Operation device and operation monitoring system

Abstract

To provide an operation device and an operation monitoring system that can store a situation in which an emergency operation instruction is made while allowing an unspecified number of persons to make the emergency operation instruction, and perform speedy tracking and confirmation at low cost.SOLUTION: The present invention relates to an operation device and an operation monitoring system. In the operation device, an operation instruction transmission determination part is configured to: cause an operation instruction transmission part to transmit an operation instruction to an operated part; cause an operation log storage part to store periphery information and an operation log; cause the operation instruction transmission part to transmit the operation instruction to the operated part when a type of the operation instruction is an operation requiring no authority; cause the operation instruction transmission part to transmit the operation instruction to the operated part when the type of the operation instruction is an operating requiring authority and an operator has operation authority; and cause the operation log storage part to store the periphery information and the operation log when the type of the operation instruction is the operation requiring authority and the operator does not have operation authority. The operation monitoring system includes the operation device and an external monitoring device.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present application relates to an operating device. [Background technology]

[0002] Automatic control is being implemented in various fields, including automated driving of vehicles, robot control, plant control, machine tool control, etc. When automatic control devices are in operation, operations may occur in emergencies, non-emergency operations performed by an unspecified number of operators, and operations performed only by authorized operators.

[0003] When the operation of an automatic control device has a significant impact on the operation of the automatic control device, the operation is permitted only to operators with specific authority, taking into consideration the importance of the operation. However, for operations that require urgent attention, there may be cases where the operation should not be limited to authorized operators, but should also be permitted to operators without authority.

[0004] Therefore, an operating device and a system that can transfer operation authority from a higher authority holder to a lower authority holder in order to respond to an emergency have been disclosed (for example, Patent Document 1). (For example, Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 5297858 Summary of the Invention [Problem to be solved by the invention]

[0006] Patent Document 1 describes a device and system that rewrites an operator's operation authority file to change operation authority in an emergency. However, this technology requires the operator's operation authority file to be created in advance, and is therefore not applicable to emergency operation instructions for an unspecified number of people. In addition, the circumstances under which the operation was performed are unclear, and although the date and time of the permission change and the operator's name are recorded, it is difficult to later track and confirm the circumstances under which such an operation was performed.

[0007] The present application has been made to solve the above problems, and aims to provide an operating device and an operation monitoring system that allow emergency operation instructions from an unspecified number of people, while storing the circumstances under which the emergency operation instructions were issued and enabling quick tracking and confirmation at low cost. It also aims to not allow operation instructions from unauthorized people regarding important operation instructions that are not urgent, and to store the circumstances under which such operation instructions were issued and enable quick tracking and confirmation at low cost. [Means for solving the problem]

[0008] The operating device according to the present application comprises: an operation interface that receives operation instructions from an operator; an operator authority determination unit that determines whether an operation instruction received by the operation interface is issued by an operator having operation authority; a surrounding information acquisition unit that acquires surrounding information within a predetermined range from an operation interface; an operation type determination unit that determines whether the type of the operation instruction is an emergency operation that requires an emergency response, an authorized operation that does not require an emergency response and requires operation authority, or an unauthorized operation that does not require an emergency response and does not require operation authority; an operation instruction transmission determination unit that determines whether or not the operation instruction can be transmitted to the operated unit based on the type of the operation instruction determined by the operation type determination unit and the presence or absence of the operation authority of the operator determined by the operator authority determination unit, and issues an instruction for transmission; an operation instruction transmission unit that transmits an operation instruction to an operated unit based on an instruction from the operation instruction transmission determination unit; and an operation log storage unit that receives an instruction from an operation instruction transmission determination unit and stores an operation log that is a record of an operation instruction, a time when the operation instruction was given, whether or not the operator has an operation authority, and whether or not the operation instruction was transmitted to an operated unit, The operation instruction transmission determination unit If the type of the operation instruction is an emergency operation, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instruct the operation log storage unit to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit; If the type of the operation instruction is an operation not requiring authority, the operation instruction transmission unit is instructed to transmit the operation instruction to the operated unit; If the type of the operation instruction is an operation requiring authority and the operator has the operation authority, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; If the type of operation instruction is an operation requiring authority and the operator does not have the operation authority, an instruction is given to the operation log storage unit to store the operation log together with the peripheral information.

[0009] The operation monitoring system according to the present application comprises: It is equipped with an operating device and an external monitoring device. [Effects of the Invention]

[0010] According to the operation device and operation monitoring system of the present application, it is possible to obtain an operation device that allows emergency operation instructions from an unspecified number of people, while storing the circumstances under which the emergency operation instructions were made and enabling quick tracking and confirmation at low cost. Also, it is possible to not allow operation instructions from unauthorized people regarding important operation instructions that are not urgent, while storing the circumstances under which such operation instructions were made and enabling quick tracking and confirmation at low cost. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a configuration diagram of an operating device according to a first embodiment. [Figure 2] 3 is a hardware configuration diagram of a control unit of the operating device according to the first embodiment. FIG. [Figure 3] 3 is an explanatory diagram of requirements and processes for each operation type of the operating device according to the first embodiment. FIG. [Figure 4] 4 is a flowchart showing operation types, requirements, and processes of the operation device according to the first embodiment. [Figure 5] FIG. 10 is an explanatory diagram of requirements and processes for each operation type of the operating device according to the second embodiment. [Figure 6] 10 is a flowchart showing operation types, requirements, and processes of an operation device according to a second embodiment. [Figure 7] FIG. 10 is a configuration diagram of an operation device and an operation monitoring system according to a third embodiment. [Figure 8] FIG. 11 is an explanatory diagram of requirements and processes for each operation type of an operating device according to a third embodiment. [Figure 9] 11 is a flowchart showing operation types, requirements, and processes of an operation device according to a third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of an operating device according to the present invention will be described with reference to the drawings.

