequence of adjacent convex closed regions exists, it is mechanically determined to be an executable control command. Conversely, if it is set to the convex closed region VD(2) that contains the motion target, the convex closed region VD(15) and the convex closed region VD(2) are separated by a convex closed region with a label value of the first component L1=1, so the control command is determined to be inexecutable. In this case, a functional inconsistency exception is notified.

[0037] In a typical autonomous system, an operator specifies a control command as appropriate, and receives a notification of a functional inconsistency exception if the control command cannot be realized.

[0038] When a sequence of adjacent convex closed regions actually exists, the sequence is converted into a sequence of control instructions for the drive system that realizes a specific transition in the physical value space for each pair of adjacent convex closed regions.The above series of processes is repeated.

[0039] When planning the motion of an autonomous mobile object operating in an open environment, dynamic safety constraints are set to avoid potentially liable collision conditions. Hazards, such as collisions, are formalized as competition between the autonomous system and surrounding moving objects in a closed temporal and spatial domain. The autonomous system cannot control surrounding moving objects, and the near-future movement intention is bounded but not measurable or observable, so the autonomous system must adapt to it and continue to satisfy the conditions of mutual exclusion.

[0040] The processing of the motion judgment system (step S002) sets the first component L1 of the label value to contribute to mutual exclusion control. However, if the mutual exclusion control to avoid conflicts is incomplete, a deadlock will occur even if the hazard is avoided. This is detected by the processing of the motion planning and control system (step S003). A binary vector representation of the current state of the system is calculated, and the corresponding binary label value of the unsatisfiable control objective or safety constraint is identified, and the conflict and deadlock are mechanically detected, allowing notification of a functional inconsistency exception.

[0041] In the binary vector model shown in Figure 3, a 3-bit binary vector type label is used. In this case, the bit length increases according to the criteria to be distinguished from the viewpoint of system functionality and operational safety, and the more detailed the binary vector model is, the more the binary vector value itself fluctuates in a short time, making it difficult for the operator to correctly understand the meaning of the transition between individual binary vectors. However, by adopting a binary vector model using a binary vector type label, the number of label value components to focus on for each individual trouble is small.

[0042] In Figures 1 and 2, if a functional inconsistency exception occurs in the motion planning and control system processing (step S003), the operator receives an exception processing call. In this case, it must first be confirmed whether the autonomous system continues to be in a statically safe state in the physical value space. This can be done by referring to the first component L1 of the label value, and other label values ​​can be ignored.

[0043] If the binary judgment result for the label value is True, the operator can take sufficient time to reconfigure the control target, but if it is False, the operator must immediately deal with the safety constraint violation. It is important to be able to distinguish the response policy in a short time, and in this embodiment, this is done by the second autonomous control device 102 as an operation terminal operated by the operator. More specifically, this process corresponds to the process of dividing the binary vector address group into closed regions (step S004) in the construction processing unit of the binary vector address set transition graph of the second autonomous control device 102.

[0044] In the construction processing unit for the transition graph between binary vector address sets, a new separation criterion that appropriately defines a set of binary vector addresses from a viewpoint selected by the operator is redefined within the binary vector address space. In this example, an inside / outside determination is made for a binary vector address set whose label value is the first component L1=0, and a binary vector address set model 104 (binary vector set model) is obtained.

[0045] Instead of directly viewing the binary vector model 103, the operator refers to the binary vector address set model 104 obtained through the process of the construction processing unit of the transition graph between binary vector addresses (discard step S004) to grasp the situation and re-specify the control command. Since the logical address having the binary vector set as an element is sufficiently shorter than the original binary vector address, a situation that contributes to the viewpoint that the operator considers important is presented.

[0046] The control target itself can also be redefined by simply adding a data point to the data point group that is the target of the binary vector model. After convex closed domain division, a convex closed domain including the vicinity of the data point can be set as the control target.

