Protection system, protection method, and program

Abstract

[Problem] To perform appropriate monitoring in order to protect a system that transmits haptic force. [Solution] A protection system S is provided with: a control parameter monitoring unit 412 and a communication quality monitoring unit 413; an abnormality detection unit 414; and a stopping unit 415. The control parameter monitoring unit 412 and the communication quality monitoring unit 413 monitor a communication circuit that chronologically transits and receives control parameters for transmitting haptic force, when a predetermined action, which is accompanied by haptic force transmission, is executed by a first drive device 10 and a second drive device 20. The abnormality detection unit 414 detects an abnormality relating to the execution of the predetermined action, on the basis of the monitoring results of the control parameter monitoring unit 412 and the communication quality monitoring unit 413. The stopping unit 415 stops the execution of the predetermined action by controlling the driving of at least either the first drive device 10 or the second drive device 20 when the abnormality detection unit 414 detects an abnormality relating to the execution of the predetermined action.

Description

Protection system, protection method, and program

[0001] The present invention relates to a protection system, a protection method, and a program.

[0002] Conventionally, there is a technology that realizes the transmission of haptic sensations between devices by converting the haptic sensation (for example, the hardness or softness of an object) felt when touching an object into data.

[0003] An example of such a technology is disclosed in Patent Document 1. The technology disclosed in Patent Document 1 converts haptic sensations into digital data and transmits and receives them, thereby enabling the transmission of haptic sensations between a multi-fingered device worn by a user (i.e., a master device) and a robot manipulator that grasps an object (i.e., a slave device).

[0004] JP 2009-289179 A

[0005] Regardless of the transmission of haptic sensations, when using a driving device such as a robot manipulator, it is important to quickly perform protective measures such as a safety shutdown if the driving device malfunctions. To achieve this, typical protective measures monitor the driving status of the driving device. However, in a special system that transmits haptic sensations between a master device and a slave device, such as that disclosed in Patent Document 1, it is also necessary to monitor the master device and the slave device, as well as the communication path that transmits and receives data for transmitting haptic sensations between them. Therefore, even if typical protective measures are applied directly to such a special system that transmits haptic sensations, it is difficult to perform appropriate monitoring.

[0006] The present invention has been made in view of the above circumstances, and an object of the present invention is to perform appropriate monitoring in order to protect a system that transmits haptic sensations.

[0007] In order to solve the above problem, a protection system according to one embodiment of the present invention is characterized by comprising: a monitoring means for monitoring a communication path that sends and receives control parameters for transmitting haptic sensations in chronological order when a predetermined action involving the transmission of haptic sensations by a first drive device and a second drive device is being performed; a detection means for detecting an abnormality in the execution of the predetermined action based on the monitoring results by the monitoring means; and a stop means for stopping the execution of the predetermined action by controlling the drive of at least one of the first drive device and the second drive device when the detection means detects an abnormality in the execution of the predetermined action.

[0008] According to the present invention, appropriate monitoring can be performed to protect the system that transmits haptic sensations.

[0009] FIG. 1 is a block diagram showing an example of the overall configuration of a protection system S according to an embodiment of the present invention. FIG. 2 is a block diagram showing the hardware configuration and functional configuration of a first drive unit 10, a second drive unit 20, a control unit 30-1, and a control unit 30-2. FIG. 3 is a block diagram showing a control algorithm for transmitting haptics in a haptic control unit 321. FIG. 4 is a block diagram showing the hardware configuration and functional configuration of a protection device 40. FIG. 5 is a flowchart illustrating the flow of haptic transmission processing executed by the protection system S. FIG. 6 is a flowchart illustrating the flow of protection processing executed by the protection system S.

[0010] An example of an embodiment of the present invention will now be described with reference to the accompanying drawings.

[0011] [System Configuration] Fig. 1 is a block diagram showing the overall configuration of a protection system S according to this embodiment. As shown in Fig. 1, the protection system S includes a first driving unit 10, a second driving unit 20, a plurality of control units 30, a plurality of protection units 40, and a plurality of external units 50. In this embodiment, these units are disposed at two bases. Specifically, at the first base, the first driving unit 10, a control unit 30-1, a protection unit 40-1, and an external unit 50-1 are disposed so as to be able to communicate with each other via wire or wirelessly. Meanwhile, at the second base, the second driving unit 20, a control unit 30-2, a protection unit 40-2, and an external unit 50-2 are disposed so as to be able to communicate with each other via wire or wirelessly.

[0012] The protection device 40-1 at the first base and the protection device 40-2 at the second base are connected to each other via a network N so that they can communicate with each other via a wired or wireless connection. This network N is realized by a network such as a LAN (Local Area Network) or the Internet. It is assumed that this network N is not a bandwidth-guaranteed network in which a predetermined communication speed is guaranteed, but a best-effort network in which a predetermined communication speed is not guaranteed.

[0013] In this embodiment, for clarity of explanation, it is assumed that there are only two bases, but this is not limited to this. A larger number of bases may exist. Furthermore, a plurality of first drive units 10 and second drive units 20 may be arranged at one base, or both the first drive unit 10 and the second drive unit 20 may be arranged at one base. In the following explanation, when the devices at these bases are described without distinction, some of the reference numerals will be omitted. For example, when the control device 30-1 and the control device 30-2 are described without distinction, some of the reference numerals will be omitted and they will simply be referred to as "control device 30."

[0014] In the protection system S, under the control of the control device 30, the first drive device 10 and the second drive device 20 are driven cooperatively to perform a predetermined action involving contact with an object. In this case, the first drive device 10 operates as a master device to drive a first mechanism that accepts operation from a user. Meanwhile, the second drive device 20 operates as a slave device to drive a second mechanism that contacts an object. The control device 30 also performs control (bilateral control) to transmit haptic sensations between the first mechanism driven by the first drive device 10 and the second mechanism driven by the second drive device 20. As a result, the user's operation on the first mechanism (position and force input) is transmitted to the second mechanism, and a reaction force (position and force response) from the second mechanism is transmitted to the first mechanism, thereby performing the predetermined action.

[0015] To achieve this transmission of haptic sensations, the control devices 30-1 and 30-2 synchronize by transmitting and receiving control parameters for transmitting haptic sensations in chronological order. The protection devices 40-1 and 40-2 also relay these transmitted and received control parameters in chronological order via the network N. That is, the protection devices 40-1 and 40-2 and the network N function as a communication path for transmitting and receiving control parameters. In the figure, the connection relationships between devices for transmitting and receiving control parameters are indicated by solid lines. Meanwhile, the connection relationships between devices for other purposes are indicated by dashed lines. Details of the information transmitted and received in the connections indicated by the dashed lines and the external device 50 will be described later.