[0013] 1. First Embodiment <Configuration of the operation device> 1 is a configuration diagram of an operation device 1 according to the first embodiment. The operation device 1 is composed of an operation interface 101, an operator authority detection unit 105, a peripheral information acquisition unit 108, and a control unit 2. The control unit 2 transmits an operation instruction to an operated unit 114 as necessary. The control unit 2 is composed of an operation type determination unit 102, an operator authority determination unit 106, an operation instruction transmission unit 107, an operation instruction transmission determination unit 109, and an operation log storage unit 110.

[0014] <Operation interface> The operation interface 101 includes an input device that accepts operation instructions from an operator. The operation interface 101 may accept instructions from the operator through a touch panel, buttons, a mouse, a keyboard, or non-contact movements, postures, gestures, etc. Alternatively, the operation interface 101 may be a device that accepts operation instructions by recognizing the voice uttered by the operator. The operation interface 101 may be connected to the control unit 2 via a wired connection using a signal line such as USB (Universal Serial Bus) (registered trademark), or a wireless connection such as Wi-Fi (Wireless Fidelity) (registered trademark) or Bluetooth (registered trademark).

[0015] The operation interface 101 may have a display that displays a list of acceptable operation instructions, and a guide that prompts operation by voice output. Furthermore, it may guide operation and accept instructions by text or voice conversation using AI.

[0016] <Operator authority detection section> The operator authority detection unit 105 detects the operator authority of an operator who issues an operation instruction using the operation interface 101. The operator authority may be determined by identifying the operator using an ID and password assigned to a pre-registered operator, an authentication card carried by the operator, a contactless communication key, or a personal authentication function set up in a mobile information terminal such as a smartphone, and detecting the pre-granted operation authority. The authentication device held by the operator may be a device that identifies the operator through wired communication such as a USB connection or LAN (Local Area Network) connection.

[0017] The operator authority detection unit 105 may confirm ID (Identification) through the operator's operation, or may identify the operator by communicating with an authentication device held by the operator operating the operation interface 101 through short-distance non-contact communication using radio waves or ultrasonic waves. For example, RFID (Radio Frequency IDentification) (registered trademark) or the like may be used. The operator authority detection unit 105 may also use a camera, a biometric authentication device, or the like to detect biometric information such as the face, fingerprint, palm print, or retinal blood vessel pattern of the operator operating the operation interface 101, and identify the operator through biometric authentication. To identify an individual, face authentication information, fingerprint information, palm print information, retinal blood vessel pattern information, etc. may be stored as a database, and a machine learning inference model for biometric recognition may be stored.

[0018] <Area information acquisition section> The peripheral information acquisition unit 108 acquires information about the operator present within a predetermined range around the operation interface 101. The peripheral information acquisition unit 108 may be an independent information acquisition device located at a position separate from the control unit 2. Alternatively, the peripheral information acquisition unit 108 may be configured integrally with the control unit 2 and may be a sensor, a camera, a radio wave receiving device, or the like configured in the same housing as the information acquisition unit of the operation device 1.

[0019] The surrounding information acquisition unit 108 can record and record the surrounding situation when an operator who issues an operation instruction for an emergency operation issues the operation instruction using the operation interface 101. When an operator who does not have the operation authority issues an operation instruction that requires operation authority issues the operation instruction using the operation interface 101, the surrounding information acquisition unit 108 can record and record the surrounding situation. This makes it possible to confirm the situation in which the operator issued the operation instruction. It is also possible to attempt to identify the operator from an image of the operator.

[0020] The peripheral information obtained by the peripheral information acquisition unit 108 may contain a large amount of information, such as high-resolution video images. In such cases, transmitting, recording, and storing all of this information places a heavy burden on the equipment. This is because large-scale storage devices are expensive, and an increase in communication volume causes congestion, making it expensive to secure large-capacity communication lines. Therefore, by transmitting and storing the peripheral information at predetermined intervals, it is possible to store meaningful peripheral information while reducing the burden on the storage device and communication device.

[0021] <Operation type determination section> The operation type determination unit 102 determines the type of operation instruction input via the operation interface 101. Operations include emergency operations that require an emergency response, authorized operations that do not require an emergency response and require operating authority, and unauthorized operations that do not require an emergency response and do not require operating authority. The operation type determination unit 102 determines which of these operations the operation instructed corresponds to. The operation type determination unit 102 determines whether the operation instruction is a high-priority operation and whether it is an operation that requires operating authority.

[0022] Possible emergency operations include instructions to make an emergency stop, slow down to a stop, maintain idling, etc. In the case of an autonomous bus in operation, if an unspecified operator (passenger) uses the operation interface 101 at a bus stop to call a bus, this falls under the category of an operation that does not require authorization. In a general system, normal operations such as starting operation, making reservations, and setting operations related to screen displays are low-priority actions, and may also be classified as an operation that does not require authorization.

[0023] Additionally, when an autonomous bus is operating abnormally, an emergency operation occurs when a passerby or a passenger waiting for the bus uses the bus stop operation interface 101 to perform an emergency stop operation on the autonomous bus. Examples of such situations include passing a stop where the bus was supposed to stop, traveling at a speed higher than a predetermined speed, approaching an obstacle abnormally, or entering a prohibited area.

[0024] Furthermore, when an authorized person in charge of managing the operation of an autonomous bus instructs the bus to enter a garage for repairs, charging, cleaning, or other maintenance, this falls under an authorized operation. An instruction to enter a garage may be issued for reasons such as a low battery level of an autonomous bus currently in operation, suspension of operation due to a decrease in the number of passengers, or cleaning of a dirty vehicle. In such cases, operation by an authorized person is required, as it is possible that the operation of other autonomous buses in operation may be affected.

[0025] <Operator authority determination unit> The operator authority determination unit 106 determines the operator authority of the operator based on the information that identifies the operator detected by the operator authority detection unit 105. The operator authority detection unit 105 may detect the operator authority and transmit the result to the operator authority determination unit 106.

