JP2008107926A - Drive control device, robot controller and autonomous moving device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a drive control device enhanced in reliability and safety in abnormality detection. <P>SOLUTION: The drive control device comprises an electric power control part 214 controlling electric power supplied to motors 31, 32 serving as a drive part, and a drive control CPU 212 receiving the input of operation instructions and outputting control signals to the electric power control part 214 in response to the operation instructions. The drive control CPU 212 comprises a first abnormality monitoring part 218 carrying out error processing when an internal clock signal of the drive control CPU 212 is not detected within a first predetermined period. A second abnormality monitoring part 213 connected to the drive control CPU 212 and carrying out error processing when the signal is not detected within the first predetermined period, is further provided outside the drive control CPU 212. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a drive control device that improves the reliability and safety of abnormality detection, a robot controller including the drive control device, and the drive control device or an autonomous mobile device including the robot controller.

  Conventionally, the abnormality detection means of the control device is composed of a plurality of control devices, and periodically transmits and receives health check signals that change periodically, and the control device that receives the health check signal periodically changes the signal. There is one that monitors and determines that the state of the control device that has transmitted the health check signal is abnormal if the signal does not change for a predetermined time (see, for example, Patent Document 1).

  As another abnormality detection means, when a pulse corresponding to the health check signal is input from a plurality of devices such as an emergency stop switch to a watch dog timer provided in the controller of the limb driving apparatus, and at least one of them is abnormal Discloses a method for improving the reliability of abnormality detection by turning off the control output (see, for example, Patent Document 2).

  In addition, by multiplexing the data indicating the necessity of emergency stop and the output signal, or by changing a part of the signal, the received signal is compared to guarantee the accuracy of the signal, and the reliability of abnormality detection Some of them improve the property (see, for example, Patent Documents 3 and 4).

Further, in the autonomous mobile device including the drive control unit and the human interface control unit, the drive control unit and the human interface control unit transmit and receive signals indicating that they are normal to each other, and monitor each other. When an abnormality is detected, the other control unit restarts the abnormal control unit (for example, see Patent Document 5).
Japanese Patent Laid-Open No. 08-171507 JP 2002-000678 A JP 2004-148488 A JP 2005-107898 A JP 2005-149376 A

  However, according to Patent Document 1, a plurality of control devices are required, and in order to monitor the health check signal, the control devices are required to be paired at least, which is redundant and expensive.

  Further, in Patent Document 2, when a pulse corresponding to the health check signal is input from a plurality of devices such as an emergency stop switch to a watchdog timer provided in a controller of the limb driving apparatus, and at least one of them is abnormal Although the reliability of abnormality detection is improved by turning off the control output and the safety of the limb body driving device is increased, sufficient abnormality detection is possible when focusing on the key controller that controls the limb body driving device. The mechanism of is not made.

  In Patent Literature 3 and Patent Literature 4, data indicating whether or not an emergency stop is required, output signals are multiplexed, or part of the signals are changed, so that the received signals are compared to increase the accuracy of the signals. While guaranteeing and improving the reliability of abnormality detection transmission, the abnormality detection power itself has not been improved.

  In Patent Document 5, if monitoring and restarting depend on a control unit that performs other processing, the processing may not be in time. In particular, an abnormality in the driving unit of the autonomous mobile device may cause a fatal accident.

  Therefore, in view of the above points, the present invention includes a drive control device that improves the reliability of abnormality detection and also has a plurality of means for processing for detected abnormality to improve safety, and the drive control device. Another object of the present invention is to provide a robot controller and an autonomous mobile device including the drive control device or the robot controller.

  In order to solve the above-described problem, the drive control device according to claim 1 receives a power control unit that controls power supplied to the drive unit and an operation instruction, and controls the power control unit according to the operation instruction. A drive control device that outputs a signal, and the drive control CPU includes a first abnormality monitoring unit that performs error processing when the internal clock signal of the drive control CPU is not detected in a first predetermined period. And a second abnormality monitoring unit that is connected to the drive control CPU and performs error processing when a signal is not detected during the first predetermined period is further provided outside the drive control CPU.

  According to a second aspect of the present invention, in the drive control device according to the first aspect, the second abnormality monitoring unit performs error processing even when a signal due to a software processing leak or a signal due to electrical noise is detected. It is characterized by performing.

  According to a third aspect of the present invention, in the drive control device according to the first or second aspect of the invention, the second abnormality monitoring unit makes the signal the same as the first predetermined period and the start period, and is shorter than the first predetermined period. Error processing is also performed when detected in the second predetermined period.