[0047] An example of a situation in which an operator may deal with a function inconsistency exception at his / her discretion after being notified of the function inconsistency exception is when the operator corrects an improper setting of a label value.

[0048] For example, consider a case where an autonomous mobile object (such as an automobile that performs autonomous driving control) is traveling on a public road. Fig. 4 is a diagram showing an example of construction of a binary vector model for a physical value space in this case.

[0049] FIG. 4 illustrates an example in which a binary vector model is constructed by applying the concept of this embodiment to the surrounding space of the autonomous moving body 400 at a given point in time, and each convex closed region is labeled in the same manner as the binary vector model illustrated in FIG. 3.

[0050] For example, when the autonomous mobile body 400 traveling on a public road stops in front of a traversable road obstacle during construction of an operating environment model, a malfunction may occur in the process (step S001) of the external measurement system that labels the convex closed area near the road obstacle. The label value mentioned here classifies the convex closed area as an area where the system can enter or not.

[0051] However, even debugging is not easy when the operator refers only to the binary vector model 103, and directly referring to the physical value space requires large amounts of communication and a visualization process that is different from the processing of the external measurement system (step S001).

[0052] The operator can first confirm that the vehicle stopped due to a functional inconsistency exception, and after performing the work required to confirm whether the cause was a spatial conflict with an obstacle on the road or another factor, he or she determines that the cause was a misidentification in the image recognition part that sets the label values, overwrites the label values ​​so that the vehicle can enter a convex closed region near the obstacle on the road, confirms that the functional inconsistency exception no longer occurs, and issues a command to continue operation. The operator is responsible for ensuring that the overwriting of the label values ​​does not cause a hazard, but by simplifying the process to a binary vector model, it is possible to provide a control interface that allows easy confirmation that appropriate label values ​​have been selected.

[0053] The effects of the present embodiment configured as above will be summarized.

[0054] In an autonomous control system, it is very difficult for an operator to directly and visually check the data structure of a large-capacity operating environment model that is updated in real time and set control commands at the appropriate timing. This is related to three fundamental problems, and these problems can be solved in this embodiment.

[0055] The first problem is the difficulty that an operator has in directly viewing the data structure of the operational environment model, which is large in volume and updated in real time, and in setting control commands at the appropriate time.

[0056] There are several reasons for this difficulty, one of which is the problem of mathematical computational complexity. If the state variables that change the operation of the autonomous system are increased to make them more precise and complex, and an operating environment model in a high d-dimensional space is constructed, the amount of data D_size [bytes] that represents the model will increase at least polynomial(d) with respect to the dimension d, and in the worst case, exponentially exp(d). There is also a derivative problem that the operation planning system of the autonomous system will not be able to satisfy the real-time constraints when performing control calculations during operation using a huge operating environment model. For example, if the physical value space is divided in a way that allows overlapping of closed regions, as in the conventional technology, this will lead to fragmentation of the closed regions, which will result in a similar problem of mathematical computational complexity. Even if the results of the inside / outside judgment of each closed region can be bundled and abstracted into M Boolean values ​​called logical addresses, simply adding one closed region will increase the number of fragmented closed regions at least polynomially. If the logical address length M increases due to the refinement of the closed region, the logical address will change at high speed, making it even more difficult to debug the control instructions.

[0057] In contrast, in this embodiment, an algorithm is used that mechanically divides a group of data points into convex closed regions with a boundary surface being a separating half-plane that divides each data point and its neighboring points equally, and a data structure is used that assigns a binary vector value label with elements of two values, True or False, to each data point to characterize the set of data points in the convex closed region. This data structure, which is used in place of the space division method based on the overlapping relationship of closed regions, is called a binary vector model.

[0058] Mathematically, there is an algorithm known that mechanically divides a space into non-overlapping convex closed regions that satisfy the above conditions, and in the case of two dimensions, it is known as Voronoi division. In fact, a separating half-plane is placed at the midpoint of two points in two-dimensional space, and the space is divided before and after it. By binarizing each point by determining whether it is inside or outside the separating half-plane placed on the adjacent point, it is possible to associate each point with a convex closed region inside the separating half-plane. Adjacent convex closed regions only share the separating half-plane, but do not overlap each other. This convex closed region division method can be extended to any dimension.

