具体实施方式

下面将结合本申请实施例中附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。通常在此处附图中描述和示出的本申请实施例的组件可以以各种不同的配置来布置和设计。因此，以下对在附图中提供的本申请的实施例的详细描述并非旨在限制要求保护的本申请的范围，而是仅仅表示本申请的选定实施例。基于本申请的实施例，本领域技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本申请保护的范围。

应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释。同时，在本申请的描述中，术语“第一”、“第二”等仅用于区分描述，而不能理解为指示或暗示相对重要性。

第一方面，请参照图1，本申请一些实施例提供了一种机器人的多重安全控制方法，机器人能执行的停机操作包括强制停止、减速停止和无损停止；

本申请实施例的机器人的多重安全控制方法包括以下步骤：

S1、基于看门狗计时器对微控制单元的运行情况进行监控，在微控制单元运行异常时，基于看门狗计时器触发控制机器人执行强制停止；

S2、在微控制单元运行正常且出现设备故障时，基于微控制单元软件控制机器人执行强制停止、减速停止或无损停止；

S3、在软件控制响应超时时，硬件控制机器人执行强制停止。

具体地，微控制单元（Microcontroller Unit，MCU）为机器人的执行控制端，其用于控制机器人各个组件配合运行以完成特定生产任务；本申请实施例的机器人的多重安全控制方法旨在根据机器人实际运行时产生的故障从多个层级触发停机操作，确保机器人出现故障时能顺利完成停机操作，以提高设备运行安全性。

更具体地，强制停止、减速停止和无损停止分别属于三种不同的停止操作，其对机器人设备造成的损伤依次递减且安全保障程度依次递减；在本申请实施例中，上述三种停止操作优选为分别对应于《EN60204-1标准》中的三种停止类别进行设计，即强制停止、减速停止和无损停止分别对应于停止类别0、停止类别1及停止类别2进行设计，其中，在《EN60204-1标准》中，停止类别0定义为：通过立即切断供给机器设备的电源来实现停止；停止类别1定义为：受控制的停止，供给机器设备执行机构的电源一直保持，以使机器设备逐渐停止下来；停止类别2为：受控制的停止，供给机器设备驱动装置的电源一直保持；由此可见，强制停止为基于立即断电而执行的停机操作，能最迅速地完成停机，会对机器人造成损伤，减速停止为基于一定时间减速再执行停止及断电的停机操作，能较为迅速地完成停机，对机器人造成的损伤较小，无损停止为基于系统控制进行停止而不断电的停机操作，不损伤机器人。

更具体地，看门狗计时器为本申请实施例的机器人的多重安全控制方法的第一道安全保护层，其用于监控并判断微控制单元是否因故障而失控（运行情况是否正常），该失控情况可以是由于机器人硬件执行错误或微控制单元软件执行错误而引起的、导致微控制单元失去控制的情况，属于系统级错误，该情况下，微控制单元无法正常触发或反馈触发看门狗计时器，作为机器人主控端的微控制单元失去控制可能会引起各类重大事故，故需要立即执行强制停止，避免意外发生。

更具体地，软件控制为本申请实施例的机器人的多重安全控制方法的第二道安全保护层；在看门狗计时器检测到微控制单元运行正常的情况下，微控制单元未失去控制，其能根据机器人实际运行情况分析机器人是否存在各类设备故障，如基于传感器接收各类电信号以综合分析是否存在运行故障（如过热、过压故障），这些设备故障属于运行级错误，在出现设备故障的情况下，微控制单元能软件控制机器人执行停机操作，以避免机器人在出现设备故障时继续运行而发生意外或损坏设备，软件控制可以根据场景需求设定机器人执行的停机操作的类型，也可以根据实际运行情况自适应选择合适的停机操作。

更具体地，硬件控制为本申请实施例的机器人的多重安全控制方法的第三道安全保护层；该硬件控制基于硬控结构实现，如继电器等硬件电路；在实际使用软件控制进行停机时，软件控制可能由于程序执行错误、信号丢失、电压波动或死机等原因导致停机操作无法顺利执行，因此，本申请实施例的机器人的多重安全控制方法设计硬件控制作为软件控制失效时的补救措施，以基于响应时间判断软件控制是否失效，并在软件控制超时失效时，基于硬件控制控制机器人执行安全程度最高的强制停止。