[0026] Alternatively, the operator authority detection unit 105 may identify the operator, and the operator authority determination unit 106 may use a database to confirm the authority held by the identified operator. In this way, it is possible to share the processing load and contribute to load leveling.

[0027] <Operation log storage section> In principle, every time an operation instruction is received by the operation interface 101, the operation log storage unit 110 stores an operation log that records the content of the received operation instruction, the time the operation instruction was given, whether the operator has the operating authority, and whether the operation instruction was transmitted to the operated unit. As a result, the status of receiving an operation instruction and the status of responding to the operation instruction are recorded one by one as an operation log.

[0028] Analyzing this operation log can contribute to the frequency of accepting operation instructions, the transition of accepted content, the appropriateness of responses at the time of acceptance, and the investigation of causes when problems occur. In addition, for emergency operations and operation instructions by unauthorized users for authorized operations, storing peripheral information acquired by the peripheral information acquisition unit 108 at the same time can contribute to multifaceted analysis.

[0029] Furthermore, since the peripheral information acquired by the peripheral information acquisition unit 108 is often large-volume information such as high-resolution images, storing peripheral information only for limited scenes can save storage capacity. Furthermore, reducing the information transmission density of the operation device can prevent communication congestion within the operation device and reduce the load. These can also contribute to reducing the cost of the operation device.

[0030] The operation log can be stored in a long-term storage device such as a magnetic disk or magnetic tape. It can also be stored in memory to improve access speed. The operation log storage unit 110 may be provided in a separate location as an operation log storage device independent of the control unit 2. A storage area may be secured using a cloud service for storage. It may also be provided in the same housing as the control unit 2 as an integrated unit.

[0031] An operation log is a record of operation instructions that includes not only the content of the operation instructions, but also the time the operation was performed, whether the operator has the operating authority, and whether the operation instruction was transmitted to the operated unit. These, along with accompanying information such as the name of the operation interface that issued the operation instruction, its location, the operator's ID, the operation type, and the operation target, are called meta-information of the operation instruction. This meta-information makes it possible to analyze various events.

[0032] <Operation instruction transmission determination unit> The operation instruction transmission determination unit 109 determines whether or not to transmit the operation instruction to the operated unit 114, based on the type of operation instruction determined by the operation type determination unit 102 and whether or not the operator has operation authority determined by the operator authority determination unit 106, and issues a transmission instruction. It also instructs the operation log storage unit 110 to store the operation log and, if necessary, to store peripheral information.

[0033] <Operation instruction transmission section> The operation instruction transmission unit 107 transmits an operation instruction to the operated unit 114 based on an instruction from the operation instruction transmission determination unit 109. When the operated unit 114 receives an operation instruction from the operator, it operates a target device in accordance with the instruction. For example, the operated unit 114 may perform an operation such as setting a destination for the autonomous vehicle, changing the destination, or stopping the vehicle.

[0034] <Hardware configuration of the control unit> 2 is a hardware configuration diagram of the control unit 2 of the operating device 1 according to the first embodiment. In this embodiment, each function of the control unit 2 is realized by a processing circuit included in the control unit 2. Specifically, as shown in FIG. 2, the control unit 2 includes, as processing circuits, an arithmetic processing device 90 (computer) such as a CPU (Central Processing Unit), a storage device 91 that exchanges data with the arithmetic processing device 90, an input circuit 92 that inputs external signals to the arithmetic processing device 90, and an output circuit 93 that outputs signals from the arithmetic processing device 90 to the outside.

[0035] The arithmetic processing device 90 may include an ASIC (Application Specific Integrated Circuit), an IC (Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), various logic circuits, various signal processing circuits, etc. Furthermore, a plurality of the same or different types of arithmetic processing device 90 may be provided, and each process may be shared and executed. The storage device 91 may include a RAM (Random Access Memory) configured to be able to read and write data from the arithmetic processing device 90, a ROM (Read Only Memory) configured to be able to read data from the arithmetic processing device 90, a flash memory, etc. The input circuit 92 is connected to various sensors and switches, such as the operation interface 101, the operator authority detection unit 105, and the peripheral information acquisition unit 108, and includes an A / D converter and a communication circuit that input output signals from these sensors and switches to the arithmetic processing device 90. The output circuit 93 is connected to electrical loads such as the operated unit 114 and the external monitoring device 113, and includes a drive circuit or a communication circuit that converts and outputs control signals from the arithmetic processing unit 90 to these electrical loads.

[0036] Each function of the control unit 2 is realized by the arithmetic processing device 90 executing software (programs) stored in a storage device 91 such as a ROM, and cooperating with other hardware of the control unit 2, such as the storage device 91, input circuit 92, and output circuit 93. Setting data such as thresholds and judgment values ​​used by the control unit 2 is stored in the storage device 91 such as a ROM as part of the software (program). The functions of the components of the control unit 2 will be described below. Each function of the control unit 2 may be configured as a software module, or may be configured as a combination of software and hardware.

[0037] <Requirements and processing for each operation type> 3 is an explanatory diagram of requirements and processing for each operation type of the operation device 1 according to the first embodiment. The explanatory diagram of FIG. 3 shows processing performed by the operation instruction transmission determination unit 109 in accordance with the operation type of the operation instruction input through the operation interface 101 and the authority held by the operator. The processing performed by the operation instruction transmission determination unit 109 refers to instructions to the operation log storage unit 110 and instructions to the operation instruction transmission unit 107.

[0038] If the type of operation instruction is an emergency operation, it is not affected by whether or not the operator has the authority. At this time, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by a circle). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit 107 to transmit the operation instruction to the operated unit 114 (indicated by a circle).