[0016] The protection device 40 not only relays the control parameters, but also quickly performs protective processing such as a safety stop to prevent damage to the drive devices or the object in the event of a malfunction of the first drive device 10 or the second drive device 20 or a communication delay on the network N. To this end, the protection device 40 monitors the communication path for sending and receiving control parameters for transmitting haptics in chronological order when the first drive device 10 and the second drive device 20 perform a predetermined action involving the transmission of haptics.

[0017] Furthermore, the protection device 40 detects an abnormality related to the execution of a predetermined action based on the monitoring results. Furthermore, when the protection device 40 detects an abnormality related to the execution of a predetermined action, the protection device 40 controls the driving of at least one of the first drive device 10 and the second drive device 20 to stop the execution of the predetermined action.

[0018] In this way, the protection system S can detect abnormalities in the predetermined actions performed by the first drive unit 10 and the second drive unit 20 simply by monitoring the communication path for transmitting and receiving control parameters in chronological order. That is, the protection system S can perform appropriate monitoring by utilizing a configuration unique to a special system, namely, transmitting and receiving control parameters in chronological order. In addition, the protection system S can also appropriately protect the monitored system by stopping the execution of the predetermined action based on the results of this appropriate monitoring. Therefore, the protection system S can solve the problem of performing appropriate monitoring to protect a system that transmits haptics.

[0019] [Device Configuration] Next, the configuration of each device included in the protection system S will be described. Fig. 2 is a block diagram showing the hardware configuration and functional configuration of the first drive device 10, the second drive device 20, the control device 30-1, and the control device 30-2. As shown in Fig. 2, the first drive device 10 includes an actuator 12 for driving the first mechanism 15, a driver 11 for driving the actuator 12, and a position sensor 13 for detecting the position of a moving object moved by the actuator 12. The second drive device 20 includes an actuator 22 for driving the second mechanism 25, a driver 21 for driving the actuator 22, and a position sensor 23 for detecting the position of a moving object moved by the actuator 22.

[0020] In this case, the position of the moving object detected by the position sensor 13 is, for example, the position of a predetermined part of the first mechanism 15 or the position of a predetermined part of the user operating the first mechanism 15. Furthermore, the position of the moving object detected by the position sensor 23 is, for example, the position of a predetermined part of the second mechanism 25 or the position of a predetermined part of an object that comes into contact with the second mechanism 25 to be grasped, processed, or moved.

[0021] However, in this embodiment, instead of detecting the positions of these moving objects, the rotational angle of the output shaft of each actuator may be detected by a rotary encoder built into each actuator. That is, in this embodiment, the concept of position is considered to include an angle (e.g., the rotational angle of the output shaft of the actuator), and information related to position is considered to include position, angle, velocity, angular velocity, acceleration, and angular acceleration. Furthermore, since position and velocity (or acceleration) or angle and angular velocity (or angular acceleration) are parameters that can be replaced by differential and integral calculations, when processing position or angle, it is possible to replace them with velocity or angular velocity, etc. as appropriate before processing.

[0022] The first mechanism 15 is a mechanism that functions as an operating tool that accepts user operation, and its shape and structure are not particularly limited. For example, the first mechanism 15 may be realized by a controller with a movable part that accepts user operation, or a device shaped like a finger worn by the user. The second mechanism 25 is a mechanism that comes into contact with an object to grasp, process, or move it, and its shape and structure are not particularly limited. For example, the second mechanism 25 may be realized by a robot manipulator that comes into contact with an object to grasp or move it, or a robot arm that is equipped with (or has attached) a tool that processes an object.

[0023] Each of the control devices 30-1 and 30-2 includes a communication unit 31 and an integrated circuit 32. The communication unit 31 controls communication with other devices (e.g., a protection device 40 located at the same base as the control device 30 itself). Note that FIG. 2 does not illustrate the protection devices 40-1 and 40-2, and the network N, which serve as communication paths when transmitting and receiving control parameters between the control devices 30-1 and 30-2. The integrated circuit 32 is an integrated circuit (IC) that causes the haptic control unit 321 to function. The integrated circuit 32 of the control device 30-1 is connected to the position sensor 13 and the driver 11, both of which are described above, via signal lines. The integrated circuit 32 of the control device 30-2 is connected to the position sensor 23 and the driver 21, both of which are described above, via signal lines. These connection paths are appropriately provided with circuits for realizing signal transmission and reception, such as a D / A (digital to analog) conversion circuit and an A / D (analog to digital) conversion circuit, a pulse counter, etc. Furthermore, the transmission and reception of signals via these signal lines may be realized by parallel communication or serial communication.

[0024] In this configuration, the haptic control unit 321 of the control device 30-1 and the haptic control unit 321 of the control device 30-2 synchronize their control parameters by sending and receiving control parameters via their respective communication units 31. These haptic control units 321 then perform a "haptic transmission process." Here, the haptic transmission process is a series of processes that realizes the transmission of haptics between the first drive unit 10, which is the master device, and the second drive unit 20, which is the slave device.

[0025] Specifically, in the haptic transmission process, the haptic control unit 321 drives both the master device (here, the first drive unit 10) and the slave device (here, the second drive unit 20), and executes control to transmit haptics associated with driving in both directions between the actuators of the master device and the slave device (here, actuators 12 and 22) based on positions detected in real time by position sensors (here, position sensors 13 and 23) of the driving master device and the slave device and forces calculated from these positions. To this end, the haptic control unit 321 obtains the position (specifically, the position or angle) of the moving object moved by actuator 12 from position sensor 13, and obtains the position (specifically, the position or angle) of the moving object moved by actuator 22 from position sensor 23.

[0026] In this way, the position (angle) acquired by the haptic control unit 321 is used as a reference value in the control algorithm for transmitting the haptic sensation to control the operation of the first drive unit 10 and the second drive unit 20. This control algorithm for transmitting the haptic sensation will be described in detail with reference to FIG. 3.

[0027] 3 is a block diagram showing a control algorithm for transmitting haptics in the haptic control unit 321. As shown in Fig. 3, the control algorithm implemented in the haptic control unit 321 is expressed as a control law including a functional force-velocity allocation conversion block FT, at least one of an ideal force source block FC or an ideal velocity (position) source block PC, and an inverse conversion block IFT. In this embodiment, the controlled system CS is composed of a first drive unit 10 and a second drive unit 20.

