Systems and methods for wireless control and planning of robots in a real-world space

Abstract

Systems and methods for wireless control and planning robots in a real-world space. An example method implemented by a robot includes establishing a wireless communication session with an external device configured to provide operating-space and / or stopping parameters. Ranging measurements between the robot and the external device are obtained. At least one distance- or position-based condition is determined based on information received from the external device. In response to the condition one or more actuators of the robot are caused to perform at least one action.

Description

TSLA.877WO / P02973-1 WOSYSTEMS AND METHODS FOR WIRELESS CONTROL AND PLANNING OF ROBOTS IN A REAL-WORLD SPACECROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U. S. Prov. Patent App. No. 63 / 751,076 titled “SYSTEMS AND METHODS FOR WIRELESS CONTROL AND PLANNING OF ROBOTS IN A REAL-WORLD SPACE” and filed on January 29, 2025, the disclosure of which is hereby incorporated herein by reference in its entirety.

[0002] This application further incorporates by reference the following applications in their entirety: International App. No. PCT / US2023 / 032214, International App. No. PCT / US2023 / 034185, and International App. No. PCT / US2023 / 075626.BACKGROUND TECHNICAL FIELD

[0003] The present disclosure relates to wireless communications, and more particularly, to wireless communications for autonomous or semi-autonomous robots.DESCRIPTION OF RELATED ART

[0004] Robotic systems for manufacturing, and industrial, tasks are commonly used, for example with respect to repetitive or dangerous tasks. As an example, in vehicle manufacturing a robot may apply welds to specific portions of a piece of metal. As another example, a robot may pick up and carry heavy elements used in vehicle manufacturing. Typically, these robots may be fixed in location and have articulated elements enabling them to perform specific functions.

[0005] The above-described robotic systems may work alongside persons with substantial safeguards in place to ensure safety of the persons. For example, these robotic systems may be rapidly turned off, or disabled, by the persons. As an example, there may be control circuits that trigger the immediate shutoff of all, or specific, robotic systems. As another example, since these robotic systems are fixed in location there may be visual markers informing persons of the operating ranges of the systems.TSLA.877WO / P02973-1 WOSUMMARY

[0006] In various embodiments, systems, methods, and computer readable media are described. A system may include a robot that comprises a wireless communication transceiver configured to perform wireless ranging; one or more processors; and memory storing authorization data, wherein the one or more processors are configured to: establish a wireless communication session with an external device wherein the external device is configured to establish an operating space and / or cause a stop; obtain ranging measurements between the robot and the external device; determine at least one distance- or position-based condition based on information received from tire external device; and in response to the condition, cause one or more actuators of the robot to perform at least one action.

[0007] In various embodiments, a method may be implemented a robot having a wireless communication transceiver configured to perform ranging with external devices and one or more processors. The method comprises establishing a wireless communication session with an external device wherein the external device is configured to provide operating-space and / or stopping parameters; obtaining ranging measurements between the robot and the external device; determining at least one distance- or position-based condition based on information received from the external device; and causing one or more actuators of the robot to perform at least one action in response to the condition.

[0008] In various embodiments, a system comprises at least one external device; and a robot comprising a wireless communication transceiver configured to perform ranging with external devices; one or more processors included in the robot configured to: establish a wireless communication session with the at least one external device wherein the external device is configured to provide operating-space and / or stopping parameters; obtain ranging measurements between the robot and the at least one external device; determine at least one distance- or position-based condition based on information received from the at least one external device; and, in response to the condition, cause one or more actuators of the robot to perform at least one action.BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A illustrates a block diagram of example robots in wireless communication with each other and wireless endpoints configured to form an example operating space.7TSLA.877WO / P02973-1 WO

[0010] Figure IB illustrates a block diagram of the example robots and interactive stop elements.

[0011] Figure 2A illustrates detail of an example robot in wireless communication with one or more robots, wireless endpoints, and interactive stop elements.

[0012] Figure 2B illustrates detail of triggering the example robot to stop functioning using example techniques.

[0013] Figure 3A illustrates a block diagram of an example robot following a person based on a user device paired with, or otherwise in communication with, the example robot.

[0014] Figure 3B illustrates a block diagram of an example mobile bot configured to traverse between operating spaces.

[0015] Figure 4A is a flowchart of an example process for a robot taking action based on measured distances between the robot and another robot or wireless endpoint.

[0016] Figure 4B is a flowchart of an example process for robots updating paths based, at least, on ranging between the robots.

[0017] Figure 5 A is a flowchart of an example process for a robot determining to stop or resume movement based on an operating space.

[0018] Figure 5B is a flowchart of an example process for a robot determining to stop based on an operating range associated with an interactive stop element.

[0019] Embodiments of the present disclosure and their advantages are best understood by referring to the detailed description that follows. It should be appreciated that like reference numerals are used to identify like elements illustrated in one or more of the figures, wherein showings therein are for purposes of illustrating embodiments of the present disclosure and not for purposes of limiting the same.DETAILED DESCRIPTIONIntroduction

[0020] Various embodiments described herein relate to control of robots, such as autonomous robots configured to move about a real-world environment, using distance measurements between one or more robots and wireless endpoints (e.g., ultra-wideband (UWB) endpoints) that define operating spaces in which the robots may move or otherwise operate. InTSLA.877WO / P02973-1 WOsome embodiments, the robots described herein may be used for manufacturing or commercial purposes. Thus, and as will be described, the robots may perform specific functions while being confined to specific operating spaces. Various embodiments additionally enable robots to be rapidly stopped or otherwise disabled. For example, a robot may be stopped (e.g., turned off, shut down, rendered inoperable) based on the robot moving beyond an exterior of an operating space.

[0021] As further described below, various embodiments implement wireless techniques, such as UWB, to accurately estimate distances between elements. For example, a robot may include one or more UWB transceivers. In this example, the robot may determine its distance to another robot with its own UWB transceivers. The robot may also determine its distance to wireless endpoint(s), such as UWB endpoint(s), which are used to define an operating space. The distance measurements may be estimated using example techniques, such as viatime-of-flight measurements. Determining distance between elements is referred to herein as ranging between, or with, the elements.

[0022] While UWB transceivers are described herein, additional wireless transceivers may be used and fall within the scope of the disclosure herein. For example, signal strength indicators (e.g., received signal strength indicator) may be used to indicate real-time signal strength between a robot and another robot or a robot and a wireless endpoint. As another example, phase-based ranging techniques may be used. As another example, angle of arrival (AoA) techniques, such as those defined in Bluetooth Direction Finding, may be used to determine the direction from which a signal is coming. As another example, the angle of departure may be used, Bluetooth channel sounding may additionally be used, which can assess the quality of Bluetooth communication via transmitting known signals and analyzing received responses, in some embodiments, mm Wave transceivers may be used to estimate distance.