[0039] If the type of operation instruction is an unauthorized operation, it is not affected by whether the operator has the authority. In this case, the operation instruction transmission determination unit 109 does not store peripheral information in the operation log storage unit 110 (indicated by x). Although not shown in FIG. 3, the operation log storage unit 110 stores the operation log. Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit 107 to transmit the operation instruction to the operated unit 114 (indicated by ◯).

[0040] If the type of operation instruction is an operation requiring authority and the operator has the operation authority, the operation instruction transmission determination unit 109 does not store peripheral information in the operation log storage unit 110 (indicated by x). Although not shown in Fig. 3, the operation log is stored in the operation log storage unit 110. Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit 107 to transmit the operation instruction to the operated unit 114 (indicated by ◯).

[0041] If the type of operation instruction is an operation requiring authority and the operator does not have the operation authority, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by ○). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit 107 not to transmit the operation instruction to the operated unit 114 (indicated by ×).

[0042] By performing such processing by operation instruction transmission determination unit 109, even if an emergency operation is performed by an unspecified number of operators, the operation instruction can be transmitted to operated unit 114, allowing the emergency operation (for example, an emergency stop of an autonomously driven bus) to be performed. In addition, since an operation log can be stored along with the surrounding information acquired by surrounding information acquisition unit 108 in association with the emergency operation, it is possible to trace and confirm under what circumstances the emergency operation was performed and by whom.

[0043] Furthermore, if an unauthorized operator issues an instruction to perform an authorized operation, this operation is not transmitted to the operated unit 114, thereby eliminating unauthorized operations. In addition, an operation log can be stored together with the peripheral information acquired by the peripheral information acquisition unit 108, making it possible to trace and confirm under what circumstances and by whom this unauthorized operation was performed.

[0044] Such peripheral information is not stored in the case of normal unauthorized operations or transmission of authorized operations by an authorized person. Therefore, the storage capacity of the operation log storage unit 110 is not strained, and the operation device can be realized at low cost.

[0045] <Handling of control device> 4 is a flowchart showing operation types, requirements, and processing of the controller device 1 according to embodiment 1. The processing of the flowchart in FIG.

[0046] 4 may be executed for each event, such as each time an operation instruction is input from the operation interface 101. Alternatively, the process of the flowchart may be executed at predetermined time intervals (for example, every 1 ms) to check whether an operation instruction has been input from the operation interface 101, and if an instruction has been input, the process is executed, and if an instruction has not been input, the process is terminated.

[0047] The process starts, and in step S101, an operation instruction input from the operation interface 101 is acquired. In step S102, the surrounding information acquisition unit 108 acquires surrounding information.

[0048] In step S103, the information detected by the operator authority detection unit 105 is taken in, and the operator authority is determined by the operator authority determination unit 106. Then, in step S104, the operation type determination unit 102 determines the type of operation.

[0049] In step S105, it is determined whether the type of operation is an emergency operation. If the type of operation is an emergency operation (determination is YES), the process proceeds to step S113. If the type of operation is not an emergency operation (determination is NO), the process proceeds to step S106.

[0050] In step S106, it is determined whether the type of operation is an authorized operation. If the type of operation is an authorized operation (determination is YES), proceed to step S112. If the type of operation is not an authorized operation (determination is NO), proceed to step S107. In this case, the type of operation is an authorized operation.

[0051] In step S107, it is determined whether the operator has authority. In this case, it is determined whether the operator has operation authority for the operation requiring authority. If the operator has authority (determination is YES), the process proceeds to step S112. If the operator does not have authority (determination is NO), the process proceeds to step S110. At this time, an operation requiring authority has been instructed by an operator without authority.

[0052] In step S110, the peripheral information is stored in the operation log storage unit 110. This stores peripheral information about an unauthorized operator who has instructed an authorized operation. It is possible to trace and confirm the circumstances under which this unauthorized operation was performed and by whom. In step S111, the operation log is stored in the operation log storage unit 110. By storing this operation log and peripheral information simultaneously, it becomes possible to confirm the circumstances under which the operation was performed from multiple perspectives.

[0053] In step S113, if an emergency operation has been performed, an operation instruction is transmitted to the operated unit 114, allowing the emergency operation (for example, an emergency stop of an autonomously driven bus) to be performed. Then, in step S110, the surrounding information is stored, and in step S111, the operation log is stored and the process ends. This makes it possible to trace and confirm the situation under which the emergency operation was performed and by whom. By storing this operation log and surrounding information simultaneously, it becomes possible to confirm the situation under which the operation was performed from multiple perspectives.

[0054] In step S112, an operation not requiring authority or an operation requiring authority is instructed by an authorized person. At this time, the operation instruction is transmitted to the operated unit 114. Thereafter, the peripheral information is not stored, and the operation log is stored in step S111, and the process ends. As a result, when normal, normal processing is performed, the peripheral information is not stored, and it is possible to suppress the capacity burden on the operation log storage unit 110 and an increase in communication capacity. This can contribute to reducing the cost of the operating device.

[0055] 2. Second Embodiment The configuration of the operation device 1 according to the second embodiment is the same as that of the first embodiment, and is shown in Fig. 1. The operation device 1 according to the second embodiment differs from the first embodiment in how it responds when it receives an operation instruction from an operator for an operation requiring authority according to the first embodiment.

[0056] In the operation device 1 according to the first embodiment, unless the operator is an authorized person having operation authority, the transmission of an authority-requiring operation to the operated unit 114 is not permitted. In contrast, the operation device 1 according to the second embodiment is different in that even if the operator does not have operation authority for an authority-requiring operation, the transfer to the operated unit 114 is permitted if specific requirements are met.

[0057] <Within a specified time from operation by an authorized person> As a first example of a specific requirement, a case will be described in which an operation instruction by an unauthorized person is permitted if an operation instruction for an operation requiring authority is given by an authorized person within a predetermined time (T1 period) from the current time. The fact that an operation instruction for an operation requiring authority was given by an authorized person at a time close to the present can be found from the operation log stored in the operation log storage unit 110. If the operation log storage unit 110 contains an operation log relating to an operation by an operator with operation authority within the T1 period from the current time, the operation instruction transmission unit is instructed to transmit the operation instruction to the operated unit.