[0028] The functional force / speed allocation transformation block FT defines the transformation of control energy into a velocity (position) and force range set according to the function of the controlled system CS. Specifically, the functional force / speed allocation transformation block FT defines a coordinate transformation that takes as input a reference value (reference value) for the function of the controlled system CS and the current position (or current angle) of the actuator 12 or 22. This coordinate transformation generally transforms an input vector having the reference value and the current position (current angle) as elements into an output vector consisting of a position (angle) for calculating a control target value for the position (angle), and also transforms an input vector having the reference value and the current force as elements into an output vector consisting of a force for calculating a control target value for the force.

[0029] By setting the coordinate transformation in the functional force / speed allocation transformation block FT to a content that represents the force / haptic transmission function, it is possible to realize the force / haptic transmission function between the first drive unit 10 and the second drive unit 20, or to reproduce the operation of transmitting the force / haptic sensation with the second drive unit 20 without using the first drive unit 10. Furthermore, by setting coefficients in the elements of the transformation matrix in the coordinate transformation in the functional force / speed allocation transformation block FT, it is possible to perform scaling of the position (angle) or force.

[0030] That is, in this embodiment, the functional force / speed allocation conversion block FT "converts" the variables of the actuator 12 or 22 alone (variables in real space) into a group of variables of the entire system (variables in space after coordinate transformation) that represent the force haptic transmission function, and allocates control energy to the control energy of position (angle) and the control energy of force. That is, the coordinate transformation set in the functional force / speed allocation conversion block FT converts real space coordinates (oblique coordinates) in which position (angle) and force are related to each other into virtual space coordinates (cartesian coordinates) in which position (angle) and force are independent of each other. Therefore, compared to when control is performed using the variables of a single actuator (variables in real space), it is possible to provide the control energy of position (angle) and the control energy of force independently, i.e., to control the position (angle) and force independently.

[0031] In this embodiment, when controlling the position (angle) and force output by the first drive unit 10, the state value in the space after coordinate transformation can be calculated under the condition that the difference in position (angle) between the position (angle) of the member moved by the actuator 12 and the input of a force calculated from these positions (angles) and the reference value serving as the basis for controlling the position (angle) and force are zero and the sum of the forces is zero (equal forces are output in opposite directions). However, the reference value serving as the basis for controlling the position (angle) and force is the position (angle) of the member moved by the actuator 22 in the second drive unit 20 and the force calculated from these positions (angles).

[0032] Similarly, in this embodiment, when controlling the position (angle) and force output by the second drive unit 20, the state value in the space after coordinate transformation can be calculated on the condition that the difference in position (angle) between the position (angle) of the member moved by the actuator 22 and the input force calculated from these positions (angles) and the reference value serving as the basis for controlling the position (angle) and force is zero and the sum of the forces is zero (equal forces are output in opposite directions). However, the reference value serving as the basis for controlling the position (angle) and force is the position (angle) of the member moved by the actuator 12 in the first drive unit 10 and the force calculated from these positions (angles).

[0033] The ideal force source block FC is a block that performs calculations in the force domain according to the coordinate transformation defined by the functional force-velocity allocation transformation block FT. The ideal force source block FC sets a target value for the force used in calculations based on the coordinate transformation defined by the functional force-velocity allocation transformation block FT. This target value is set as a fixed value or a variable value depending on the function to be realized. For example, to achieve a function similar to the function indicated by the reference value, the target value can be set to zero. To perform scaling, a value obtained by enlarging or reducing the information representing the function indicated by the reference value can be set. The ideal force source block FC can also set an upper limit for the force energy determined by calculations in the force domain. Setting an upper limit for the force energy limits the contact force when the second mechanism 25 contacts an object, thereby preventing the second mechanism 25 or the object from being damaged by being pressed too hard against the object.

[0034] The ideal velocity (position) source block PC is a block that performs calculations in the position (angle) domain according to the coordinate transformation defined by the functional force-velocity allocation transformation block FT. The ideal velocity (position) source block PC sets a target value for the position (angle) when performing calculations based on the coordinate transformation defined by the functional force-velocity allocation transformation block FT. This target value is set as a fixed value or a variable value depending on the function to be realized. For example, to achieve a function similar to the function indicated by the reference value, the target value can be set to zero. To perform scaling, a value obtained by enlarging or reducing the information indicating the function to be reproduced can be set. The ideal velocity (position) source block PC can also set an upper limit for the position (angle) energy determined by calculations in the position (angle) domain. Setting an upper limit for the position (angle) energy limits the distance the second mechanism 25 can travel, thereby preventing excessive movement of the second mechanism 25 and preventing damage to the second mechanism 25 or the object.

[0035] The inverse transformation block IFT is a block that inversely transforms values ​​in the position (angle) and force domains into values ​​in the input domain to the controlled system CS (e.g., voltage values ​​or current values, etc.) (i.e., determines command values ​​in real space).

[0036] Under this control algorithm, the haptic control unit 321 receives as input time-series position (angle) detection values ​​detected by the position sensors 13 and 23. These time-series position (angle) detection values ​​represent the operations of the actuators 12 and 22, and the haptic control unit 321 applies coordinate transformation to transmit haptics to the input positions (angles) and forces derived from these positions (angles).

[0037] As described above, the haptic control units 321 of the control device 30-1 and the haptic control units 321 of the control device 30-2 transmit and receive time-series control parameters for transmitting the calculated haptic sensations (here, time-series position (angle) and force control parameters for transmitting the haptic sensations to the first drive unit 10 and the second drive unit 20) via their respective communication units 31, and synchronize these parameters to achieve the transmission of the haptic sensations. Alternatively, the haptic control units 321 of the control device 30-1 and the haptic control units 321 of the control device 30-2 transmit and receive time-series position (angle) detection values ​​detected by the position sensor 13 and the position sensor 23 via their respective communication units 31. The haptic control units 321 of the control device 30-1 and the haptic control units 321 of the control device 30-2 then calculate time-series control parameters for transmitting the haptic sensations based on the detection values ​​under the control algorithm, thereby achieving the transmission of the haptic sensations.

[0038] Furthermore, regardless of the method used to realize the transmission of haptics, the haptic control unit 321 of the control device 30-1 performs control involving the transmission of haptics by directly communicating with the first drive unit 10 at the first location where the control device 30-1 is located, and the haptic control unit 321 of the control device 30-2 performs control involving the transmission of haptics by directly communicating with the second drive unit 20 at the second location where the control device 30-2 is located. This makes it possible to perform control involving the transmission of haptics quickly and stably without causing any loss of control parameters, etc.