[0023] As may be appreciated, autonomous robots, such as humanoid bipedal robots, may provide substantial benefits with respect to a manufacturing or commercial setting. Indeed, and with respect to a manufacturing setting, such robots may perform repetitive tasks necessary to achieve a manufacturing goal. For example, the robots may cany / parts used in a manufacturing process, perform manufacturing tasks (e.g., welding, building), prepare manufacturing areas for skilled human laborers to work, and so on. Thus, the robots may perform w'ork, in some cases, alongside people to collectively perform complex manufacturing processes. This work may be performed in combination with, for example, industrial robotsTSLA.877WO / P02973-1 WOthat may be fixed in place.

[0024] While beneficial, use of freely-moving autonomous robots may require safeguards with respect to their operation. For example, an emergency in a factory may require rapidly stopping all robots within an operating space. As another example, due to the complexity of the robots, assurances may be needed that the stopping will be effective even with malfunctioning robots. For this example, a robot may operate using, in part, computationally expensive autonomous techniques (e.g., neural networks). In this example, the robot may characterize visual information, such as objects, which are proximate to the robot. This visual information may be used, in part, to control movement, path planning, and so on, of the robot. Thus, even with malfunctioning of any of these autonomous techniques, the robot may require guaranteed shutdown techniques.

[0025] Various embodiments enable the operation of a robot to be more reliably stopped through use of wireless endpoints (e.g., UWB endpoints). For example, one or more w ireless endpoints may define an operating space. In this example, the operating space may represent an area or volume of space in which robots are allowed to maneuver. As an example, a robot may range with the UWB endpoints to determine its location within the operating space. In this example, the robot may be instructed to enforce the operating space such that any movement outside causes immediate shutdown of the robot. Advantageously, such monitoring of the operating space of the robot may, in some embodiments, be separate from the more complex autonomous techniques described herein. In this way, the robots may self-manage safe stop operations to reduce the need for a human to monitor the robots.

[0026] Additionally, the robots may be responsive to remote stop control elements, such as buttons, positioned within a real -world space. A remote stop control element, also referred to herein as an interactive stop element, may define a stop radius around the element. Robots ■within the stop radius, such as within the resulting circle or sphere defined by the interactive stop element, may rapidly stop (e.g., shutdown, turn off, and so on). In some embodiments, the remote stop control element may transmit message(s) (e.g., over Bluetooth, such as Bluetooth low energy (BLE), or Wi-Fi) indicating that proximate robots are to stop. The robots may then determine their proximity to the element (e.g., using ranging, such as via UWB or BLE) to ascertain whether they are in the stop radius. Similar to the above, the robots may determine to stop using techniques separate from the more complex autonomous techniques described herein. In this way, people may walk around a setting in which robots are working and utilize interactive stop elements to, in real-time, more easily disable robots at theirTSLA.877WO / P02973-1 WOdiscretion.

[0027] In some embodiments, a robot may pair with, or otherwise range with, a user device of a person. For example, the person may hold a mobile device, a wearable device, a fob, and so on. In this example, the person may enable, or configure, a mode that causes the robot to follow the user device. As further described herein, the robot may range with the user device to follow the path of tire person. Advantageously, the robot may maintain at least a threshold distance from the person (e.g., a safe distance, such as I meter, 2 meters, a user adjustable distance, and so on), lire person may lead the robot towards an operating space and then cause the robot to be assigned to that operating space. In this way, the person may move robots to assigned areas (e.g., move from a first operating space to a second operating space).

[0028] Thus, UWB transceivers may be relied upon to provide safeguards with respect to use of autonomous robots. In addition to enhancing safety, the UWB transceivers may be used to inform path planning of robots. For example, robots within a confined operating space may communicate with each other to coordinate movement, access control, route planning, and so on. In this example, the robots may monitor each other’s location and negotiate, or otherwise establish, movement patterns that safeguard against collisions. Additionally, the movement patterns may ensure that each robot is able to perform its task. As may be appreciated, the robots may look substantially similar such that robots that leverage image sensors may struggle to uniquely identify specific robots. Tire robots may also operate in limited light, or no light situations. Thus, use of wireless communications may ensure that the robots are able to co¬ exist with each other while performing work.

[0029] An example description of autonomous or semi-autonomous robots is included in International App. No. PCT / US2023 / 032214, which is incorporated by reference herein in its entirety’. For example, the incorporated disclosure describes vision techniques for robots which leverage a multitude of image sensors (e.g., 6 cameras, 8 cameras, and so on). Additional example description is included in International App. No. PCT / US2023 / 034185, which is incorporated by reference herein in its entirety. For example, the incorporated disclosure describes techniques for generating a path for a robot to take towards a destination. Additional example description is included in International App. No. PCT / US2023 / 075626, which is incorporated by reference herein in its entirety. For example, the incorporated disclosure describes techniques for joint behavior planning and forecasting.

[0030] The above, and additional features, will now be described in more detail.TSLA.877WO / P02973-1 WOExample Block Diagrams

[0031] Figure 1A illustrates a block diagram of example robots 102A-102C in wireless communication with each other and wireless endpoints 120A-120D configured to form an example operating space 110. The robots 102A-102C may be examples of autonomous robots that can perform work within the operating space 110. For example, in some embodiments the robots 102A-102C may be similar to humans with two arms, two legs, and so on. As another example, the robots 102A-102C may have image sensors that capture image data of substantially 360-degrees around the robots 102A-102C.

[0032] Individual robots may include wireless transceivers to communicate with other robots, along with the endpoints 120A-120D illustrated in Figure 1 A. As described herein, the wireless transceivers may include ultrawide-band (UWB) transceivers. As used herein, a short-range wireless transceiver includes radios configured for short-range data communications such as Bluetooth low energy (BLE) and Wi-Fi, and a precision ranging transceiver includes radios configured for precision distance estimation such as ultra-wideband (UWB). In some embodiments, when both a short-range wireless transceiver and a precision-ranging transceiver are present, they may be integrated into a single integrated circuit or multi-radio module; in other embodiments, they may be implemented as separate components. These transceivers may enable an individual robot to range with (e.g., determine distance from) the other robots and the endpoints 120A-120D. In some embodiments, the wireless transceivers may also include Bluetooth low energy (BLE), Wi-Fi, and so on, to effectuate wireless communications. As used herein, an external device includes robots, interactive stop devices, and wireless endpoints (e.g., UWB / BLE / Wi-Fi nodes) with which the robot may establish authenticated communications and / or perform distance or position estimation.

[0033] For example, in some embodiments, an individual UWB endpoint may advertise its presence using an example wireless technique (e.g., BLE, Wi-Fi). In certain embodiments, the short-range wireless transceiver (e.g., BLE or Wi-Fi) is used for control signaling, session establishment, and encryption key provisioning, while the precision ranging transceiver (e.g., UWB) is used to perform time-of-flight ranging for distance or position estimation. An individual robot may respond to the advertisement information to establish communications with the UWB endpoint. In some embodiments, communications between the UWB endpoint and the robot may be encrypted and enabled only between authorized robots and endpoints.TSLA.877WO / P02973-1 WOFor example, the endpoint may authenticate the robot through an exchange of provisioned public certificate(s) from a trusted certificate authority. After exchanging shared secrets using the certificate(s)’ public keys, the UWB endpoint may securely initiate UWB time-of-flight ranging measurements between the endpoint pad and robot. The UWB ranging may additionally be secured via a ranging key used to encrypt the time-of-flight information, which may be transferred through encrypted BLE communications.