  A robot controller according to a fourth aspect includes the drive control device according to any one of the first to third aspects, and a host controller that gives an operation instruction to the drive control device, and the second abnormality monitoring unit includes: As error processing, an error notification is sent to the host controller.

  According to a fifth aspect of the present invention, in the robot controller according to the fourth aspect, the host controller is connected to a cutoff circuit between the power control unit and the drive unit, and when receiving an error notification, A shutoff signal is output to the shutoff circuit so as to shut off.

  According to a sixth aspect of the present invention, in the robot controller according to the fourth or fifth aspect, when the first abnormality monitoring unit does not detect the internal clock signal in the first predetermined period, the drive control CPU notifies the host controller. An error notification is made, and an error notification from the drive control CPU and an error notification from the second abnormality monitoring unit are sent to the host controller, and the host controller presents an error route indicating which error notification was made. A presentation unit is provided.

  The autonomous mobile device according to claim 7 includes the drive control device according to any one of claims 1 to 3 or the robot controller according to any one of claims 4 to 6. And

  In the first aspect of the present invention, since the second abnormality monitoring unit is provided outside the drive control CPU, the abnormality is detected even when the drive control CPU itself is in an abnormal state or stopped, Error handling can be performed. Therefore, the reliability and safety of abnormality detection can be improved. Moreover, since the 2nd abnormality monitoring part should just be provided with the function to judge whether a signal is detected in a 1st predetermined period, it can comprise at low cost.

  In the invention described in claim 2, since the second abnormality monitoring unit exists outside the drive control CPU, the period from the drive control CPU is determined by a signal due to software processing leakage or a signal due to electrical noise. Although it may be determined that a signal has been detected, error processing is also performed when a signal due to software processing leaks or a signal due to electrical noise is detected, further improving the reliability and safety of abnormality detection Can do.

  In the invention according to claim 3, since the first predetermined period and the start period are the same and a second predetermined period shorter than the first predetermined period is set, the second abnormality monitoring unit is a signal generated by a software processing leak. And signals due to electrical noise can be detected uniformly.

  In the invention described in claim 4, since the second abnormality monitoring unit notifies the host controller of an error, the host controller can perform appropriate error processing even when the drive control CPU stops.

  In the fifth aspect of the present invention, the host controller that has received the error notification can cut off the power from the outside without going through the drive control CPU in which an abnormality has occurred, so that safety can be improved.

  In the invention described in claim 6, the host controller is provided with an error presenting unit for presenting on which route the error notification is made, and the error signal is the first abnormality monitoring unit and the second abnormality monitoring. Since it is possible to easily confirm which one of the sections is outputting or both of which are output, it is possible to quickly identify the cause of the occurrence of the abnormality.

  In the invention according to claim 7, since it comprises the drive control device according to any one of claims 1 to 3 or the robot controller according to any one of claims 4 to 6, An autonomous mobile device with high reliability and safety of abnormality detection can be obtained.

(Embodiment 1)
FIG. 1 shows an autonomous mobile device according to the present invention.

  The autonomous mobile device 1 includes an instruction input device 2, a robot controller 3 according to the present invention, motors 31 and 32 as driving units, moving wheels 33 and 34, a power supply battery 4, a laser radar 5 and an ultrasonic sensor. 6 (see FIG. 2).

  The instruction input device 2 is, for example, a touch panel monitor, receives a command from a user, and transmits the information to the robot controller 3.

  The robot controller 3 determines the operation content of the autonomous mobile device 1 in accordance with an instruction from the user through the instruction input device 2 and then controls the motors 31 and 32 to drive the moving wheels 33 and 34. The autonomous mobile device 1 is operated.

  The motors 31 and 32 rotate at a rotational speed according to a speed command from the robot controller 3 and drive the moving wheels 33 and 34.

  The moving wheels 33 and 34 are driven by the rotation of the motors 31 and 32. An auxiliary wheel (not shown) may be provided so that the autonomous mobile device 1 can move smoothly. For the same reason, the moving wheels 33 and 34 may be crawlers.

  The laser radar 5 and the ultrasonic sensor 6 recognize the environment by measuring the distance to the peripheral object of the autonomous mobile device 1 and transmit the information to the robot controller 3.

  FIG. 2 shows a schematic diagram of the connection of each device centering on the robot controller 3 according to the present invention.

  The robot controller 3 includes a basic configuration of a drive control device 21 according to the present invention, a motion control PC 22 and a human interface PC 23 as a host controller, and an integrated substrate 24 that connects the drive control device 21, the motion control PC 22 and the human interface PC 23. And In addition, although not shown, a relay for safety measures and various interfaces for communication are also provided. The laser radar 5, the ultrasonic sensor 6, the bumper sensor (not shown), and the like are connected to the motion control PC 22 and the human interface PC 23 via the integrated substrate 24.