[0058] If an operation instruction was being given by an authorized person until just before, it is possible that the authorized person is temporarily away from the operation interface 101 but is nearby. It is also possible that the authorized person is watching over the operation if an unauthorized operator has temporarily taken over the operation.

[0059] <Operation log storage section> If the operation log storage unit 110 contains an operation log relating to an operation by an operator with operation authority within a period T1 from the current time, the operation instruction transmission unit is instructed to transmit the operation instruction to the operated unit. In this way, the operation instruction given by the authorized person up until just before can be taken over.

[0060] <An authorized person exists near the operation log storage unit 110> As a second example of a specific requirement, it is noted that even if an operator operating the operation interface 101 does not have the operation authority, if there is an authorized person with operation authority nearby the operator, the operator's operation instructions may be approved.

[0061] Possible cases include when an authorized person having operation authority is too busy to operate directly, when the authorized person is injured and unable to move, when the authorized person has lost consciousness, etc. The surrounding information acquired by the surrounding information acquisition unit 108 makes it possible to confirm the presence of an authorized person around the operation interface 101.

[0062] <Area information acquisition section> The surrounding information acquisition unit 108 scans the set space using a camera, laser radar, LiDAR (Light Detection and Ranging), a thermal sensor, a radio wave receiver / transmitter, an infrared receiver / transmitter, etc. The presence of an authorized person within a predetermined distance around the operation interface 101 may be estimated using an authentication card carried by the operator, a contactless communication key, or a personal authentication function set up in a mobile information terminal such as a smartphone. Furthermore, the authorized person may be identified from an image captured by a camera based on an authentication card, face, fingerprint, palm print, retinal vascular pattern, etc. carried by a person around the operation interface 101.

[0063] <Requirements and processing for each operation type> Fig. 5 is an explanatory diagram of requirements and processing for each operation type of the operation device 1 according to embodiment 2. The explanatory diagram of Fig. 5 shows processing performed by the operation instruction transmission determination unit 109 in accordance with the operation type of the operation instruction input through the operation interface 101, the authority held by the operator, and other requirements. The processing performed by the operation instruction transmission determination unit 109 refers to instructions to the operation log storage unit 110 and instructions to the operation instruction transmission unit 107.

[0064] 3, which is an explanatory diagram of the requirements and processing for each operation type of the operating device 1 according to the first embodiment, differs in that, in addition to the requirement that the operator has or does not have the operating authority, the requirements that the period T1 has elapsed since the operation by an authorized person and that an authorized person is present in the vicinity have been added. Also, it is clearly stated that the operation log is stored as processing in all cases.

[0065] 3 according to the first embodiment, the case where the requirements are different will be described, and the description of the similar parts will be omitted. That is, the description of the emergency operation, the operation not requiring authority, and the case where the operator has authority for the operation requiring authority will be omitted.

[0066] The following describes a case where the type is an authorized operation, the operator does not have the operation authority, and an operation log relating to an operation by an operator with operation authority within a period T1 from the current time exists in the operation log storage unit 110. In this case, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by ○). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit to transmit the operation instruction to the operated unit (indicated by ○).

[0067] Next, we will explain the case where the type is an authorized operation, the operator does not have the operation authority, and the peripheral information acquired by the peripheral information acquisition unit includes at least one of authentication information of an authentication device held by the authorized person or biometric information of the authorized person. In this case, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by ○). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit to transmit the operation instruction to the operated unit (indicated by ○).

[0068] Next, we will explain a case where the type is an authorized operation, the operator does not have the operation authority, and the peripheral information acquired by the peripheral information acquisition unit does not include both the authentication information of the authentication device held by the authorized person and the biometric information of the authorized person. In this case, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by ○). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit (indicated by ×).

[0069] By performing such processing by the operation instruction transmission determination unit 109, even if the type is an authorized operation and the operator does not have the operation authority, if there is an operation log related to an operation by an operator who has operation authority within a period T1 from the current time, and if the peripheral information acquired by the peripheral information acquisition unit includes at least one of authentication information of an authentication device held by the authorized person or biometric information of the authorized person, the operation instruction transmission determination unit 109 can instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit. As a result, if the type is an authorized operation, the authorized operation can be continued without interruption.

[0070] This improves the reliability of the operation device. In addition, in this case, it is possible to trace and confirm under what circumstances an operation requiring authority was performed and by whom. Furthermore, since storage of peripheral information is limited to specific cases, it is possible to prevent the operation log storage unit 110 from requiring excessive capacity, and to prevent the communication volume of the operation device 1 from becoming excessive. Therefore, the operation device 1 can be realized at low cost.

[0071] <Handling of control device> 6 is a flowchart showing operation types, requirements, and processing of the controller device 1 according to embodiment 2. The processing of the flowchart in FIG.

[0072] 6 may be executed for each event, such as each time an operation instruction is input from the operation interface 101. Alternatively, the process of the flowchart may be executed at predetermined time intervals (for example, every 1 ms) to check whether an operation instruction has been input from the operation interface 101, and if an instruction has been input, the process may be executed, and if an instruction has not been input, the process may be terminated.

[0073] 6 according to the second embodiment differs from the flowchart of FIG. 4 according to the first embodiment only in that steps S108 and S109 are added after step S107. Here, only the different parts will be described.

[0074] Step S108 is a process that is selected when the type of operation in step S107 is an authorized operation and the operator does not have the authority. In step S108, it is determined whether it has been less than T1 period since the authorized person gave an instruction to operate the authorized operation. If it has been less than T1 period (determination is YES), proceed to step S113. If it has not been less than T1 period (determination is NO), proceed to step S109.