[0034] Thus, the UWB endpoints 120A-120D may establish wireless communications between the endpoints 120A-120D and the robots 102A-102C. Accordingly, connectable packets on BLE or Wi-Fi are communicated via the short-range wireless transceiver, whereas ranging frames and measurements are effected via the precision ranging transceiver (e.g., UWB). For example, each UWB element may transmit connectable packets (e.g., BLE packets) to scan for robots which are approaching the UWB element, A robot may use one or more BLE or ultra-wideband (UWB) endpoints to listen to the packets from the UWB element. The robot may then connect to the endpoint, for example the robot may be the central BLE endpoint. Alternatively, the UWB element may connect to the robot, for example the element may be the central BLE endpoint. In some embodiments, the BLE packets may be required to meet a signal strength threshold before establishing wireless communications.

[0035] In some embodiments, authorization and secure communications between a robot and interactive stop elements or wireless endpoints can be implemented using a certificate¬ based scheme consistent with the encrypted exchanges described herein. Mutual authentication and session key derivation occur over the short-range wireless transceiver (e.g., BLE), and the ranging key used to encrypt time-of-flight information is provisioned over that authenticated short-range link for use by the precision ranging transceiver (e.g., UWB). An example implementation includes assigning each interactive stop element and optionally, each robot an identity certificate that is signed by a trusted issuing authority. The identity certificate enables mutual authentication and secure establishment of session keys over wireless channels such as BLE and UWB, as previously described. In addition, a separate operating-area certificate can be provisioned to an interactive stop element and / or a robot to indicate the human-readable operating area(s) in which that device is authorized to trigger or respond to stop actions. The operating-area certificate can be installed or updated via a mobile application that first retrieves a proof of possession token from the device, relays the token to a backend to obtain a signed command, and then loads tire signed operating-area permissions into the device. This approach aligns with the earlier disclosure of encrypted communications, authenticated provisioning, andTSLA.877WO / P02973-1 WOendpoint-defined spaces, and provides one exemplary mechanism to bind devices to defined operating spaces without relying on visual markers or manual configuration alone.|0036] In the illustrated example, the robots 102A-102C are included in operating space 110 which may define an area, or volume of space, in which the robots 102A-102C are authorized to move about. For example, the UWB endpoints 120A-120D may be positioned on substantially the same plane or surface as the robots 102A-102C. In some embodiments, the UWB endpoints 120A-120D may be adjusted in height or z-axis. For example, a UWB endpoint may be placed on a ceiling of a structure in which the robots 102A-102C are working.|0037] Figure 1A illustrates that the operating space 110 is rectangular. However, in various embodiments, the area and / or volume of the operating space 100 may have any shape. To define the operating space 110, the robots 102A-102C may enforce distance constraints from the UWB endpoints 120A-120D. As an example, each robot may periodically determine its location based on the robot’s distance from the endpoints 120A-120D. In some embodiments, the robot may determine its location based on a trigger, such as performing movement of its location (e.g., movement of its legs).|0038] With respect to enforcing distance constraints, in some embodiments the robots 102A-102C may maintain an internal map that defines the operating space 110. As an example, a robot may obtain information defining allowable distances, or distance ranges, from the UWB endpoints 120A-120D. For this example, when communicating with the UWB endpoints 120A-120D the endpoints may provide information indicating distance constraints that are allowable. Thus, a person may define the operating space 110 based on information stored by the UWB endpoints 120A-120D. As an example, the person may indicate that the UWB endpoints 120A-120D are associated with the operating space 110. For example, in some embodiments the person may use an application executing on a user device. Tire person may thus define tire perimeter, or surface, of the operating space 110. For example, the person may draw, or otherwise indicate, the operating space 110 via tire application, and the application may determine distance constraints from the endpoints 120A-120D that are in conformance with the space 110. Similarly, the person may assign particular UW B endpoints as forming the space 110.

[0039] In some embodiments, each robot may store information that defines the operating space 110. For example, the robot may be instructed to enforce the operating space 110 based on specific UWB endpoints 120A-120D. In this example, a person may use an application toTSLA.877WO / P02973-1 WOassociate the robots 102A-120C (e.g., associate unique identifiers of the robots) to the operating space 110. Thus, when the robots 102A-102C are placed within the operating space 110, they may ensure compliance with the boundaries of tire space 110.

[0040] In some embodiments, tire association of robots and interactive stop elements with a particular operating space can be effected by loading an operating-area certificate into those devices, in addition to or in lieu of drawing the perimeter in an application. Tire certificate can identify the operating area using human-readable descriptors and can be signed by a trusted authority, in alignment with the earlier disclosure that endpoints may authenticate robots and provide authorized distance constraints. A mobile application can query devices for their currently provisioned operating areas and, upon authorized user request, update those areas through an authenticated provisioning flow. This approach provides an exemplary implementation of the secure, authenticated assignment of robots and endpoints to operating spaces described above.

[0041] In some embodiments, a person may associate a robot with an operating space using an application that pairs with the robot. For example, and as described above, the person may use a user device to communicate with the robot. In this example, the user device may be in wireless communication with the robot and be authorized to instruct the robot. Thus, the person may associate the robot with a preexisting or new operating space 110. In some embodiments, the robot may follow the person to the operating space 110. For these embodiments, the person may enter the operating space 110 to cause the robot to also enter the operating space 110. The person may also stand proximate to, but outside of, the operating space 110. Hie person may then provide a visual signal (e.g., a hand motion), or a wireless instruction from the application, that causes the robot to enter the operating space 110.

[0042] As described above, the operating space 110 may be defined based on information from the UWB endpoints 120A-120D or based on information provided to the robot via the application. The robot may then enforce the operating space 110 boundaries, for example the robot may be stuck inside the operating space 110. In this way, robots may be led into operating spaces (e.g., operating space 110) and then remain stuck inside the operating spaces to perform work. In some embodiments, a particular robot may be enabled to lead other robots to different operating spaces. For example, the robot may traverse between operating spaces to cause movement of other robots to different work areas.TSLA.877WO / P02973-1 WO

[0043] In some embodiments, a robot may traverse to a different operating space based on receiving updated information. For example, there may be a multitude of UWB endpoints within a structure. In this example, a robot may be initially within operating space 110. The robot may then receive wireless information, for example the above-described application, indicating an updated selection of the multitude of UWB endpoints. Thus, the robot may stop ranging with, for example, UWB endpoints 120B and 120D and instead range with UWB endpoints 120A and 120C along with one or more additional UWB endpoints to the left of the endpoints 120A and 120C. The robot may also receive wireless communications from the one or more additional UWB endpoints. For example, the additional UWB endpoints may enable an overlapping operating space with operating space 110. In this way, the robot’s operating space may be updated in substantially real-time. Similarly, the robot may receive a task, or path, that causes the robot to leave operating space 110 and enter the different operating space.