  The drive control device 21 controls driving of the motors 31 and 32 in response to an instruction from the motion control PC 22.

  The motion control PC 22 issues an operation instruction to the drive control device 21 so that the autonomous mobile device 1 operates in accordance with the instruction content input to the human interface PC 23. In addition, a map storage unit, a position storage unit, and a route generation unit (not shown) are provided to determine a movement route from environmental information obtained from the laser radar 5 and the ultrasonic sensor 6 and to drive and control rotation of a motor necessary for movement. Instruct the device 21.

  The human interface PC 23 mainly processes communication with people and other robots.

  FIG. 3 shows an example of the internal configuration of the drive control device 21 according to the present invention.

  The drive control device 21 has a drive control CPU 212, a second abnormality monitoring unit 213, and a power control unit 214 as a basic configuration.

  The drive control CPU 212 receives an operation instruction and outputs a control signal to the power control unit 214 in accordance with the operation instruction.

  The second abnormality monitoring unit 213 detects an abnormality by detecting a periodic signal output from the drive control CPU 212. The second abnormality monitoring unit 213 determines that the signal detected during the first predetermined period is a periodic signal that is output when the drive control CPU 212 is in a normal state. Therefore, the second abnormality monitoring unit 213 performs error processing when no signal is detected during the first predetermined period. The first predetermined period referred to in the present invention is, for example, a period of every 10 milliseconds. Note that the second abnormality monitoring unit 213 may be configured to perform error processing even when a signal due to a software processing leak or a signal due to electrical noise is detected. This is because a signal due to a software processing leak or a signal due to electrical noise causes a reduction in safety. As a method for detecting a signal due to a software processing leak or a signal due to electrical noise, for example, even if it is the first predetermined period, the first predetermined period and the start period are the same, and the second is shorter than the first predetermined period. There is a method in which a signal detected during a predetermined period is used as a signal due to software processing leakage or a signal due to electrical noise. The second predetermined period is, for example, a period of every 5 milliseconds. Details of the error processing will be described later using the flowchart shown in FIG.

  The power control unit 214 controls the power supplied to the motors 31 and 32. A shut-off circuit 211 is provided between the power control unit 214 and the motors 31 and 32 so that a shut-off signal or a return signal can be input to shut off or return the power supply. More specifically, the cutoff circuit 211 may use an electromagnetic relay.

  The drive control CPU 212 has a motor control output port 215, a communication unit 216, a clock 217, a first abnormality monitoring unit 218, a port D-OUT 219, and a reset input port 220 as basic configurations.

  The motor control output port 215 outputs a control command to the power control unit 214.

  The communication unit 216 communicates operation instructions (commands, responses, and other information) with the host controller 22 or 23.

  The clock 217 transmits an internal clock signal that is turned on and off at predetermined intervals within the drive control CPU 212.

  The first abnormality monitoring unit 218 detects an internal clock signal from the clock 217. If the first abnormality monitoring unit 218 does not detect the internal clock signal output from the clock 217 during the first predetermined period, the first abnormality monitoring unit 218 determines that the drive control CPU 212 is in an abnormal state and performs error processing. Details of the error processing will be described later using the flowchart shown in FIG.

  The port D-OUT 219 can output a periodic signal to the outside of the drive control CPU 212 according to software recorded in the drive control CPU 212. In this embodiment, the port D-OUT 219 has eight output ports, one of which is connected to the second abnormality monitoring unit 213.

  The reset input port 220 receives a reset signal from the first abnormality monitoring unit 218, the second abnormality monitoring unit 213, and the host controller 22 or 23. When the reset input port 220 receives the reset signal, the drive control CPU 212 resets the internal software, restarts, and tries to recover from the abnormal state.

  FIG. 4 shows a flowchart of the electrical signal of the drive control device 21 and the software processing in the drive control CPU 212.

  The process starts when the drive control device 21 is turned on (S1).

  First, various initialization processes are performed (S2). For example, the encoder is cleared or environmental information from the host controller 22 or 23 is acquired.

  Next, calculation and output processing for controlling the motors 31 and 32 are repeated (Ls to Le).

  First, a calculation for controlling the motors 31 and 32 is performed (S3).

  Next, the clock 217 outputs an internal clock signal to the first abnormality monitoring unit 218 in order to confirm (guarantee) that the calculation in S3 is completed within a predetermined time (S4).