[0039] Fig. 4 is a block diagram showing the hardware configuration and functional configuration of the protection device 40. As shown in Fig. 4, the protection device 40 includes a processor 41, a storage unit 42, a ROM (Read Only Memory) 43, a RAM (Random Access Memory) 44, a communication unit 45, an input unit 46, an output unit 47, and a drive 48.

[0040] The processor 41 is configured by an arithmetic device such as a CPU (Central Processing Unit), and executes various processes according to programs recorded in a ROM 43 or programs loaded from the storage unit 42 to a RAM 44. The RAM 44 also stores data and the like necessary for the processor 41 to execute various processes.

[0041] The processor 41 is connected to the ROM 43 and the RAM 44 via a bus (not shown). The bus is further connected to a storage unit 42, a communication unit 45, an input unit 46, an output unit 47, and a drive 48.

[0042] The storage unit 42 is configured by a hard disk, a solid state drive (SSD), a dynamic random access memory (DRAM), etc., and stores various data. The communication unit 45 controls communication with other devices.

[0043] The input unit 46 is made up of various buttons etc. and inputs various information in response to instruction operations. The output unit 47 is made up of a display, a speaker etc. and outputs images and sounds.

[0044] Removable media 101, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, is appropriately loaded into the drive 48. A program read from the removable media 101 by the drive 48 is installed in the storage unit 42 as needed.

[0045] The protection device 40 having such a hardware configuration performs a "protection process." Here, the protection process is a series of processes that quickly perform a safety stop or the like to prevent damage to each drive device or object in the event of a malfunction of the first drive device 10 or the second drive device 20, a communication delay on the network N, or the like.

[0046] When protection processing is performed, the following functions are activated in the processor 41: a relay unit 411, a control parameter monitoring unit 412, a communication quality monitoring unit 413, an abnormality detection unit 414, a stop unit 415, and an external device linking unit 416. The storage unit 42 also includes a control parameter storage unit 421. Data required to achieve processing is transmitted and received between these functional blocks at appropriate times, including cases not specifically mentioned below.

[0047] The relay unit 411 relays control parameters transmitted and received in time series between the control device 30-1 and the control device 30-2. Specifically, the relay unit 411 transmits the time series control parameters received from the control device 30 located at the same base as itself to the protection device 40 located at another base. The relay unit 411 also transmits the time series control parameters received from the protection device 40 located at another base to the control device 30 located at the same base as itself. This realizes relaying of the time series control parameters.

[0048] In addition, the relay unit 411 stores the relayed time-series control parameters in the control parameter storage unit 421. That is, the control parameter storage unit 421 functions as a storage unit that stores time-series control parameters. The time-series control parameters stored in the control parameter storage unit 421 are used as appropriate by the user of the protection system S. For example, when an abnormality related to a predetermined action is detected by the anomaly detection unit 414 (described later), the time-series control parameters are used as a log or the like for analyzing the driving state at the time of the abnormality. This allows the user to easily investigate the cause of the abnormality and take measures to prevent the abnormality from recurring.

[0049] If necessary, the relay unit 411 relays and stores the time-series control parameters after adding additional information such as identifiers for identifying the first drive unit 10 and the second drive unit 20, attributes of the first drive unit 10 and the second drive unit 20 (for example, the type of each unit, the number of axes, the range of motion, the torque output range, the sampling period, etc.), the execution date and time of the operation performed by the first drive unit 10 and the second drive unit 20 under the control of the control device 30, the operation content, and the type of object contacted during the operation. This makes it possible to better support the user in analysis, etc.

[0050] The control parameter monitoring unit 412 monitors the time-series control parameters relayed by the relay unit 411. For example, the control parameter monitoring unit 412 monitors the position (angle) values ​​and force values ​​included in the control parameters. Alternatively, the control parameter monitoring unit 412 calculates the velocity values, acceleration values, angular velocity values, and angular acceleration values ​​from the monitored position (angle) values ​​and force values ​​using differential and integral calculations, and monitors the calculated values.

[0051] Alternatively, the control parameter monitoring unit 412 calculates the output torque value of a drive unit (e.g., the second drive unit 20) based on the real-space command value (e.g., voltage value or current value) in the control algorithm of the control unit 30 and the monitored position (angle) value and force value, and monitors this output torque value. In this case, the real-space command value in the control algorithm of the control unit 30 may be received from one of the control units 30 as part of the control parameters.

[0052] The control parameter monitoring unit 412 then outputs these monitored values ​​as the control parameter monitoring results to the abnormality detection unit 414. Note that which value the control parameter monitoring unit 412 outputs to the abnormality detection unit 414 as the monitoring result is determined depending on which value the abnormality detection unit 414 uses to detect an abnormality.

[0053] The communication quality monitoring unit 413 monitors the communication quality of the communication path of the time-series control parameters transmitted and received between the control device 30-1 and the control device 30-2. As described above, the communication path includes the protection device 40-1, the protection device 40-2, and the network N, but the network N is a best-effort network in which a predetermined communication speed is not guaranteed. Therefore, the communication quality in the network N is not constant. Therefore, the communication quality monitoring unit 413 monitors values ​​indicating communication quality based on various indices.

[0054] For example, the communication quality monitor 413 transmits segments and receives ACKs between itself and the communication quality monitor 413 of another protection device 40, and monitors the value of the round-trip time required for these transmissions and receptions. Alternatively, for example, when the relay unit 411 communicates with the relay unit 411 of another protection device 40 by including the time of data transmission in the transmission parameters of the data for time synchronization, the communication quality monitor 413 calculates and monitors the amount of communication delay from the difference between the time of transmission and the time of reception included in the received data. Alternatively, the communication quality monitor 413 measures and monitors the jitter value indicating the fluctuation of network delay, the packet loss rate value indicating the rate at which packets are lost in the network, and the synchronization interval between bases (i.e., between protection devices 40). Note that methods for measuring values ​​indicating communication quality based on these various indicators are well known to those skilled in the art, and therefore detailed description thereof will be omitted here.

[0055] The communication quality monitoring unit 413 then outputs these monitored values ​​as communication quality monitoring results to the abnormality detection unit 414. Note that which value the communication quality monitoring unit 413 outputs to the abnormality detection unit 414 as the monitoring result is determined depending on which value the abnormality detection unit 414 uses to detect an abnormality.