本申请实施例的机器人的多重安全控制方法基于看门狗计时器、软件控制和硬件控制实现对机器人进行三重安全保护，能根据机器人运行过程中不同情况出现的故障执行停机操作，能有效避免安全事故发生并保护使用者。

需要说明的是，步骤S1、步骤S2和步骤S3中的强制停止指同一类别的停止模式（如基于立即断电而执行的停机操作），而不限于基于同类手段来执行。

在一些优选的实施方式中，看门狗计时器基于微控制单元定时触发重置以对微控制单元的运行情况进行监控。

具体地，在该实施方式中，看门狗计时器进行持续计数以监控微控制单元是否出现运行异常，看门狗计时器计数值达到预设值时生成超时信号，该超时信号用于触发控制机器人执行强制停止；微控制单元定时重置看门狗计时器的计数值来避免看门狗计时器生成超时信号；该监控逻辑简单有效，能及时、准确反映出微控制单元是否出现运行异常。

更具体地，看门狗计数器基于计数值进行监控，故无法获知和评估微控制单元出现的故障类型和严重等级，而微控制单元失控属于系统级错误，可能会引起严重事故，故该情况下需要执行安全程度最高的强制停止。

在一些优选的实施方式中，基于微控制单元软件控制机器人执行强制停止、减速停止或无损停止的步骤包括：

S21、获取设备故障的安全级别；

S22、基于微控制单元软件控制机器人执行强制停止、减速停止及无损停止中与安全级别对应的停机操作。

具体地，微控制单元能收集机器人各类运行参数、状态参数来控制机器人完整特定生产任务，也能基于各类运行参数、状态参数来分析机器人是否出现设备故障，故能分析出故障的严重程度以此来确定故障的安全级别。

更具体地，不同类型的故障会可能会引起不同严重程度的生产事故，而不同的停机操作方式也会对机器人造成不同程度的损伤，因此，本申请实施例的机器人的多重安全控制方法需要对设备故障进行区分，以基于设备故障的安全级别选择合适的停机操作方式，在平衡兼顾安全性和机器人损伤程度的前提下选择合适的停机操作。

在一些优选的实施方式中，获取设备故障的安全级别的步骤包括：

S211、基于设备故障的故障类型和/或环境状态获取安全级别。

具体地，设备故障的故障类型不同会引发不同的问题，以决定了机器人会产生不同的故障动作，故本申请实施例的机器人的多重安全控制方法能基于故障类型获取安全级别。

更具体地，环境状态可以是机器人附近的环境参数，也可以机器人附近的人、物分布特性；不同的环境状态会影响存在设备故障的机器人触发不同生产事故的概率，如机器人附近存在多个使用者时，更容易出现危及人身安全的事故，又如机器人周边存在易燃物且空气湿度较低时，更容易出现火灾事故，故本申请实施例的机器人的多重安全控制方法能基于环境状态获取安全级别。

更具体地，安全级别可以基于预设的分级表进行选择，在本申请实施例中，优选为基于故障类型和环境状态从分级别中筛选出对应的级别。

更具体地，环境状态可以基于各类搭载在机器人上的传感器获取相关数据信息进行确定，如基于图像传感器或人体感应开关判断机器人附近是否存在使用者，又如基于温湿度传感器获取温湿度数据等。

在一些优选的实施方式中，安全级别包括分别对应用于触发强制停止、减速停止及无损停止的第一级别、第二级别和第三级别；

第一级别对应于危及使用者安全的设备故障；

第二级别对应于不危及使用者安全且停机不可控的设备故障；

第三级别对应于不危及使用者安全且停机可控的设备故障。

具体地，在出现第一级别的设备故障时，本申请实施例的机器人的多重安全控制方法基于微控制单元软件控制机器人执行强制停止，能迅速停止机器人运行并断电，避免机器人继续运行而危及使用者安全，有效保障使用者的人身安全。

更具体地，停机不可控指机器人不能基于正常运行时的停机流程执行停机的状态；在出现第二级别的设备故障时，本申请实施例的机器人的多重安全控制方法基于微控制单元软件控制机器人执行减速停止，能使机器人进行对内部结构损伤较小的减速停机和断电，对机器人的机械结构产生保护。

更具体地，停机可控指机器人能基于正常运行时的停机流程执行停机的状态；在出现第三级别的设备故障时，本申请实施例的机器人的多重安全控制方法基于微控制单元软件控制机器人执行无损停止，能使机器人基于正常运行时的停机流程进行停机，尽可能避免机器人的内部结构出现损伤。