[0044] In the illustrated example, robots 102A-102C are confined within operating space 110. As described above, each of the robots may determine its distance from the UWB endpoints 120A-120D. Thus, as each robot performs actions within the operating space 110 the robot may ensure that the robot stays within a boundary’ of the operating space 110. For example, each robot may calculate its relative position to the UWB endpoints 120A-120D. Using the relative position, each robot may thus determine its location relati ve to the boundary of the operating space 110,

[0045] In some embodiments, a robot may be rapidly stopped prior to exceeding the boundary of the operating space 110. For example, robot 102A may be carrying a heavy load towards the boundary of the operating space 110. In this example, robot 102A may stumble forward or undergo a malfunction that causes the robot 102A to exceed the boundary. The robot 102A may determine its location substantially continuously, such as every second or every threshold of a second. Thus, the robot 102A may determine that the robot 102A is outside the boundary and may stop movement. For example, the robot 102A may trigger a soft stop that transitions the robot to a safe state (e.g., a safe posture) and causes motor functions to cease. For example, the robot may safely place any load the robot was carrying down on the ground prior to ceasing. In some embodiments, the robot 102A may be disabled until re-enabled by a person. For example, the robot 102A may disable power to body controller(s) that cause the robot 102A to rapidly crumple. Once stopped, the robot 102A may, in some embodiments, be re-enabled via movement back into the operating space 110.TSLA.877WO / P02973-1 WO

[0046] The robots 102A-102C may communicate with each other as they move about the operating space 110. For example, robot 102A may provide wireless communications 104 to robot 102B. In this example, the robots may range with each other using time-of-flight measurements, or other techniques, as described herein. The robots may additionally provide their location or position relative to the UWB endpoints 120A-120D. The location or position may also represent a position (e.g., two- or three-dimensional coordinates) within the operating space 110. Thus, individual robots may generate a map of the operating space 110 along with substantially real-time locations of other robots in the space 110.

[0047] Using the wireless communications 104, the robots 102A-102C may coordinate movement within the operating space 110. For example, robot 102A may share its path, or upcoming movement actions, with robots 102B-102C. Similarly, robots 102B-102C may share their path or upcoming movement actions. The robots 102A-102C may then adjust movements to ensure that the robots do not collide or get in each other’s -way. For example, the robots 102A-102C may resolve any overlapping paths or upcoming positions and communicate updated paths. As described herein, the robots 102A-102C may accurately determine their position within the operating space 110 via ranging with each other. In some embodiments, the robots 102A-102C may combine the ranging information with visual information determined using image sensors. For example, robot 102A may use image sensor information to determine respective locations of robots 102B-102C, In this example, the ranging information may be used to refine, or otherwise adjust, these locations to more accurately position the robots 102B-102C within operating space 110.

[0048] The robots 102A-102C may also identify obstacles that may block movement ofthe robots 102A-102C. For example, in the illustrated embodiment obstacle 106 is included in operating space 110. This obstacle may be identified based on image sensor information, or touch information, obtained from the robots 102A-120C. The robots 102A-102C may update their maps associated with the operating space 110 to include the obstacle. In some embodiments, the maps may be shared with the robots 102A-102C. For example, the robots 102A-102C may collectively form a sensing graph associated with the operating space 110. In this example, the robots 102A-102C may navigate about the operating space 110 based on the shared sensing graph. Thus, even in low-light conditions any obstacle that one robot identifies may be shared with the remaining robots.

[0049] In some embodiments, each robot may ensure that the other robots are authorized to be in the operating space 110. For example, robot 102A may use its image sensors to visuallyTSLA.877WO / P02973-1 WOidentify the other robots 102B-102C. In this example, robot 102A may request authorization information (also referred to as authorization data) from the other robots 102B-102C (e.g., an authorization token, an authorization certificate from one or more known certificate authorities, or a key). The robots may receive, in some embodiments, authorization information for operating space 110 from the UWB endpoints 120A-120D. The authorization information may additionally be received from an outside user device or system (e.g., the above-described application). Robot 102A may inform the UWB endpoints 120A-120D, or an outside user device or system, if the robot 102A detects that one of the robots 102B-102C is not authorized to be in operating space 110. Robot 102A may request authorization information from robots 102B-102C. Robot 102A may additionally verify that the robots 102B-102C are in the authorized operating space 110. For example, robot 102A may receive information identifying the space for the robots 102B-102C (e.g., from the endpoints, the information may be in the authorization information, from a certificate authority or trusted system, and so on).

[0050] In some embodiments, an interactive stop element periodically advertises authenticated status information and, upon interaction, broadcasts an authenticated stop token to nearby robots in the permitted operating area. Consistent with the encrypted and authenticated BLE / UWB communications described above, the interactive stop element can include in its wireless advertising a non-sensitive index value and an indication of the operating area code, enabling nearby robots to determine whether the element is associated with one of their permitted operating spaces before initiating active scanning. Upon active scanning, the interactive stop element can provide, over authenticated wireless exchanges, a signed digest of a stop token and associated session metadata. The signature can be verified by the robot using the public key associated with the interactive stop element’s identity certificate and the trusted issuing authority, as described herein for endpoint-robot authentication (e.g., authorization data).

[0051] After verifying the signature and associating the interactive stop element with an allowed operating area, the robot can cache non-sensitive parameters, such as the element’s public identity and the last observed index value, for whitelisted scanning and efficient revalidation. When the interactive stop element is actuated, the interactive stop element can broadcast a stop token that, when hashed by tire robot, matches the previously authenticated digest. A match indicates that the authenticated stop token is present within range, and the robot asserts the appropriate stop action according to the selected stopping mode described elsewhere herein. For safety and replay resistance against previously captured stop tokens, the robot thenTSLA.877WO / P02973-1 WOmarks the matched digest as consumed and will not reuse the matched digest until the interactive stop element provides updated authenticated session information. This workflow is consistent with the previously described techniques in which interactive stop elements transmit message(s) over wireless channels, robots determine proximity and authorization, and stop actions are asserted in real time even in low-light or vision-denied scenarios.

[0052] In some embodiments, the robot performs periodic whitelisted scanning for interactive stop elements recently observed in its vicinity to detect updates in the advertised index or operating area code. If an update is detected and authenticated, the robot refreshes the cached parameters and continues monitoring for a corresponding stop token broadcast. Tire authenticated session information can include a time- or usage-based expiration parameter to limit the validity of a stop token, consistent with tire safety-focused, certificate-backed authorization model described above. These techniques complement other techniques described herein related to the robots establishing encrypted communications with endpoints and interactive stop elements, verifying authorization information for operating spaces, and performing distance-based actions, including stopping, based on authenticated, proximate interactions,

[0053] Figure IB illustrates a block diagram of the example robots 102A-102C and interactive stop elements 130A-130B. Tire interactive stop elements 130A-130B may, in some embodiments, represent interactive features which persons may use to trigger stopping of robots. For example, an interactive stop element may include a button which is connected to a fixed, or moveable, device. As another example, an interactive stop element may include an interaction with an application executing on a mobile device.