[0056] The abnormality detection unit 414 detects abnormalities regarding the execution of a specified action involving the transmission of haptic sensations by the first drive unit 10 and the second drive unit 20 based on the monitoring results of the control parameters input from the control parameter monitoring unit 412 and the monitoring results of the communication quality input from the communication quality monitoring unit 413.

[0057] To this end, the anomaly detection unit 414 compares the values ​​input as the monitoring results with a preset threshold range. For example, the anomaly detection unit 414 compares one or more of the force value, velocity value, and output torque value input as the monitoring results of the control parameters with a preset threshold range. This makes it possible to detect an anomaly related to the execution of a predetermined action, such as one that appears in the value of the control parameter.

[0058] Additionally, the anomaly detection unit 414 compares one or more of the values ​​of the round trip time, jitter, packet loss rate, and synchronization interval between bases, which are input as the communication quality monitoring results, with a preset threshold range, thereby making it possible to detect an anomaly in the execution of a predetermined action due to the communication quality on the communication path.

[0059] In these cases, the threshold range is set corresponding to each type of value input as the monitoring result. For example, a threshold range is set corresponding to each of the output torque value and the round trip time value. Furthermore, this threshold range may be defined by only an upper threshold value, by only a lower threshold value, or by both.

[0060] If the input values ​​are outside the threshold range, the anomaly detection unit 414 determines that an anomaly has occurred in the execution of the predetermined action and detects the anomaly. If the anomaly detection unit 414 detects an anomaly in this way, it outputs a signal to that effect to the stop unit 415.

[0061] In addition to comparing with such a threshold range, the anomaly detection unit 414 may also determine that an anomaly has occurred in the execution of a predetermined action and detect the anomaly based on statistical analysis processing of time-series values, such as frequency analysis or regression analysis. In either case, the user may set the threshold range or the judgment criteria for the statistical analysis processing by analyzing values ​​input as monitoring results under normal circumstances and values ​​input as monitoring results under abnormal circumstances.

[0062] When the abnormality detection unit 414 detects an abnormality in the execution of a predetermined action, the stopping unit 415 stops the execution of the predetermined action by controlling the driving of at least one of the first drive unit 10 and the second drive unit 20. For example, the stopping unit 415 stops the execution of the predetermined action by controlling the driving of the first drive unit 10 or the second drive unit 20 located at the same base as itself. To do this, the stopping unit 415 controls the values ​​of control parameters. For example, as described above, in the control algorithm for transmitting haptic sensations, the ideal force source block FC, which performs calculations in the force domain, and the ideal velocity (position) source block PC, which performs calculations in the position (angle) domain, can set variable values ​​as target values. Therefore, the stopping unit 415 controls the driving of the first drive unit 10 or the second drive unit 20 by controlling (i.e., varying) the target value of the control device 30. For example, the stopping unit 415 controls the target value so that the position (angle) value or force value of the first drive unit 10 or the second drive unit 20 to be controlled converges to zero, thereby stopping the execution of the predetermined action.

[0063] Alternatively, the stopping unit 415 stops the execution of a predetermined action by forcibly setting the position (angle) and force domain values ​​input to the inverse transformation block IFT in the control algorithm of the control device 30 to zero, rather than the position (angle) and force domain values ​​calculated in the control algorithm. Alternatively, the stopping unit 415 stops the execution of a predetermined action by forcibly setting the real-space command value (e.g., voltage value or current value) output by the inverse transformation block IFT in the control algorithm of the control device 30 to zero, rather than the command value calculated in the control algorithm. Alternatively, the stopping unit 415 fixes the position (angle) and stops the execution of a predetermined action by setting the reference value in the control parameters (i.e., the position (angle) of the member moved by the other driving device and the force calculated from this position (angle)) to a value different from the position (angle) of the member actually detected by the position sensor 13 or the position sensor 23 and the force calculated from this position (angle).

[0064] This makes it possible to stop the execution of a predetermined action by utilizing control parameters that are originally used to transmit haptic sensations.

[0065] Furthermore, the stop unit 415 may stop the execution of a predetermined action by controlling the driving of at least one of the first drive unit 10 and the second drive unit 20 using a method other than controlling the value of such a control parameter. For example, the stop unit 415 stops the execution of a predetermined action by controlling the external device 50 via the external device linkage unit 416 described below. The external device 50 is, for example, a programmable logic controller (PLC) or a robot controller, and can control the driving of the first drive unit 10 and the second drive unit 20 independently of control by the control device 30. Therefore, the stop unit 415 controls the driving of at least one of the first drive unit 10 and the second drive unit 20 to stop the execution of a predetermined action by transmitting a control signal or a stop message to the external device 50 via the external device linkage unit 416 described below. Alternatively, if the stop unit 415 is connected so as to be able to output a control signal to the driver 11 or the driver 21, the stop unit 415 sends a control signal to the driver 11 or the driver 21, thereby activating the brake stop function of the driver 11 or the driver 21 and stopping the execution of a specified action.

[0066] This makes it possible to stop the execution of a predetermined action without using a control parameter.

[0067] Furthermore, prior to stopping the execution of the predetermined action using such a control parameter or a method using the external device 50, the stopping unit 415 may control the drive of at least one of the first drive unit 10 and the second drive unit 25 to execute another predetermined action different from the currently executing predetermined action. For example, the other predetermined action may be to move the first mechanism 15 or the second mechanism 25 along a predetermined trajectory (e.g., a trajectory moving away from an object) or to perform a predetermined stopping procedure (e.g., placing the object being held), before stopping the execution of the predetermined action. To execute such another predetermined action, a drive control program for realizing the other predetermined action is created. Then, upon detecting an abnormality, the control device 30 executes drive control based on the program. This allows the execution of the predetermined action to be stopped after moving along a predetermined trajectory or performing a predetermined stopping procedure.

[0068] Furthermore, prior to stopping the execution of the predetermined action using such a method using the control parameters or the external device 50, the stopping unit 415 may control the driving of at least one of the first drive unit 10 and the second drive unit to suppress an abnormality related to the execution of the predetermined action, thereby avoiding the stopping of the execution of the predetermined action. For example, the stopping unit 415 attempts to suppress an abnormality related to the execution of the predetermined action by performing predictive control using model predictive control or compensatory control such as compensating for communication delays using a communication disturbance observer (CDOB). Then, if the abnormality is actually suppressed by these controls and the abnormality detection unit 414 no longer detects an abnormality, the stopping unit 415 cancels the stopping of the execution of the predetermined action. On the other hand, if the abnormality detection unit 414 continues to detect an abnormality, the stopping unit 415 stops the execution of the predetermined action. In this way, the execution of the predetermined action can be stopped gradually rather than suddenly.