[0059] In other words, in this embodiment, instead of visually observing the continuous changes in state values ​​that characterize the situation in the operating environment of the autonomous system, the autonomous system itself can perform real-time control while maintaining the high-dimensional structure of the operating environment model by mapping them into a binary vector type label value (= logical address) space based on an inside / outside determination of a separation boundary defined from a system perspective.

[0060] The second challenge is that the complexity and scale of the operating environment model itself imposes cognitive limitations that make it difficult for operators to understand the operating environment and identify defects within the control program of the autonomous system that is supposed to adapt to that environment.

[0061] Although only a small portion of control program defects are involved in troubles that actually manifest at the system level, it takes a long time to exclude non-defective parts, narrow down the possible defective parts, and finally identify the defective parts. This is because the correspondence between the individual elements of the data structure of the operating environment model and the events occurring in the physical space is not at all self-evident to an average operator trying to understand the system safety from the perspective of system safety.

[0062] In addition, the external measurement system receives a large amount of data, but the reliability cannot be guaranteed based on the minimum data unit sent from each sensor device, and data consistency must be maintained by detecting and correcting errors in each sensor device in a complementary manner. As a result, the accuracy of the operating environment model and the external state remains insufficient, and only boundedness can be guaranteed, which is also a cause of malfunctions that cannot be completely eliminated at the design stage.

[0063] When debugging or when a malfunction occurs, the operator or designer must ultimately use the operation log to check the validity of error handling in the smallest data unit. However, it is difficult to deploy a large-capacity, low-latency recording device that can store all the data from the sensor device, making it impossible to reproduce the malfunction and making debugging itself difficult. Therefore, a data structure for the operating environment model that can reduce the amount of data itself without omitting information necessary from the perspective of system safety is required.

[0064] In contrast, this embodiment provides an alternative to the problem that the data representation expressing the events occurring in the physical value space becomes long and that it is difficult to understand the separation boundary of the judgment criteria that uses a complex and high-dimensional operating environment model that uses the data representation as an argument.In other words, by using a binary vector model, it is possible to utilize the fact that the binary vector is binarized to determine whether it is inside or outside the separation boundary that defines the judgment criteria for True / False values, which are components of the binary vector.

[0065] The separation boundary surface of the convex closed region that contains each data point is then associated with the boundary of the judgment criterion. By extracting only the separation boundaries that are meaningful from the system perspective, it becomes possible to handle the separation boundaries of a high-dimensional operating environment model while keeping them in high dimensions, without incurring model errors caused by unnecessary reduction in dimensions.

[0066] For each convex closed region, a binary vector is assigned as a label based only on the binary criteria for determining whether it is homogeneous or heterogeneous with adjacent points. If the separation boundary is incomplete, data points can be added to refine the convex closed region partitioning, so there is no increase in the amount of data required to represent a high-dimensional model. This is because even with an M-bit label, the number of convex closed regions can be kept at N data points.

[0067] That is, in this embodiment, by providing an operator control interface for the entire autonomous system, the operator of the autonomous system can grasp the operating environment and its meaning from the viewpoint of the system through a binary vector model. It becomes possible to monitor and discover unintended behavior and quickly respond to exception processing such as functional inconsistency according to the operator's interests.

[0068] The third issue is control responsibility, in the sense that if an operator with incomplete situational awareness modifies control commands in an attempt to deal with an autonomous system that is in trouble, the computational complexity involved in estimating the effect and verifying its validity during operation may increase or become undecidable, making it difficult for the operator to respond in a short period of time.

[0069] In order to allow one operator to be responsible for multiple autonomous systems, it is desirable for the design to facilitate monitoring and reduce the time it takes to respond to malfunctions.