  If the first abnormality monitoring unit 218 does not detect the internal clock signal in the first predetermined period (S5), it performs error processing. Specifically, a reset signal is output to the reset input port 220 (S6), and reset processing of the drive control CPU 212 is performed (S7). If the first abnormality monitoring unit 218 does not detect the internal clock signal during the first predetermined period (S5), the first abnormality monitoring unit 218 outputs an error signal to the host controller 22 or 23 via the port D-OUT 219 (S8). ), Error notification. Upon receiving the error notification, the host controller 22 or 23 outputs a cutoff signal to the cutoff circuit 211 (S9), shuts off the supply of power to the motors 31 and 32, and resets to the reset input port 220 of the drive control CPU 212. A signal is output (S10), and reset processing is performed (S7). If the first abnormality monitoring unit 218 does not detect the internal clock signal during the first predetermined period (S5), the first abnormality monitoring unit 218 outputs a cutoff signal to the cutoff circuit 211 via the port D-OUT 219 (S11). The power supply to the motors 31 and 32 is cut off. If it is detected during the first predetermined period (S5), the state is normal and the first abnormality monitoring unit 218 is cleared (S12).

  Subsequently, the periodic signal of the drive control CPU 212 is output from the port D-OUT 219 to the second abnormality monitoring unit 213 (S13).

  If the second abnormality monitoring unit 213 detects a signal in the second predetermined period (S14), the second abnormality monitoring unit 213 performs error processing. Specifically, a reset signal is output to the reset input port 220 (S15), and reset processing of the drive control CPU 212 is performed (S7). Further, when the second abnormality monitoring unit 213 detects a signal in the second predetermined period (S14), the second abnormality monitoring unit 213 outputs an error signal to the host controller 22 or 23 (S16) and performs error notification. Upon receiving the error notification, the host controller 22 or 23 outputs a cutoff signal to the cutoff circuit 211 (S9), shuts off the supply of power to the motors 31 and 32, and resets to the reset input port 220 of the drive control CPU 212. A signal is output (S10), and reset processing is performed (S7). In addition, when the second abnormality monitoring unit 213 detects a signal in the second predetermined period (S14), it outputs a cutoff signal to the cutoff circuit 211 (S17), and cuts off the supply of power to the motors 31 and 32. To do.

  If the second abnormality monitoring unit 213 does not detect the signal during the second predetermined period (S14), the second abnormality monitoring unit 213 determines whether the signal is detected after the second predetermined period ends and before the first predetermined period ends. (S18). The signal detected during this period may be a normal periodic signal from the drive control CPU 212. If no signal is detected during this period (S18), the second abnormality monitoring unit 213 performs error processing similar to the above (S15 to S17). On the other hand, if a signal is detected during this period (S18), the drive control CPU 212 outputs a motor control signal from the motor control output port 215 to the power control unit 214 as a normal state, and the motors 31, 32 are detected. (S19), and the second abnormality monitoring unit is cleared (S20).

  Further, communication with the host controller 22 or 23, IO processing, etc. are executed (S21).

  When the first predetermined period has elapsed, the process returns to the motor control calculation (S3) again, and the same processing is repeated. In the present embodiment, the first predetermined period is a period of every 10 milliseconds.

  For example, the drive control CPU 212 may cause a thermal runaway, the motor control calculation cannot be performed due to a voltage abnormality, or the motor control output port 215 cannot be output within a first predetermined period (for example, every 10 milliseconds). In this case, the autonomous mobile device 1 performs an unexpected operation. At this time, since the processing is not completed within the first predetermined period, the first abnormality monitoring unit 218 or the second abnormality monitoring unit 213 detects an abnormality at the moment when the first predetermined period is exceeded.

  Here, it is highly possible that the first abnormality monitoring unit 218 inside the drive control CPU 212 alone cannot detect an abnormality when the drive control CPU 212 is in an abnormal state. Even if an abnormality is detected, there is a possibility that no processing can be performed.

  Therefore, since the second abnormality monitoring unit 213 is provided outside the drive control CPU 212, an abnormality can be detected and error processing can be performed even when the drive control CPU 212 itself enters an abnormal state or stops. . Therefore, the reliability and safety of abnormality detection can be improved. Moreover, since the 2nd abnormality monitoring part 213 should just be provided with the function to judge whether a signal is detected in a 1st predetermined period, it can be comprised cheaply.

  Since the second abnormality monitoring unit 213 exists outside the drive control CPU 212, it may be determined that a periodic signal has been detected due to software processing leakage or electrical noise, but software processing leakage. If it is configured to perform error processing even when a signal due to or a signal due to electrical noise is detected, the reliability and safety of abnormality detection can be further improved.