[0069] Furthermore, when the stopping unit 415 stops the execution of the predetermined action using such a control parameter, the external device 50, or the like, it may notify the user of this fact. This allows the user to understand that an abnormality has been detected and that the execution of the predetermined action has been stopped accordingly. In this case, the user may also be notified of additional information, such as which type of monitoring result the abnormality was detected based on and whether the execution of the predetermined action has been properly stopped. This notification may be realized by displaying on a display included in the output unit 47, emitting a warning sound from a speaker included in the output unit 47, or the like.

[0070] The external device linking unit 416 links with the external device 50 to control the external device 50 and acquire information from the external device 50. For example, the external device linking unit 416 controls the operation of the external device 50 by outputting a control signal conforming to the standard of the external device 50 to the external device 50, which is a PLC or a robot controller. This makes it possible to stop the execution of a predetermined action by the method using the external device 50 by the above-mentioned stopping unit 415.

[0071] Furthermore, for example, if the external device 50 is a camera, the external device linking unit 416 acquires video data captured by the camera showing the driving states of the first drive unit 10 and the second drive unit 20. Furthermore, for example, if the external device 50 is a sensor such as a temperature sensor, the external device linking unit 416 acquires measured values ​​such as the ambient temperature of the first drive unit 10 and the second drive unit 20 measured by the sensor. This makes it possible to notify the user of this video data and measured values. Note that the user may refer to this video data and measured values ​​to consider a safe range of motion and a safe movement speed, and dynamically change the threshold range for the abnormality detection unit 414 to detect an abnormality.

[0072] As described above, the protection device 40 can perform monitoring based on various perspectives, such as various control parameters and index values ​​indicating various communication qualities. Furthermore, the protection device 40 can stop a predetermined action using various methods, such as a method of controlling control parameters or a method of using the external device 50. Furthermore, monitoring based on these various perspectives and various stopping methods can be combined as desired.

[0073] As a result, the protection device 40 can flexibly respond to the environment in which the protection system S is implemented and the user's requests, and can solve the problem of performing appropriate monitoring to protect the system that transmits haptic sensations.

[0074] 5 is a flowchart illustrating the flow of the haptic transmission process executed by the protection system S. The haptic transmission process is executed when the control device 30 starts control to transmit a haptic sensation in response to an operation on the first drive device 10 by a user, or when the control device 30 subsequently receives an instruction operation from the user to start the haptic transmission process.

[0075] In step S11, the haptic control unit 321 starts sending and receiving control parameters to and from the haptic control unit 321 of the other control device 30, and continues sending and receiving control parameters in chronological order in parallel with the processing in each subsequent step. In step S12, the haptic control unit 311 acquires the position (specifically, the position or angle) of the moving object moved by the actuator 12 and the position (specifically, the position or angle) of the moving object moved by the actuator 22.

[0076] In step S13, the haptic control unit 311 converts the input vector in the real space into a vector in the virtual space. In step S14, the haptic control unit 311 performs calculations in the velocity (position) domain and in the force domain.

[0077] In step S15, the haptic control unit 311 inversely converts the values ​​of the velocity (position) and force domains into values ​​of the domain of input to the controlled system CS (vectors in real space). In step S16, the haptic control unit 311 of the control device 30-1 outputs a command value for the actuator 12, and the haptic control unit 311 of the control device 30-2 outputs a command value for the actuator 22.

[0078] In step S17, the operation data acquisition unit 312 determines whether the transmission control of the predetermined action by the first drive unit 10 and the second drive unit 20 has ended as the user has finished operating the first drive unit 10. If the predetermined action has ended, step S17 returns YES, and the process ends. On the other hand, if the predetermined action has not ended, step S17 returns NO, and the process returns to step S12 and is repeated.

[0079] 6 is a flowchart illustrating the flow of the protection process executed by the protection system S. The protection process is executed when the control device 30 starts transmitting and receiving control parameters due to the start of the haptic transmission process.

[0080] In step S21, the relay unit 411 starts relaying the control parameters transmitted and received in time series between the control devices 30-1 and 30-2, and continues relaying the control parameters in time series in parallel with the processing in each subsequent step. In step S22, the control parameter monitoring unit 412 monitors the time series control parameters relayed by the relay unit 411.

[0081] In step S23, the abnormality detection unit 414 determines whether or not an abnormality has been detected in the execution of a predetermined action involving the transmission of haptic sensations by the first drive unit 10 and the second drive unit 20, based on the monitoring results of the control parameters input from the control parameter monitoring unit 412. If an abnormality has been detected, step S23 is determined as Yes, and the process proceeds to step S27. On the other hand, if no abnormality has been detected, step S23 is determined as No, and the process proceeds to step S24.

[0082] In step S24, the communication quality monitoring unit 413 monitors the communication quality of the communication path for the time-series control parameters transmitted and received between the control device 30-1 and the control device 30-2. In step S25, the abnormality detection unit 414 determines whether or not an abnormality has been detected in the execution of a predetermined action involving the transmission of haptics by the first drive unit 10 and the second drive unit 20, based on the communication quality monitoring results input from the communication quality monitoring unit 413. If an abnormality is detected, the result in step S25 is Yes, and the process proceeds to step S27. On the other hand, if no abnormality is detected, the result in step S25 is No, and the process proceeds to step S26.

[0083] In step S26, the relay unit 411 determines whether the transmission control of the predetermined action by the first drive unit 10 and the second drive unit 20 has ended as the user has finished operating the first drive unit 10. If the predetermined action has ended, step S26 returns YES, and the process ends. On the other hand, if the predetermined action has not ended, step S26 returns NO, and the process returns to step S22 and is repeated.

[0084] It should be noted that instead of performing both steps S22 and S23 and steps S24 and S25, only one of them may be performed.

[0085] In step S27, the execution of the predetermined action is stopped by controlling the driving of at least one of the first drive unit 10 and the second drive unit 20. In step S28, the user is notified that the execution of the predetermined action has been stopped, and this process ends.

[0086] According to the haptic transmission process and protection process described above, it is possible to detect abnormalities in the predetermined actions performed by the first drive unit 10 and the second drive unit 20 simply by monitoring the communication path for transmitting and receiving control parameters in chronological order. That is, the protection system S can perform appropriate monitoring by utilizing a configuration unique to a special system, namely, transmitting and receiving control parameters in chronological order. In addition, the protection system S can also appropriately protect the monitored system by stopping the execution of the predetermined action based on the results of this appropriate monitoring. Therefore, the protection system S can solve the problem of performing appropriate monitoring to protect a system that transmits haptics.