[0070] Operators must deal with a variety of malfunctions. One example of a design flaw specific to autonomous systems is the Functional Inconsistency Exception. The Functional Inconsistency Exception is a failure mode specific to autonomous systems that operate in an open space, and occurs when the current state value is not included in the partial closed region where two defined closed regions overlap, when the two closed regions respectively represent a control objective and a safety constraint. If an operator continues operation without intervening in the autonomous system's motion planning system, the violation of the control objective is observed as an uncontrollable state, and if the violation of the safety constraint is not addressed, it actually causes a hazard.

[0071] When this functional inconsistency exception occurs, the operator must understand the elements that characterize each closed region, detect the superficial conflict between the closed region that encodes the control objective and the closed region that encodes the safety constraint, and then quickly identify the root cause of the conflict and issue the correct corrective control command to resolve the conflict, which can be difficult.

[0072] In contrast, in the present embodiment, this problem is addressed by providing a control interface to an autonomous system that has the function of mapping a physical value space to a binary vector address via a binary vector model.

[0073] By constructing a binary vector model, instead of operators having to directly see the values ​​represented by sensor data in the physical value space in which the autonomous system operates, operators can see state values ​​that are binary based on whether they are inside or outside a separation boundary that is meaningful from the system's perspective.

[0074] There are many components of a binary vector, but the meaning is determined by the homogeneity and heterogeneity of the data points from the system's perspective. Therefore, when an autonomous system malfunctions, only a small part of the components should be focused on.

[0075] An operator must instantly determine whether a system is in a statically safe state or in the process of introducing a hazard, but this is extremely difficult when the associated binary vector components exceed approximately 4 bits. In fact, when a label value is 4 bits, an operator must refer to a separation boundary that distinguishes at least 2^4 bits = 16 adjacent points.

[0076] Instead, we can use an information abstraction method that splits binary vector label values ​​into two values ​​based on the viewpoint that the operator is interested in. This means classifying all convex closed regions into two convex closed regions and defining a new separation boundary between them.

[0077] That is, in this embodiment, the design, testing, and verification of the physical-logical integrated system at the design stage are facilitated. Also, during normal operation, a setting format for control commands in a binary vector space is provided, and the system can be used as a means for monitoring the operation planning process of an autonomous system.

[0078] <Additional Notes> The present invention is not limited to the above-described embodiments, and includes various modifications and combinations within the scope of the gist of the present invention. The present invention is not limited to those having all the configurations described in the above-described embodiments, and includes those in which some of the configurations are deleted. The above-described configurations, functions, etc. may be realized by designing some or all of them as an integrated circuit, for example. The above-described configurations, functions, etc. may be realized by software, in which a processor interprets and executes a program that realizes each function. [Explanation of symbols]

[0079] 101...first autonomous control device, 102...second autonomous control device, 103...binary vector model, 104...binary vector address set model, 201...external world measurement processing unit, 202...motion judgment processing unit, 203...motion plan control processing unit, 400...autonomous moving body

Claims

1. An autonomous control device as an operator terminal operated by an operator, The autonomous control device is connected to another autonomous control device having an action planning and control system that realizes a control command by transition between convex closed regions using a binary vector model construction function by dividing the state space into convex closed regions, An autonomous control device characterized in that, based on the viewpoint selected by the operator, a binary vector set model is constructed whose elements are a binary vector set for which a truth-false judgment equation having a binary vector as an argument is true and a binary vector set for which the truth-false judgment equation is false, the state of the physical operation space interpreted by the autonomous control device via the binary vector set model is presented to the operator in the form of a transition graph based on the binary vector set model, and a control command whose argument is the binary vector set for which the truth-false judgment equation is true is transmitted to the other autonomous control device.

2. 2. The autonomous control device according to claim 1, An autonomous control device characterized in that the operation planning / control system of the other autonomous control device determines whether a specified control command is executable, and if it determines that it is not executable, notifies an operator of a functional inconsistency exception.

Images