在一些优选的实施方式中，微控制单元基于引脚发送停止信号以对机器人进行软件控制。

具体地，微控制单元基于发射引脚发送对应的停机操作的停止信号给被控的机器人中的各个设备模块，以使机器人整体或部分设备模块执行相应的停机操作。

更具体地，强制停止、减速停止和无损停止配置有不同的停止信号。

在一些优选的实施方式中，在软件控制响应超时时，硬件控制机器人执行强制停止的步骤包括：

S31、根据与停机操作对应的时间阈值判断软件控制是否出现响应超时，并在响应超时时，硬件控制机器人执行强制停止。

具体地，该实施方式基于时间阈值判断软件控制是否响应超时，能及时、准确触发机器人执行强制停止；其中，由于在软件控制中，不同类型的停机操作完成停机所需的时长不同，故步骤S31优选为基于不同停机操作配置不同的大小的时间阈值来判断软件控制是否出现响应超时，以更及时、准确地触发机器人执行强制停止。

在一些优选的实施方式中，微控制单元的软件控制包括手动控制停止模式和自动控制停止模式，其中，步骤S2的控制方式属于自动控制停止模式；在微控制单元的软件控制切换为手动控制停止模式的情况下，在微控制单元运行正常且出现设备故障时，系统生成故障提示信息以供用户选择合适的停机操作来停止机器人运行。

第二方面，请参照图2，本申请一些实施例还提供了一种机器人的多重安全控制装置，机器人能执行的停机操作包括强制停止、减速停止和无损停止；

本申请实施例的机器人的多重安全控制包括：

第一停止模块201，用于基于看门狗计时器对微控制单元的运行情况进行监控，在微控制单元运行异常时，基于看门狗计时器触发控制机器人执行强制停止；

第二停止模块202，用于在微控制单元运行正常且出现设备故障时，基于微控制单元软件控制机器人执行强制停止、减速停止或无损停止；

第三停止模块203，用于在软件控制响应超时时，硬件控制机器人执行强制停止。

本申请实施例的机器人的多重安全控制装置基于看门狗计时器、软件控制和硬件控制实现对机器人进行三重安全保护，能根据机器人运行过程中不同情况出现的故障执行停机操作，能有效避免安全事故发生并保护使用者。

需要说明的是，该机器人的多重安全控制装置优选为与微控制单元电性连接的上位机。

在一些优选的实施方式中，本申请实施例的机器人的多重安全控制装置用于执行上述第一方面提供的机器人的多重安全控制方法。

第三方面，请参照图3，本申请一些实施例还提供了一种电子设备的结构示意图，本申请提供一种电子设备，包括：处理器301和存储器302，处理器301和存储器302通过通信总线303和/或其他形式的连接机构（未标出）互连并相互通讯，存储器302存储有处理器301可执行的计算机可读取指令，当电子设备运行时，处理器301执行该计算机可读取指令，以执行时执行上述实施例的任一可选的实现方式中的方法。

第四方面，本申请实施例提供一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时，执行上述实施例的任一可选的实现方式中的方法。其中，计算机可读存储介质可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器（Static Random Access Memory, 简称SRAM），电可擦除可编程只读存储器（Electrically Erasable Programmable Read-Only Memory, 简称EEPROM），可擦除可编程只读存储器（Erasable Programmable Read Only Memory, 简称EPROM），可编程只读存储器（Programmable Red-Only Memory, 简称PROM），只读存储器（Read-OnlyMemory, 简称ROM），磁存储器，快闪存储器，磁盘或光盘。

综上，本申请实施例提供了一种机器人的多重安全控制方法、装置、电子设备及存储介质，其中，本申请实施例的机器人的多重安全控制方法基于看门狗计时器、软件控制和硬件控制实现对机器人进行三重安全保护，能根据机器人运行过程中不同情况出现的故障执行停机操作，能有效避免安全事故发生并保护使用者。

在本申请所提供的实施例中，应该理解到，所揭露装置和方法，可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，又例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些通信接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。

另外，作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。

再者，在本申请各个实施例中的各功能模块可以集成在一起形成一个独立的部分，也可以是各个模块单独存在，也可以两个或两个以上模块集成形成一个独立的部分。

在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。

以上所述仅为本申请的实施例而已，并不用于限制本申请的保护范围，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

The specific embodiment

The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application, and it is obvious that the described embodiments are only part of the embodiments of the present application, not all embodiments. The components of the embodiment of the present application, which are normally described and shown in the drawings herein, may be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed application, but merely indicates the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by a person skilled in the art without creative work fall within the scope of protection of the present application.