[0087] [Modifications] While the embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. The present invention can take on various other embodiments and can be modified in various ways, such as omissions and substitutions, without departing from the spirit of the present invention.

[0088] [Variation 1] In the above-described embodiment, the control device 30 and the protection device 40 are realized as separate devices at each base. This is not a limitation, and for example, the control device 30 and the protection device 40 may be realized as an integrated device at each base. Furthermore, in the above-described embodiment, the protection device 40 is disposed at each base together with the control device 30 and the like. This is not a limitation, and the protection device 40 may be disposed at a location different from the bases where the control device 30 and the like are disposed.

[0089] Furthermore, in the above-described embodiment, a plurality of protection devices 40 are provided corresponding to each base. However, the present invention is not limited to this, and only one protection device 40 may be provided in the entire protection system S, and this one protection device 40 may perform protection processing for each base. Furthermore, in this case, the protection device 40 may be realized by a plurality of server devices constituting a cloud server.

[0090] Alternatively, for example, there may be a base that includes one control device 30, multiple first drive units 10, and multiple second drive units 20. At such a base, for example, multiple first drive units 10 operate as master units of a multi-degree-of-freedom robot arm, and multiple second drive units 20 operate as slave units of the multi-degree-of-freedom robot arm, with all of these operations controlled by a single control device 30 at each base. In other words, the system configuration in the above-described embodiment is merely an example, and can be modified into various configurations as appropriate.

[0091] [Variation 2] In the above-described embodiment, if the external device 50 is a sensor, the abnormality detection unit 414 may detect an abnormality related to the execution of a predetermined action based on the sensor's measurement values, in addition to the control parameter monitoring results and communication quality monitoring results. In this case, the abnormality detection unit 414 can detect an abnormality related to the execution of a predetermined action by comparing the measurement values ​​with a preset threshold range. For example, if the external device 50 is a temperature sensor that measures the temperature of the first drive unit 10 or the second drive unit 20 itself or the ambient temperature, the abnormality related to the execution of a predetermined action, such as abnormal heat generation of an actuator, can be detected by comparing these measurement values ​​with a threshold range. Furthermore, even if an abnormality is detected in this manner, the stop unit 415 stops the execution of the predetermined action by controlling the drive of at least one of the first drive unit 10 and the second drive unit 20.

[0092] This makes it possible to detect abnormalities in the execution of a predetermined action and stop the execution of the predetermined action from a perspective different from that of the monitoring results of control parameters and communication quality.

[0093] [Variation 3] In the above-described embodiment, haptic sensations are transmitted based on the control algorithm described with reference to FIG. 3 . In this case, as described above, the time-series position (angle) values ​​detected in real time by the position sensor 23 (or position sensor 13) and the force values ​​calculated from these positions (angles) are used as reference values ​​in the control algorithm. This is not limited to this, and a force sensor may be used in addition to a position sensor. In this case, a force sensor is provided in addition to a position sensor in each of the first drive unit 10 and the second drive unit 20. Then, the time-series force values ​​detected in real time by this force sensor are used as the reference value in the control algorithm, rather than the force values ​​calculated from the time-series position (angle) values ​​detected in real time by the position sensor. This allows, for example, if a force sensor capable of detecting force values ​​with high accuracy is available, to transmit haptic sensations using this force sensor.

[0094] As described above, the protection system S according to this embodiment includes a control parameter monitoring unit 412, a communication quality monitoring unit 413, an abnormality detection unit 414, and a stop unit 415. The control parameter monitoring unit 412 and the communication quality monitoring unit 413 monitor the communication path over which control parameters for transmitting haptics are transmitted in chronological order when the first drive unit 10 and the second drive unit 20 perform a predetermined action involving the transmission of haptics. The abnormality detection unit 414 detects an abnormality related to the execution of the predetermined action based on the monitoring results of the control parameter monitoring unit 412 and the communication quality monitoring unit 413. When the abnormality detection unit 414 detects an abnormality related to the execution of the predetermined action, the stop unit 415 controls the driving of at least one of the first drive unit 10 and the second drive unit 20 to stop the execution of the predetermined action. In this way, the protection system S can detect an abnormality related to the predetermined action performed by the first drive unit 10 and the second drive unit 20 simply by monitoring the communication path over which control parameters are transmitted in chronological order. That is, the protection system S can perform appropriate monitoring by utilizing a configuration unique to a special system, namely, transmitting and receiving control parameters in chronological order. In addition, the protection system S can also appropriately protect the monitored system by stopping the execution of a predetermined action based on the results of this appropriate monitoring. Therefore, the protection system S can solve the problem of performing appropriate monitoring to protect a system that transmits haptic sensations.

[0095] The control parameter monitoring unit 412 monitors the values ​​of the control parameters transmitted and received over the communication path, and the abnormality detection unit 414 detects abnormalities related to the execution of a predetermined action based on the values ​​of the control parameters, thereby making it possible to detect abnormalities related to the execution of a predetermined action, such as those that appear in the values ​​of the control parameters.

[0096] The communication quality monitoring unit 413 monitors the communication quality of the communication path, and the abnormality detection unit 414 detects an abnormality in the execution of a predetermined action based on the communication quality of the communication path. This makes it possible to detect an abnormality in the execution of a predetermined action caused by the communication quality of the communication path.

[0097] The control parameter monitoring unit 412 monitors the values ​​of the control parameters transmitted and received over the communication path, and the stopping unit 415 controls the values ​​of the control parameters transmitted and received over the communication path to control the driving of at least one of the first drive unit 10 and the second drive unit 20 and stop the execution of a predetermined action. In this way, the execution of a predetermined action can be stopped by utilizing the control parameters that are originally used to transmit haptic sensations.

[0098] Prior to stopping the execution of the predetermined action, the stopping unit 415 controls the driving of at least one of the first drive unit 10 and the second drive unit 20 to perform another predetermined action different from the predetermined action. This makes it possible to stop the execution of the predetermined action after moving along a preset trajectory or performing a predetermined stopping procedure.

[0099] The stopping unit 415 stops the execution of a predetermined action by controlling the driving of at least one of the first drive unit 10 and the second drive unit 20 using a method different from controlling the value of a control parameter transmitted and received over a communication path. This makes it possible to stop the execution of a predetermined action without using a control parameter.