[0075] In step S109, it is determined whether the surrounding information acquired by the surrounding information acquisition unit includes at least one of authentication information of an authentication device held by the authorized person and biometric information of the authorized person. The flowchart abbreviates the description to determine whether an authorized person is present in the vicinity. If an authorized person is present in the vicinity (determination is YES), the process proceeds to step S113. If an authorized person is not present in the vicinity (determination is NO), the process proceeds to step S110. In this case, the operation instruction for an authorized operation by an unauthorized person is not transmitted to the operated unit 114.

[0076] In step S113, when an emergency operation is performed, when an operator who is not an authorized person issues an operation instruction for an operation requiring authority, and when the time period T1 has elapsed since the operation instruction was issued by the authorized person, or when an authorized person is present in the vicinity, this is selected. In this case, not only is the operation instruction transmitted to the operated unit 114 in step S113, but peripheral information is stored in step S110, and an operation log is stored in step S111.

[0077] 3. Embodiment 3 <Configuration of operation device and operation monitoring system> Fig. 7 is a configuration diagram of an operation device 1 and an operation monitoring system 100 according to embodiment 3. The difference from Fig. 1 according to embodiment 1 is that an external monitoring device 113 is connected to the operation device 1, and that an operation monitoring system 100 consisting of the operation device 1, the external monitoring device 113, and an operated unit 114 is provided.

[0078] In the first embodiment, if the requirements for an authority-requiring operation are not met, the authority-requiring operation is not transmitted to the operated unit 114. However, the operating device 1 according to the third embodiment is different in that it inquires of the external monitoring device 113 about whether or not an operation instruction can be transmitted to the operated unit 114, and follows the instruction of the external monitoring device 113.

[0079] When inquiring of the external monitoring device 113 as to whether or not the operation instruction can be transmitted to the operated unit 114, the peripheral information acquired by the peripheral information acquisition unit 108 may be transmitted to the external monitoring device 113. This is because the external monitoring device 113 can more appropriately determine whether or not the operation instruction can be transmitted to the operated unit 114 by checking the peripheral information.

[0080] <Requirements and processing for each operation type> Fig. 8 is an explanatory diagram of requirements and processing for each operation type of the operation device 1 according to embodiment 3. The explanatory diagram of Fig. 8 shows processing performed by the operation instruction transmission determination unit 109 in accordance with the operation type of the operation instruction input through the operation interface 101, the authority held by the operator, and instructions from the external monitoring device. The processing performed by the operation instruction transmission determination unit 109 refers to instructions to the operation log storage unit 110 and instructions to the operation instruction transmission unit 107.

[0081] The difference from FIG. 3, which is an explanatory diagram of the requirements and processing for each operation type of the operating device 1 according to the first embodiment, is that in addition to the requirement of whether or not the operator has the operating authority, a requirement has been added regarding whether or not there is an instruction to transmit an operating instruction from the external monitoring device 113 to the operated unit 114.

[0082] 3 according to the first embodiment, the case where the requirements are different will be described, and the description of the similar parts will be omitted. That is, the description of the emergency operation, the operation not requiring authority, and the case where the operator has authority for the operation requiring authority will be omitted.

[0083] When the type is an authorized operation and the operator does not have the operation authority, the external monitoring device is inquired about whether or not the operation instruction can be transmitted, and a case where an operation instruction transmission instruction is received from the external monitoring device will be described. At this time, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by a circle). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit to transmit the operation instruction to the operated unit (indicated by a circle).

[0084] When the type is an authorized operation and the operator does not have the operation authority, the external monitoring device is inquired about whether or not the operation instruction can be transmitted, and a case where there is no instruction to transmit the operation instruction from the external monitoring device (when there is an instruction not to transmit the operation instruction) will be described. In this case, the operation instruction transmission determination unit 109 instructs the operation log storage unit 110 to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108 (indicated by ○). Then, the operation instruction transmission determination unit 109 instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit (indicated by ×).

[0085] In the operation device 1 according to the first embodiment, if the operator does not have enough authority for an operation requiring authority, the operation instruction is not transmitted to the operated unit 114. However, when an authorized person with sufficient authority is not present at the site, it is conceivable that real-time monitoring is being performed and an authorized person wants to permit the transmission of the operation instruction remotely. In such a case, the operation device 1 according to the third embodiment can handle it by querying the external monitoring device 113 and following the instructions from the external monitoring device 113.

[0086] This makes it possible to avoid interruptions and delays in operation instructions from the operation device and continue operation instructions, thereby improving the reliability of the operation device.

[0087] Even when an instruction from the external monitoring device 113 is followed, by storing the operation log together with the peripheral information acquired by the peripheral information acquisition unit 108, it is possible to trace and confirm under what circumstances an authorized operation was performed and by whom. Furthermore, by limiting the storage of peripheral information to specific cases, it is possible to prevent an increase in the storage capacity of the operation log storage unit 110 and suppress an increase in communication traffic. This makes it possible to realize the operation device 1 and the operation monitoring system at low cost.

[0088] <Handling of control device> 9 is a flowchart showing operation types, requirements, and processing of the controller device 1 according to embodiment 3. The processing of the flowchart in FIG.

[0089] 9 may be executed for each event, such as each time an operation instruction is input from the operation interface 101. Alternatively, the process of the flowchart may be executed at predetermined time intervals (for example, every 1 ms) to check whether an operation instruction has been input from the operation interface 101, and if an instruction has been input, the process is executed, and if an instruction has not been input, the process is terminated.

[0090] 9 according to the third embodiment differs from the flowchart of FIG. 4 according to the first embodiment only in that steps S114, S115, and S116 are added after step S107. Here, only the different parts will be described.

[0091] Step S114 is a process selected when the type of operation is an authorized operation in step S107 and the operator does not have the authorization. In step S114, the peripheral information acquired by the peripheral information acquisition unit 108 is transmitted to the external monitoring device 113. Then, in step S115, the external monitoring device 113 is inquired about whether or not the operation instruction can be transmitted to the operated unit 114, and a response is obtained from the external monitoring device 113.