[0054] In the illustrated example, interactive stop element 130A has a stop radius 132 that defines a distance by which a robot will be affected by the interaction. For example, robots within the stop radius 132 may be stopped or otherwise disabled. In some embodiments, the interactive stop element 130Amay trigger wireless information 134 (e.g., wireless data packets) to robots positioned proximate to the element 130A. For example, robots 102A-102C may receive the wireless information 134. Tire wireless information 134 may be provided over BLE, Wi-Fi, cellular (e.g., long-term evolution (LTE)), and so on. The wireless information 134 may be provided over encrypted channels, for example the robots 102A-102C and element 130A may establish encrypted, or otherwise authorized, communications.TSLA.877WO / P02973-1 WO

[0055] The robots 102A-102C may then range with the interactive stop element 130A. For example, each robot may determine its distance from the interactive stop element 130A. In some embodiments, the element 130A may complete a time-of-flight measurement. As an example, the element BOA may determine its respective range from the robots 102A-102C. The respective ranges may be provided to the robots 102A-102C. In some embodiments, the robots 102A-102C may locally determine their distances from the element 130A,

[0056] Each interactive stop element may define a stop radius. For example, certain interactive stop elements may have longer, or shorter, stop radii as compared to other interactive stop elements. Tire stop radius may be provided, in some embodiments, to robots proximate to an interactive stop element. In Figure IB, once interactive stop element 130A is pressed, or interacted with, the element 130A may broadcast the stop radius 132 to robots102A-102C. In some embodiments, the robots 102A-102C may store information identifyinga default stop radius. For example, if the element 130A fails to broadcast its stop radius, orbroadcasts an incorrect value, the robots 102A-102C may use the default stop radius.

[0057] Robots 102A-102B that determine they are within stop radius 132 may then transition to a stop mode or configuration. As illustrated, robot 102C has determined that robot 102C is outside of the stop radius 132. In some embodiments, the robots interactive stop element 130A may have different stopping modes. For example, a person may trigger one ofthe stopping modes based on a type of interaction with the element 130A. Example interactions may be based on a pressure applied to a button, a quickness with which the button is depressed, a selection of one button over another button, and so on. An example stopping mode may include a graceful stop in which the robots 102A-102B transition to a safe posture and cease movement. Another example stopping mode may include a power cut in which power to tire robots 102A-102B is cut. For example, power to body controller(s), actuators, and related circuitry’ may be cut.

[0058] As will be described with reference to Figure 2B, robots 102A-102B may respond to the interactive stop element 130A even while malfunctioning. For example, the robots 102A-102B may include software and / or hardware that is separate from the software and / or hardware used to perform autonomous operation of the robots 102A-102B. As one example, wireless communications may be processed separately from autonomous operations of the robots 102A-102B. The output of the processing may be provided to processor(s) used to process autonomous operations. Thus, the output may instruct the processor(s) to perform a graceful stop towards a safe posture. The output may also be provided to a power supplyTSLA.877WO / P02973-1 WOcontroller or system on a chip (SoC). This output may cause performance of the power cut, for example by severing power to the body controller(s) used to control movement of the robots 102A-102B.

[0059] As described above, the interactive stop element 130A may cause robots 102A-102B that are within the stop radius 132 to stop. Thus, the example interactive stop element 103 A may implement a one-to-many relationship that enables the interactive stop element 103A to stop many robots. Another example interactive stop element may reflect a one-to-one relationship in which interaction with tire element may cause a single robot to stop. In some embodiments, the single robot may stop anywhere the robot is reachable via wireless communications. In some embodiments, the single robot may stop based on the robot being within a stop radius of the interactive stop element. Another example interactive stop element may cause a set of robots, but not other robots, to stop if they are within a stop radius or if they are reachable via wireless communications.

[0060] Figure 2A illustrates additional details of an example robot 200 in wireless communication with one or more robots 222, wireless endpoints 224, and interactive stop elements 226. Tire example robot 200 may represent a robot of one or more processors. For example, the robot may be similar to robots described in International App. No. PCT / US2023 / 032214, International App, No. PCT / US2023 / 034185, and International App. No. PCT / US2023 / 075626.

[0061] In the illustrated example, the robot 200 includes an autonomous engine 210. As may be appreciated, the autonomous engine 210 may enable autonomous actions of the robot 200. For example, the autonomous engine 210 may receive sensor information from image sensors, tactile or force sensors, and so on. In this example, the autonomous engine 210 may determine objects positioned about the robot 200, The autonomous engine 210 may additionally perform path planning, task planning, and so on to effectuate autonomous performance of specific tasks.

[0062] The robot 200 additionally includes a wireless communication engine 220 that communicates with other elements 222-226 as described herein. The wireless communication engine 220 includes both a short-range wireless transceiver (e.g., BLE and / or Wi-Fi) for session control and data exchange and a precision ranging transceiver (e.g., UWB) for accurate distance measurements. For example, the wireless communication engine 220 may include one or more of a UWB transceiver, a BLE transceiver, Wi-Fi, LTE, and so on. As described inTSLA.877WO / P02973-1 WOFigures 1A-1B, the robot 200 may range with other robots 222, UWB endpoints 224, and interactive stop elements 226. For example, the robot 200 may determine, or cause determination of, its distance from these elements.

[0063] The robot 200 may perform different actions based on distance measurements from the elements 222-226. For example, the wireless communication engine 220 may, in some embodiments, determine distance measurements with respect to UWB endpoints 224. In this example, the distance measurements may be provided to the autonomous engine 210 to inform movement within a defined operating space. As an example, the autonomous engine 210 may determine the robot’s 200 position within the operating space. As another example, the wireless communication engine 220 may monitor the robot’s position within the operating space. Thus, the position may be provided to tire autonomous engine 210 for use in movement of the robot 200.

[0064] Tire robot 200 may additionally stop or otherwise cause the robot 200 to be disabled based on the wireless communication engine 220. In some embodiments, tire short-range wireless transceiver carries authenticated control messages indicating boundary conditions and stop radii, while the precision ranging transceiver provides the underlying distance measurements used to evaluate those conditions. For example, the engine 220 may determine that the robot 200 has exceeded a boundary associated with an operating space. In this example, the engine 220 may cause the robot to stop. In some embodiments, the robot 200 may return into the operating space. For these embodiments, the robot 200 may ascertain whether any persons are proximate to the robot before moving back into the operating space. The wireless engine 220 may additionally receive information from an interactive stop element 226. As described above, with respect to Figure IB, the received information may indicate a stop radius associated with element 226. The engine 220 may then determine, or cause determination of, the distance of the robot 200 from the element 226, Based on the robot 200 being within the stop radius, the robot 200 may stop or otherwise be disabled.

[0065] lire wireless communication engine 220 may additionally communicate with other robots 222. For example, the robot 200 may determine, or cause the determination of, its distance from tire robots 222. As described above, the robot 200 may coordinate movements, path planning, and so on. As another example, the robot 200 may contribute to a sensing graph that indicates one or more of boundaries of an operating space, positions of other robots 222, obstacles, and so on.TSLA.877WO / P02973-1 WO

[0066] Figure 2B illustrates detail of triggering the example robot to stop functioning using example techniques. As may be appreciated, Figure 2B is an example block diagram, and certain elements may be present or omitted in various embodiments. In tire illustrated example, three example input types are used to stop the robot 200. For example, and with respect to element 232, in some embodiments the robot may be stopped based on receipt of information from an interactive stop element. As another example, and with respect to element 232, the robot may be stopped based on a determination that the robot is outside of an operating space. As another example, and with respect to element 234, the robot may be stopped based on receipt of voice commands. For this example, optionally the robot may respond to visual commands (e.g., provided by a person, sign, or other visual indicia). As another example, and with respect to element 236. The robot 200 may stop in response to a stop button or power cut.