[0100] A first base station where a first driving device 10 is installed and a second base station where a second driving device 20 is installed are connected via a communication path. The protection system S includes a control parameter monitoring unit 412, a communication quality monitoring unit 413, an abnormality detection unit 414, and a stopping unit 415, each of which corresponds to the first base station and the second base station. The stopping unit 415 stops the execution of a predetermined action by controlling the drive of the first driving device 10 or the second driving device 20 installed at the base station corresponding to itself. This allows the execution of a predetermined action to be stopped quickly at each base station, even in a case where, for example, haptic sensations are transmitted between remote base stations.

[0101] [Realization of Functions by Hardware or Software] The function of executing the series of processes according to the above-described embodiment can be realized by hardware, software, or a combination of these. In other words, it is sufficient that the function of executing the series of processes described above is realized in any of the protection systems S, and there are no particular limitations on how this function is realized.

[0102] For example, when the function of executing the above-mentioned series of processes is realized by a processor that executes arithmetic processing, the processor that executes this arithmetic processing includes processors that are configured by various types of processing devices alone, such as single processors, multiprocessors, and multicore processors, as well as processors that combine these various types of processing devices with processing circuits such as ASICs (Application Specific Integrated Circuits) or FPGAs (Field-Programmable Gate Arrays).

[0103] Furthermore, for example, when the function of executing the above-described series of processes is realized by software, the program constituting the software is installed on a computer via a network or a recording medium. In this case, the computer may be a computer incorporating dedicated hardware, or may be a general-purpose computer (e.g., a general electronic device such as a general-purpose personal computer) that can execute predetermined functions by installing a program. Furthermore, the steps of writing the program may include only processes that are executed chronologically according to the order, but may also include processes that are executed in parallel or individually. Furthermore, the steps of writing the program may be executed in any order within the scope of the present invention.

[0104] A recording medium on which such a program is recorded may be provided to a user by being distributed separately from the computer main unit, or may be provided to a user in a state where it is pre-installed in the computer main unit. In this case, the storage medium distributed separately from the computer main unit is, for example, removable media 101, which may be a magnetic disk (including a floppy disk), an optical disk, or a magneto-optical disk. An optical disk may be, for example, a CD-ROM (Compact Disc-Read Only Memory), a DVD (Digital Versatile Disc), or a Blu-ray (registered trademark) Disc. An magneto-optical disk may be, for example, an MD (Mini Disc). The recording medium provided to the user in a state where it is pre-installed in the computer main body is, for example, a storage unit 42 on which the program is recorded, and is configured by an HDD (hard disk drive) or an SSD (solid state drive).

[0105] 10 First driving device, 11, 21 Driver, 12, 22 Actuator, 13, 23 Position sensor, 15 First mechanism, 20 Second driving device, 25 Second mechanism, 30-1, 30-2 Control device, 31, 45 Communication unit, 32 Integrated circuit, 40-1, 40-2 Protection device, 41 Processor, 42 Memory unit, 43 ROM, 44 RAM, 46 Input unit, 47 Output unit, 48 Drive, 50-1, 50-2 External device, 101 Removable media, 321 Force haptic control unit, 411 Relay unit, 412 Control parameter monitoring unit, 413 Communication quality monitoring unit, 414 Abnormality detection unit, 415 Stop unit, 416 External device linkage unit, 421 Control parameter memory unit, CS Controlled system, FT Force / speed allocation conversion block, FC Ideal force source block, PC Ideal velocity (position) source block, IFT inverse transformation block, N network, S protection system

Claims

1. a monitoring means for monitoring a communication path for transmitting a control parameter for transmitting a haptic sensation in a time series when a predetermined action involving the transmission of the haptic sensation by the first drive device and the second drive device is being performed; a detection means for detecting an abnormality regarding the execution of the predetermined action based on a monitoring result by the monitoring means; a stop means for stopping the execution of the predetermined action by controlling driving of at least one of the first drive device and the second drive device when the detection means detects an abnormality related to the execution of the predetermined action; A protection system comprising:

2. the monitoring means monitors the value of the control parameter transmitted and received through the communication path; the detection means detects an abnormality regarding the execution of the predetermined action based on a value of the control parameter.

2. The protection system of claim 1.

3. The monitoring means monitors the communication quality of the communication path, The detection means detects an abnormality regarding the execution of the predetermined action based on a communication quality in the communication path.

3. A protection system according to claim 1 or 2.

4. the monitoring means monitors the value of the control parameter transmitted and received through the communication path; the stopping means controls the value of the control parameter transmitted and received via the communication path to control driving of at least one of the first drive device and the second drive device, thereby stopping the execution of the predetermined action.

3. A protection system according to claim 1 or 2.

5. the stopping means controls driving of at least one of the first drive device and the second drive device to perform another predetermined action different from the predetermined action prior to stopping the execution of the predetermined action; 5. The protection system of claim 4.

6. the stopping means controls driving of at least one of the first drive device and the second drive device to stop the execution of the predetermined action by a method different from a method of controlling the value of the control parameter transmitted and received through the communication path; 3. A protection system according to claim 1 or 2.

7. a first base where the first driving device is installed and a second base where the second driving device is installed are connected via the communication path, the monitoring means, the detection means, and the stopping means are provided in a plurality of units corresponding to the first base and the second base, the stopping means stops the execution of the predetermined action by controlling the driving of the first driving device or the second driving device installed at the base corresponding to the stopping means; 3. A protection system according to claim 1 or 2.

8. a monitoring step of monitoring a communication path for transmitting and receiving a control parameter for transmitting a haptic sensation in a time series when a predetermined action involving the transmission of the haptic sensation by the first drive device and the second drive device is being performed; a detection step of detecting an abnormality regarding the execution of the predetermined action based on a monitoring result by the monitoring step; a stop step of stopping the execution of the predetermined action by controlling driving of at least one of the first drive device and the second drive device when an abnormality related to the execution of the predetermined action is detected in the detection step; A protection method comprising:

9. a monitoring function that monitors a communication path for transmitting and receiving control parameters for transmitting a haptic sensation in a time series when a predetermined action involving the transmission of the haptic sensation by the first drive device and the second drive device is being performed; a detection function for detecting an abnormality regarding the execution of the predetermined action based on a monitoring result by the monitoring function; a stop function that stops the execution of the predetermined action by controlling driving of at least one of the first drive device and the second drive device when the detection function detects an abnormality related to the execution of the predetermined action; and A program characterized by causing a computer to realize the above.