  For example, as shown in the present embodiment, if the first predetermined period and the start period are the same and a second predetermined period shorter than the first predetermined period is set, the second abnormality monitoring unit 213 causes a software processing leak. Signals and signals due to electrical noise can be detected uniformly.

  In addition, since the second abnormality monitoring unit 213 notifies the host controller 22 or 23 of an error, the host controller 22 or 23 can perform appropriate error processing even when the drive control CPU 212 stops. For example, in the drive control CPU 212 in which an abnormality has occurred, it is possible to perform two error processes such as shutting off power to the motors 31 and 32 while performing recovery by reset processing, and safety is improved. It has improved.

Furthermore, since the host controller 22 or 23 that has received the error notification can cut off the power from the outside without going through the drive control CPU 212 in which an abnormality has occurred, safety can be improved.
(Embodiment 2)
FIG. 5 shows another example of the internal configuration of the drive control device 21 according to the present invention.

  The difference from the first embodiment is that the host controller 22 or 23 is provided with an error presenting unit 221 or 231 for presenting the route through which the error notification is performed.

  Therefore, it is possible to easily confirm whether the error signal is output from the first abnormality monitoring unit 218 or the second abnormality monitoring unit 213, or both, so that the cause of the abnormality can be identified. Can be fast.

  When the instruction input device 2 (see FIG. 1) is a touch panel monitor, the display of the error presentation unit 221 or 231 may be displayed there.

  The basic configurations of the autonomous mobile device 1 and the robot controller 3 are the same as those in the first embodiment (see FIGS. 1 and 2).

  Note that the autonomous mobile device 1 described in the first and second embodiments refers to not only general robots such as autonomous mobile robots, automatic cleaning robots, and guide robots but also automobiles.

1 is a perspective view of an autonomous mobile device according to the present invention. It is a schematic diagram of the connection of each apparatus centering on the robot controller by this invention. It is a block diagram which shows the internal structure (Embodiment 1) of the drive control apparatus by this invention. It is a flowchart which shows the flow of the electric signal of a drive control apparatus, and the flow of a software process in drive control CPU. It is a block diagram which shows the internal structure (Embodiment 2) of the drive control apparatus by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Autonomous mobile device 2 Instruction input device 3 Robot controller 4 Battery for power supply 5 Laser radar 6 Ultrasonic sensor 21 Drive control device 22 Motion control PC (high-order controller)
23 Human Interface PC (Host Controller)
24 Integrated board 211 Cutoff circuit 212 Drive control CPU
213 Second abnormality monitoring unit 214 Power control unit 215 Motor control output port 216 Communication unit 217 Clock 218 First abnormality monitoring unit 219 Port D-OUT
220 Reset input port 221, 231 Error presentation unit 31, 32 Motor 33, 34 Moving wheel

Claims (7)

A power control unit for controlling power supplied to the drive unit;
A drive control CPU that receives an operation instruction and outputs a control signal to the power control unit in response to the operation instruction;
A drive control device comprising:
The drive control CPU includes a first abnormality monitoring unit that performs error processing when an internal clock signal of the drive control CPU is not detected in a first predetermined period;
A drive control device, further comprising a second abnormality monitoring unit connected to the drive control CPU and performing error processing when a signal is not detected in the first predetermined period, outside the drive control CPU. .   2. The drive control device according to claim 1, wherein the second abnormality monitoring unit performs error processing even when a signal due to software processing leakage or a signal due to electrical noise is detected.   The second abnormality monitoring unit performs error processing even when a signal is detected in a second predetermined period shorter than the first predetermined period with the same initial period as the first predetermined period. Item 3. The drive control device according to Item 1 or 2. The drive control apparatus according to any one of claims 1 to 3,
A host controller for giving an operation instruction to the drive control device;
With
The robot controller according to claim 2, wherein the second abnormality monitoring unit performs error notification to the host controller as error processing.   The upper controller is connected to a cutoff circuit between the power control unit and the drive unit, and outputs a cutoff signal to the cutoff circuit so as to cut off power when receiving an error notification. The robot controller according to claim 4. The drive control CPU performs error notification to the host controller when the first abnormality monitoring unit does not detect the internal clock signal in the first predetermined period,
The host controller is notified of an error from the drive control CPU and an error notification from the second abnormality monitoring unit,
The robot controller according to claim 4, wherein the host controller includes an error presenting unit that presents a route through which the error notification is performed.   An autonomous mobile device comprising the drive control device according to any one of claims 1 to 3 or the robot controller according to any one of claims 4 to 6.

Images