[0067] Elements 232 and 234 may represent paths that cause the robot 200 to gracefully stop. For example, the robot 200 may receive information from an interactive stop element indicating the robot is to stop, in this example, and as described above, the robot 200 may determine its distance from the element. Based on its distance being within the stop radius, the robot 200 may provide information to the autonomous engine 210 indicating the robot 200 is to come to a safe posture. Similarly, based on receipt of a voice command the robot 200 may provide information to the engine 210 indicating that the robot 200 is to come to a safe posture.

[0068] In some embodiments, the robot 200 may ascertain whether the autonomous engine 210 has placed the robot 200 in a safe posture. For example, the robot 200 may monitor its movements or monitor information sent to body controller(s) 240. In this example, the robot 200 may cause the power to be cut to the body controller(s) 240 if the engine 210 failed to move the robot 200 towards a safe posture within a threshold time. For example, the power supply 242 may be cut.

[0069] In some embodiments, the stop architecture includes circuitry configured with two independent paths for asserting a stop: a soft stop path, which communicates a stop request to an application processor, and a power cut path, which directly controls energy-isolation circuitry' for the robot’s actuators. The soft stop path is consistent with the earlier disclosure in which the robot transitions to a safe posture under processor control. Tire power cut path provides a bypass of higher-level logic and software to remove power from the limbs or other body controllers, consistent with the previously described disconnection of power to body controller(s) included in the robot. This dual-path configuration ensures that a stop can beTSLA.877WO / P02973-1 WOguaranteed even in the presence of processor malfunction, compromise, or failure of autonomous control algorithms.|0070] In some embodiments, when the stop-control circuitry receives an authenticated command to assert the power cut, the stop-control circuitry may, prior to energizing the hardware isolation, send a brief pre-cut indication to the application processor via the soft stop path or another communication channel to allow' the processor an opportunity to transition to a safe posture. The endpoint can then assert the hardware isolation after a short delay, thereby combining tire benefits of graceful stopping with a guaranteed energy removal if graceful stopping does not complete in time. This staged approach is consistent with the previously disclosed separation between autonomous operations and stop enforcement, and with the described capability to both trigger a safe posture and, when required, effectuate a hardware power cut to ensure safety.

[0071] Element 236 may represent a path associated with cutting power via power supply 242. In some embodiments, the robot 200 may have a button that is associated with cutting all pow er to the robot 200. As another example, an interactive stop element may trigger a power cut to the robot 200. In some embodiments, certain voice commands, visual signals, and so on, may be associated with cutting the power.

[0072] In this way, the robot may be safely stopped based on receipt of disparate information. Advantageously, the techniques to stop the robot 200 may be separate from the autonomous engine 210. In this way, the robot 200 may ensure that the robot 200 can be stopped regardless of a fault associated with the autonomous actions of the robot 200.

[0073] Figure 3A illustrates a block diagram of an example robot 300 following a person 302 based on a user device 304 paired with, or otherwise in communication with, the example robot 300. Tire user device 304 may include, for example, a mobile device (e.g., a smart phone), a wearable device (e.g., a smart watch), a fob (e.g., a moveable device that includes wireless transceiver(s)), and so on. The example robot 300 may follow- the user device 304 into an operating space 310.

[0074] The user device 304 and robot 300 may be paired or otherwise in communication. With respect to pairing, the robot 300 may transmit advertisement information (e.g., advertisement packets) over a communication channel. As described herein, example communication channels may include BLE, Wi-Fi, LTE. and so on. The user device 304 may,TSLA.877WO / P02973-1 WOin some embodiments, transmit advertisement information. The robot 300 and / or user device 304 may then initiate a pairing process, for example a Bluetooth pairing process.|0075] After pairing, the robot 300 may follow the user device 304. For example, the person 302 may interact with the user device 304 to establish or otherwise set a follow mode with the user device 304. As an example, the robot 300 may range with the user device 304 to monitor its distance from the robot 300. The robot 300 may maintain at least a threshold distance from the person 302. For example, the robot 300 may be at least 1 meter, 2 meters, and so on from the person 302. The robot 300 may, in some embodiments, additionally be within a threshold range of the person 302, For example, the robot 300 may ensure that the robot 300 stays further than a first threshold distance and closer than a second threshold distance.

[0076] The robot 300 may thus autonomously follow the user device 304 while preserving a reasonable distance from the person 302. As illustrated, the person 302 is leading the robot 300 towards operating space 310. The operating space 310 may be defined using UWB endpoints 312A-312D, for example as described above. Thus, the operating space 310 may have a defined boundary (e.g., in the illustrated example, the boundary is rectangular).

[0077] The robot 300 may communicate with UWB endpoints 312A-312D as the robot 300 moves toward the operating space 310. For example, the user device 304 may have information indicating that the robot 300 is to be moved to operating space 310. Thus, the user device 304 may provide information to the robot 300 identifying the UWB endpoints 312A-312D which are to be used to define the operating space 310. As another example, the UWB endpoints 312A-312D may advertise themselves to the robot 300. The robot 300 may be associated with the endpoints 312A-312D, and thus the operating space 310, based on the robot 300 entering the space 310, In some embodiments, the robot 300 may wait a threshold amount of time before constraining itself to the space 310, For example, the robot 300 may wait until the person 302 configures the follow mode to be turned off.

[0078] Figure 3B illustrates a block diagram of an example mobile bot 322 configured to traverse between operating spaces 340A-340B. In some embodiments, a robot may be allowed to transition between operating spaces. In the illustrated example, mobile bot 322 is illustrated as moving between operating space 340A and operating space 340B. Thus, tire mobile bot 322 may be associated with both operating spaces 340A-340B. In contrast, robot 320 is illustrated as being constrained within operating space 340A.TSLA.877WO / P02973-1 WO

[0079] The illustrated operating spaces 340A-340B are defined, respectively, by UWB endpoints 330A-330B. In the illustrated embodiment, each operating space is circular based on use of a single UWB endpoint. In some embodiments, the mobile bot 322 may leave operating space 340A and enter operating space 340B. For example, the operating spaces 340A-340B may touch, or overlap, such that the mobile bot 322 is able to maintain inclusion in one of the operating spaces at all times. To transition to operating space 340B, the mobile bot 322 may cease ranging with UWB endpoint 330A (e.g., at the boundary of space 340A) and initiate ranging with UWB endpoint 330B. Thus, the mobile bot 322 may ensure that it respects the confines of the operating spaces. In some embodiments, the mobile bot 322 may range with both endpoints 330A-330B such that the mobile bot 322 treats spaces 340A-340B as a large space encompassed by both endpoints 330A-330B.Example Flowcharts

[0080] Figure 4 A is a flowchart of an example process for a robot taking action based on measured distances between the robot and another robot or a wireless endpoint. For convenience, the process 400 will be described as being performed by a system of one or more processors (e.g., robots 102A, 200, 300, 320, 322).