[0092] In step S116, it is determined whether or not there has been an instruction from the external monitoring device 113 to transmit the operation instruction to the operated unit 114. If there has been an instruction to transmit the operation instruction (determination is YES), the process proceeds to step S113. If there has not been an instruction to transmit the operation instruction from the external monitoring device 113 to the operated unit 114 (determination is NO), the process proceeds to step S110. In this case, the operation instruction for an authorized operation by an unauthorized person is not transmitted to the operated unit 114.

[0093] Step S113 is selected when an emergency operation is performed, or when an operator who is not an authorized person issues an operation instruction for an operation requiring authorization, and when an instruction to transmit the operation instruction is received from external monitoring device 113. In this case, not only is the operation instruction transmitted to operated unit 114 in step S113, but peripheral information is also stored in step S110, and an operation log is also stored in step S111.

[0094] Although various exemplary embodiments and examples are described in this application, the various features, aspects, and functions described in one or more embodiments are not limited to the application of a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless variations not illustrated are contemplated within the scope of the technology disclosed in this specification. For example, this includes cases where at least one component is modified, added, or omitted, or where at least one component is extracted and combined with components of another embodiment.

[0095] Various aspects of the present disclosure are summarized below as appendices.

[0096] (Appendix 1) an operation interface that receives operation instructions from an operator; an operator authority determination unit that determines whether the operation instruction received by the operation interface is issued by an operator having operation authority; a surrounding information acquisition unit that acquires surrounding information within a predetermined range from the operation interface; an operation type determination unit that determines whether the type of the operation instruction is an emergency operation that requires an emergency response, an authorized operation that does not require an emergency response and requires the operation authority, or an unauthorized operation that does not require an emergency response and does not require the operation authority; an operation instruction transmission determination unit that determines whether or not the operation instruction can be transmitted to an operated unit based on the type of the operation instruction determined by the operation type determination unit and the presence or absence of the operation authority of the operator determined by the operator authority determination unit, and issues an instruction for transmission; an operation instruction transmission unit that transmits the operation instruction to an operated unit based on an instruction from the operation instruction transmission determination unit; and an operation log storage unit that receives an instruction from the operation instruction transmission determination unit and stores an operation log that is a record of the operation instruction, the time when the operation instruction was given, whether or not the operator has the operation authority, and whether or not the operation instruction was transmitted to the operated unit, The operation instruction transmission determination unit when the type of the operation instruction is the emergency operation, instructing the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instructing the operation log storage unit to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit; If the type of the operation instruction is the unauthorized operation, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; If the type of the operation instruction is the operation requiring authority and the operator has the operation authority, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; If the type of the operation instruction is an operation requiring authority and the operator does not have the operation authority, the operation device instructs the operation log storage unit to store the operation log together with the peripheral information. (Appendix 2) The operation instruction transmission determination unit when the type of the operation instruction is the emergency operation, instructing the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instructing the operation log storage unit to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit; If the type is the unauthorized operation, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instruct the operation log storage unit to store the operation log; An operating device as described in Appendix 1, which, when the type is the operation requiring authority and the operator has the operation authority, instructs the operation instruction transmission unit to transmit the operation instruction to the operated unit and instructs the operation log storage unit to store the operation log. (Appendix 3) The operation instruction transmission determination unit If the type is the authority-required operation and the operator does not have the operation authority, if the operation log storage unit contains an operation log relating to an operation by the operator who has the operation authority within a predetermined time from the current time, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; When the type is an operation requiring authority and the operator does not have the operation authority, if there is no operation log in the operation log storage unit relating to an operation by the operator who has the operation authority within a predetermined time from the current time, the operation device described in Appendix 2 instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit. (Appendix 4) The operation device according to claim 1 or 2, wherein the operator authority determination unit determines whether or not an operator has the operation authority based on at least one of authentication information of an authentication device held by an authorized person having the operation authority or biometric information of the authorized person. (Appendix 5) The operation instruction transmission determination unit When the type is the authorized operation and the operator does not have the operation authority, if the peripheral information acquired by the peripheral information acquisition unit includes at least one of the authentication information of the authentication device held by the authorized person or the biometric information of the authorized person, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; An operating device as described in Appendix 4, wherein if the type is an operation requiring authority and the operator does not have the operating authority, and if the peripheral information acquired by the peripheral information acquisition unit does not include both the authentication information of the authentication device held by the authorized person and the biometric information of the authorized person, the operating device instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit. (Appendix 6) The operation instruction transmission determination unit is connected to an external monitoring device that causes the operation instruction transmission determination unit to issue an instruction to transmit the operation instruction to the operated unit, and if the type is the authority-required operation and the operator does not have the operation authority, it queries the external monitoring device as to whether the operation instruction can be transmitted, and if there is an operation instruction transmission instruction from the external monitoring device, it instructs the operation instruction transmission unit to transmit the operation instruction to the operated unit, and if there is no operation instruction transmission instruction from the external monitoring device, it instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit. (Appendix 7) The operation device described in Appendix 6, wherein the operation instruction transmission determination unit inquires of the external monitoring device as to whether or not the operation instruction can be transmitted when the type is the operation requiring authority and the operator does not have the operation authority, and transmits the peripheral information acquired by the peripheral information acquisition unit. (Appendix 8) The operation instruction transmission determination unit An operating device as described in Appendix 1 or 2, wherein, if the type of the operation instruction is an operation requiring authority and the operator does not have the operation authority, the operating device instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit. (Appendix 9) The operation device according to any one of appendices 1 to 8, wherein the operation interface has at least one function of guiding an operation by a display screen or audio output, or operation by a touch panel or non-contact operation. (Appendix 10) The operating device according to any one of Supplementary Notes 1 to 9, wherein the surrounding information acquisition unit scans space using a camera, a receiver, or a radar to acquire authentication information of an authentication device owned by an authorized person who has the operating authority, or biometric authentication of the authorized person. (Appendix 11) 11. The operating device according to claim 1, wherein the peripheral information acquisition unit outputs the acquired information at predetermined intervals. (Claim 12) An operation monitoring system comprising the operation device according to appendix 6 or 7 and the external monitoring device. [Explanation of symbols]