[0081] At block 402, the system responds to wireless advertisement information from a robot or from a wireless endpoint. As described above, the system may receive advertisement packet(s) from other robots or from wireless endpoints. The robots may communicate together to, for example, range with each other to determine distances, exchange path information, perform cooperative localization (e.g., in vision-denied scenarios, such as low or no light), and so on. The robot may additionally communicate with the wireless endpoints to determine its location relative to the endpoints.

[0082] At block 404, the system transmits a ranging request to the robot or wireless endpoint. The system may use, for example, UWB to range with the robot or wireless endpoint. In this way, the system may determine a distance measurement between itself and the robot or wireless endpoint.

[0083] At block 406, the system takes an action based on the measured distance. The system may determine its location relative to wireless endpoints and perform subsequent movement actions, path planning, and so on, based on the location. The system may also cause the system to stop, or otherwise shut down, based on its location exceeding boundaries of anTSLA.877WO / P02973-1 WOoperating space. The system may also communicate movements, path information, and so on, with other robots proximate to the system.10084 ] Figure 4B is a flowchart of an example process 410 for robots updating paths based, at least in part, on ranging between the robots. For convenience, the process 410 will be described as being performed by a system of one or more processors (e.g., robots 102A, 200, 300, 320, 322).

[0085] At block 412, the system responds to wireless advertisement information from other robots. As described above, the wireless advertisement information may represent BLE, LTE, Wi-Fi, and so on, information. The system and the robots may then establish communications, such as encrypted communications.

[0086] At block 414, the system transmits one or more ranging requests to the robots. The system may use, for example, UWB to range with the robots. At block 416, the system monitors locations associated with the robots. The system may monitor its position relative to the other robots. The system may also receive location information (e.g., relative to a shared operating space) from the other robots.

[0087] At block 418, the system communicates path information with the robots. As described above, the robots may coordinate movements such that they can coexist within the operating space. The system may additionally work with the robots for cooperative localization, such as via sharing positions of objects, and so on.

[0088] Figure 5A is a flowchart of an example process 500 for a robot determining to stop or resume movement based on an operating space. For convenience, the process 500 will be described as being performed by a system of one or more processors (e.g., robots 102A, 200, 300, 320, 322).

[0089] At block 502, the system receives advertisement information from wireless endpoints. At block 504, the system transmits ranging requests to the wireless endpoints. For example, as described herein the ranging requests may be effectuated using UWB.

[0090] At block 506, the system periodically determines its position relative to the wireless endpoints. The endpoints may be used to define an operating space. For example, the system may obtain information indicating boundaries of the operating space which are defined using the endpoints. In this example, the system may monitor its location within the operating space.TSLA.877WO / P02973-1 WO

[0091] At block 508. the system determines to stop or resume movement based on the operating space. The system may trigger a stop, such that the system is disabled, based on determining that the robot has exited, or is likely to exit (e.g., greater than a threshold likelihood), the operating space, in some embodiments, the system may resume movement based on being moved back into the operating space.

[0092] Figure 5B is a flowchart of an example process 510 for a robot determining to stop based on an operating range associated with an interactive stop element. For convenience, the process 510 will be described as being performed by a system of one or more processors (e.g., robots 102A, 200, 300, 320, 322).

[0093] At block 512, the system receives wireless information from an interactive stop element. As described above, for example with respect to Figures 2A-2B, the interactive stop element may output a wireless signal (e.g., over BLE, LTE, and so on) which is received via the system. The wireless signal may indicate a stop radius associated with the interactive stop element.

[0094] At block 514, the system transmits a ranging request to the interactive stop element. The system may determine its distance from the interactive stop element, for example using UWB

[0095] At block 516, the system determines to stop based on the measured distance and stop radius, or operating range, associated with tire interactive stop element. For example, if the system determines that the system is within the stop radius the system may trigger a stop.Other Embodiments

[0096] All of the processes described herein may be embodied in, and fully automated, via software code modules executed by a computing system that includes one or more computers or processors. The code modules may be stored in any type of non-transitory computer- readable medium or other computer storage device. Some or all the methods may be embodied in specialized computer hardware.

[0097] Many other variations than those described herein will be apparent from this disclosure. For example, depending on the embodiment, certain acts, events, or functions of any of the algorithms described herein can be performed in a different sequence or can be added, merged, or left out altogether (for example, not all described acts or events are necessary forTSLA.877WO / P02973-1 WOthe practice of the algorithms). Moreover, in certain embodiments, acts or events can be performed concurrently, for example, through multi-threaded processing, interrupt processing, or multiple processors or processor cores or on other parallel architectures, rather than sequentially, In addition, different tasks or processes can be performed by different machines and / or computing systems that can function together.

[0098] The various illustrative logical blocks, modules, and engines described in connection with the embodiments disclosed herein can be implemented or performed by a machine, such as a processing unit or processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A processor can be a microprocessor, but in the alternative, the processor can be a controller, microcontroller, or state machine, combinations of the same, or the like. A processor can include electrical circuitry configured to process computer-executable instructions. In another embodiment, a processor includes an FPGA or other programmable device that performs logic operations without processing computer-executable instructions. A processor can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Although described herein primarily with respect to digital technology, a processor may also include primarily analog components. For example, some or all of the signal processing algorithms described herein may be implemented in analog circuitry or mixed analog and digital circuitry. A computing environment can include any type of computer system, including, but not limited to, a computer system based on a microprocessor, a mainframe computer, a digital signal processor, a portable computing device, a device controller, or a computational engine within an appliance, to name a few.

[0099] Conditional language such as, among others, “can,” “could,” “might” or “may,” unless specifically stated otherwise, are understood within the context as used in general to convey that certain embodiments include, while other embodiments do not include, certain features, elements and / or steps. Thus, such conditional language is not generally intended to imply that features, elements and / or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and / or steps are included or are to be performed in any particular embodiment.TSLA.877WO / P02973-1 WO

[0100] Disjunctive language such as the phrase ‘"at least one of X, Y, or Z,” unless specifically stated otherwise, is understood with the context as used in general to present that an item, term, etc., may be either X, Y, or Z, or any combination thereof (for example, X, Y, and / or Z). Thus, such disjunctive language is not generally intended to, and should not, imply that certain embodiments require at least one of X, at least one of Y, or at least one of Z to each be present,

[0101] Any process descriptions, elements or blocks in the flow diagrams described herein and / or depicted in tire attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or elements in the process. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, executed out of order from that shown, or discussed, including substantially concurrently or in reverse order, depending on the functionality involved as would be understood by those skilled in the art.

[0102] Unless otherwise explicitly stated, articles such as a " or “an” should generally be interpreted to include one or more described items. Accordingly, phrases such as “a device configured to” are intended to include one or more recited devices. Such one or more recited devices can also be collectively configured to carry out the stated recitations. For example, “a processor configured to carry out recitations A, B and C” can include a first processor configured to carry out recitation A working in conjunction with a second processor configured to carry out recitations B and C

[0103] It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure.