[0097] 1 Operation device, 100 Operation monitoring system, 101 Operation interface, 102 Operation type determination unit, 105 Operator authority detection unit, 106 Operator authority determination unit, 107 Operation instruction transmission unit, 108 Peripheral information acquisition unit, 109 Operation instruction transmission determination unit, 110 Operation log storage unit, 113 External monitoring device, 114 Operated unit

Claims

1. an operation interface that receives operation instructions from an operator; an operator authority determination unit that determines whether the operation instruction received by the operation interface is issued by an operator having operation authority; a surrounding information acquisition unit that acquires surrounding information within a predetermined range from the operation interface; an operation type determination unit that determines whether the type of the operation instruction is an emergency operation that requires an emergency response, an authorized operation that does not require an emergency response and requires the operation authority, or an unauthorized operation that does not require an emergency response and does not require the operation authority; an operation instruction transmission determination unit that determines whether or not the operation instruction can be transmitted to an operated unit based on the type of the operation instruction determined by the operation type determination unit and the presence or absence of the operation authority of the operator determined by the operator authority determination unit, and issues an instruction for transmission; an operation instruction transmission unit that transmits the operation instruction to an operated unit based on an instruction from the operation instruction transmission determination unit; and an operation log storage unit that receives an instruction from the operation instruction transmission determination unit and stores an operation log that is a record of the operation instruction, the time when the operation instruction was given, whether or not the operator has the operation authority, and whether or not the operation instruction was transmitted to the operated unit, The operation instruction transmission determination unit when the type of the operation instruction is the emergency operation, instructing the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instructing the operation log storage unit to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit; If the type of the operation instruction is the unauthorized operation, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; If the type of the operation instruction is the operation requiring authority and the operator has the operation authority, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; If the type of the operation instruction is an operation requiring authority and the operator does not have the operation authority, the operation device instructs the operation log storage unit to store the operation log together with the peripheral information.

2. The operation instruction transmission determination unit when the type of the operation instruction is the emergency operation, instructing the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instructing the operation log storage unit to store the operation log together with the peripheral information acquired by the peripheral information acquisition unit; If the type is the unauthorized operation, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit, and instruct the operation log storage unit to store the operation log; An operating device as described in claim 1, wherein, when the type is the operation requiring authority and the operator has the operation authority, the operating instruction transmission unit is instructed to transmit the operation instruction to the operated unit, and the operation log storage unit is instructed to store the operation log.

3. The operation instruction transmission determination unit If the type is the authority-required operation and the operator does not have the operation authority, if the operation log storage unit contains an operation log relating to an operation by the operator who has the operation authority within a predetermined time from the current time, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; 3. The operating device according to claim 2, wherein if the type is an operation requiring authority and the operator does not have the operating authority, and if the operation log storage unit does not contain an operation log relating to an operation by the operator who has the operating authority within a predetermined time from the current time, the operating device instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit.

4. The operation device according to claim 1 , wherein the operator authority determination unit determines whether or not an authorized person has the operation authority based on at least one of authentication information of an authentication device held by the authorized person having the operation authority and biometric information of the authorized person.

5. The operation instruction transmission determination unit When the type is the authorized operation and the operator does not have the operation authority, if the peripheral information acquired by the peripheral information acquisition unit includes at least one of the authentication information of the authentication device held by the authorized person or the biometric information of the authorized person, instruct the operation instruction transmission unit to transmit the operation instruction to the operated unit; An operating device as described in claim 4, wherein when the type is an operation requiring authority and the operator does not have the operating authority, if the peripheral information acquired by the peripheral information acquisition unit does not include both the authentication information of the authentication device held by the authorized person and the biometric information of the authorized person, the operating instruction transmission unit is instructed not to transmit the operation instruction to the operated unit.

6. The operation instruction transmission judgment unit is connected to an external monitoring device that issues an instruction to the operation instruction transmission judgment unit to transmit the operation instruction to the operated unit, and if the type is the authority-required operation and the operator does not have the operation authority, it queries the external monitoring device as to whether the operation instruction can be transmitted, and if an operation instruction transmission instruction is received from the external monitoring device, it instructs the operation instruction transmission unit to transmit the operation instruction to the operated unit, and if an operation instruction transmission instruction is not received from the external monitoring device, it instructs the operation instruction transmission unit not to transmit the operation instruction to the operated unit.

7. The operation device according to claim 6, wherein the operation instruction transmission determination unit inquires of the external monitoring device as to whether or not the operation instruction can be transmitted when the type is the operation requiring authority and the operator does not have the operation authority, and transmits the peripheral information acquired by the peripheral information acquisition unit.

8. The operation instruction transmission determination unit The operating device according to claim 1, wherein if the type of the operation instruction is an operation requiring authority and the operator does not have the operation authority, the operating instruction transmission unit is instructed not to transmit the operation instruction to the operated unit.

9. The operating device according to claim 1 , wherein the operating interface has at least one of the functions of guiding an operation on a display screen or by audio output, and of operating by a touch panel or by non-contact operation.

10. The operating device according to claim 1 , wherein the surrounding information acquisition unit scans space using a camera, a receiver, or a radar to acquire authentication information of an authentication device owned by an authorized person who has the operating authority, or biometric authentication of the authorized person.

11. The operating device according to claim 1 , wherein the peripheral information acquisition unit outputs the acquired information at predetermined intervals.

12. An operation monitoring system comprising the operation device according to claim 6 or 7 and the external monitoring device.

Images