Claims

TSLA.877WO / P02973-1 WOWHAT IS CLAIMED IS:

1. A robot comprising:a wireless communication transceiver configured to perform wireless ranging; one or more processors; andmemory storing authorization data, wherein the one or more processors are configured to:establish a wireless communication session with an external device wherein the external device is configured to establish an operating space and / or cause a stop;obtain ranging measurements between the robot and the external device; determine at least one distance- or position-based condition based on information received from the external device; andin response to the condition, cause one or more actuators of the robot to perform at least one action.

2. The robot of claim 1, wherein the external device comprises at least one of a different robot, an interactive stop element, or a wireless endpoint.

3. The robot of claim 1, wherein the wireless communication session is mutually authenticated and encrypted,4. The robot of claim 1, wherein obtaining ranging measurements comprises obtaining at least one of time-of-flight measurements, phase-based ranging measurements, received- signal-strength analysis measurements, angle-of-arrival measurements, or angle-of-departure measurements.

5. The robot of claim 2, wherein the condition comprises at least one of the robot being within boundaries of an operating space defined using wireless endpoints, the robot being within a stop radius associated with an interactive stop element, or a proximity of the robot to another robot or obstacle requires path adjustment.

6. The robot of claim 1, wherein the action comprises at least one of updating motion planning or asserting a stop action, wherein the stop action comprises at least one of (i) a processor-controlled soft stop that transitions the robot to a safe posture and (ii) a hardwareTSLA.877WO / P02973-1 WOpower cut that removes energy from at least one of a body controller or an actuator via energyisolation circuitry independent of an application processor.

7. The robot of claim 1, wherein the authorization data comprises an identity certificate and an operating-area certificate signed by a trusted issuing authority, and wherein the one or more processors are further configured to:perform mutual authentication with the external device using the identity certificate wherein the mutual authentication creates an authenticated wireless link; restrict responses to distance- or position-based conditions to external devices whose operating-area identifiers match the operating-area certificate; and encrypt ranging data using a ranging key provisioned over the authenticated wireless link.

8. The robot of claim 1, wherein ranging is performed using ultra-wideband (UWB).

9. The robot of claim 1, wherein wireless communication is established using Bluetooth low energy (BLE).

10. The robot of claim 1, wherein the one or more external devices include a wireless endpoint, and wherein the one or more processors are further configured to:obtain information indicating a distance from which the robot is authorized to be located,wherein the distance informs an operating space; andwherein based on the robot exceeding a boundary space, the action includes stopping the robot.

11. The robot of claim 10, wherein the information is obtained from the wireless endpoint.

12. The robot of claim 10, wherein the information is obtained from a user device,13. The robot of claim 1, wherein the one or more external devices include another robot, and wherein the one or more processors are configured to:communicate respective path information with the other robot, such that the robot and the other robot can navigate within an operating space.TSLA.877WO / P02973-1 WO14. The robot of claim 1, wherein the external devices comprises an interactive stop element, wherein the one or more processors are configured to receive, via wireless communications, information indicating a stop radius associated with the interactive stop element, and wherein taking the action comprises:determining, based on the condition, that the robot is within the stop radius; andstopping the robot.

15. The robot of claim 1, wherein the external device comprises a user device associated with a person, wherein the one or more processors are configured to:cause the robot to follow the user device, wherein the robot maintains at least a threshold distance from the person based on tire determined ranging measurements.

16. The robot of claim 15, wherein the robot receives information configuring the robot into a follow mode.

17. The robot of claim 15, wherein the robot follows the user device to a boundary associated with an operating space, wherein the operating space is defined based on one or more wireless endpoints that range with the robot, and wherein the one or more processors are configured to maintain the robot within the operating space.

18. A method implemented by a robot having a wireless communication transceiver configured to perform ranging with external devices and one or more processors, the method comprising:establishing a wireless communication session with an external device wherein the external device is configured to provide operating-space and / or stopping parameters;obtaining ranging measurements between the robot and the external device; determining at least one distance- or position-based condition based on information received from the external device; andcausing one or more actuators of the robot to perform at least one action in response to the condition.TSLA.877WO / P02973-1 WO19. The method of claim 18, wherein the external device comprises at least one of other robots, interactive stop elements, and wireless endpoints.

20. The method of claim 18, wherein the wireless communication session is mutually authenticated and encrypted.

21. The method of claim 18, wherein obtaining ranging measurements comprises at least one of time-of-flight, phase-based ranging, received-signal-strength analysis, angle-of-arrival, or angle-of-departure.

22. The method of claim 18, wherein the condition comprises at least one of whether the robot is within boundaries of an operating space defined using wireless endpoints, w hether the robot is within a stop radius associated with an interactive stop element, or whether proximity to another robot or obstacle requires path adjustment.

23. The method of claim 18, w'herein the action comprises at least one of updating motion planning or asserting a stop action, w'herein the stop action comprises at least one of processor-controlled soft stop that transitions the robot to a safe posture and a hardware power cut that removes energy from at least one of a body controller or an actuator via energyisolation circuitry independent of an application processor.

24. The method of claim 18, further comprising:authenticating an interactive stop element by verifying a signed digest that includes session metadata comprising at least one of an index value and an expiration parameter;caching the session metadata;receiving a broadcast stop token from the interactive stop element; determining that a hash of the stop token matches the signed digest; asserting a stop action in response to the match; andmarking the signed digest as consumed to provide replay resistance until updated authenticated session metadata is obtained.

25. A system comprising:at least one external device; anda robot comprising:TSLA.877WO / P02973-1 WOa wireless communication transceiver configured to perform ranging with external devices;one or more processors configured to:establish a wireless communication session with the at least one external device wherein the external device is configured to provide operating-space and / or stopping parameters;obtain ranging measurements between the robot and the at least one external device;determine at least one distance- or position-based condition based on information received from the at least one external device; and in response to the condition, cause one or more actuators of the robot to perform at least one action.

26. The system of claim 25. wherein the at least one external device comprises at least one of other robots, interactive stop elements, and wireless endpoints.

27. The system of claim 25, wherein the wireless communication session between the robot and the at least one external device is mutually authenticated and encrypted,28. The system of claim 25, wherein obtaining the ranging measurements comprises at least one of time-of-flight, phase-based ranging, received-signal strength analysis, angle-of- arrival, or angle-of-departure.

29. The system of claim 25, wherein the at least one distance- or position-based condition comprises at least one of whether the robot is within boundaries of an operating space defined using wireless endpoints, whether the robot is within a stop radius associated with an interactive stop element, or whether proximity to another robot or obstacle requires path adjustment,30. The system of claim 25, wherein the at least one action comprises at least one of updating motion planning or asserting a stop action, wherein the stop action comprises at least one of a processor-controlled soft stop that transitions the robot to a safe posture and a hardware power cut that removes energy from at least one of a body controller or an actuator via energy-isolation circuitry independent of an application processor.

Images