It should be noted that similar designations and letters indicate similar terms in the drawings below, so that once an item is defined in a drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, the terms "first", "second", etc., are only used to distinguish the description and cannot be construed as indicating or implying relative importance.

First, please refer to Figure 1, some embodiments of the present application provide a plurality of safety control methods of the robot, and the shutdown operation that the robot can perform comprises forced stop, deceleration stop and non-destructive stop;

The multiple safety control methods of the robot in the embodiment of the present application comprise the following steps:

S1. Monitor the operation of the micro-control unit based on the watchdog timer, and when the micro-control unit runs abnormally, the control robot is triggered to perform a forced stop based on the watchdog timer;

S2. When the microcontroller unit is running normally and the equipment fails, the robot is controlled to perform forced stop, deceleration stop or lossless stop based on the microcontrol unit software;

S3. When the software control response times out, the hardware controls the robot to perform a forced stop.

Specifically, the microcontroller unit (MCU) is the execution control end of the robot, which is used for controlling the operation of each component of the robot to cooperate with the operation to complete a specific production task, and the multiple safety control methods of the robot in the embodiment of the present application are designed to trigger the shutdown operation from multiple levels according to the fault generated during the actual operation of the robot, so as to ensure that the shutdown operation can be successfully completed when the robot fails, so as to improve the safety of equipment operation.

More specifically, forced stop, deceleration stop and non-destructive stop belong to three different stop operations, and the damage caused to the robot equipment decreases sequentially and the degree of safety guarantee decreases sequentially; in the embodiment of the present application, the above three stop operations are preferably designed corresponding to the three stop categories in the "EN60204-1 standard" respectively, that is, the forced stop, the deceleration stop and the non-destructive stop are respectively designed corresponding to the stop category 0, the stop category 1 and the stop category 2, wherein, in the EN60204-1 standard》 , stop category 0 is defined as: stop is achieved by immediately cutting off the power supply of machinery and equipment; stop category 1 is defined as: controlled stop, the power supply to the actuator of the machinery and equipment has been maintained, so that the machinery and equipment gradually stop; stop category 2 is: controlled stop, the power supply to the driving device of the machinery and equipment has been maintained; it can be seen that the forced stop is the shutdown operation that is performed based on the immediate power failure, can complete the shutdown most quickly, and will cause damage to the robot, and the deceleration stop is the shutdown operation of stopping and power-off based on a certain period of time deceleration, and the shutdown can be completed relatively quickly, and the damage caused to the robot is small, non-destructive stop is a shutdown operation that stops based on system control and does not damage the robot.

More specifically, the watchdog timer is the first safety protection layer of the multiple safety control method of the robot in the embodiment of the present application, and it is used for monitoring and judging whether the microcontrol unit is out of control due to fault (whether the operation situation is normal), and the out-of-control situation can be caused by the error of robot hardware execution or the software execution error of microcontrol unit, In this case, the microcontrol unit can not trigger normally or feedback to trigger the watchdog timer, and the loss of control of the microcontrol unit as the main control end of the robot may cause various major accidents, so it is necessary to immediately implement a forced stop to avoid accidents.

More specifically, the software control is the second safety protection layer of the multiple safety control method of the robot in the embodiment of the present application; under the condition that the watchdog timer detects that the microcontrol unit is running normally, the microcontrol unit does not lose control, and it can analyze whether the robot has various equipment faults according to the actual operation of the robot, such as receiving various electrical signals based on sensors to comprehensively analyze whether there is an operation fault (such as overheating, In the case of equipment failure, the microcontrol unit can control the robot to perform shutdown operations to avoid accidents or damage to the equipment due to the continued operation of the robot in the event of equipment failure, and the software control can set the type of shutdown operation performed by the robot according to the needs of the scene, and can also adaptively select the appropriate shutdown operation according to the actual operation situation.

More specifically, the hardware control is the third safety protection layer of the multiple safety control method of the robot in the embodiment of the present application; the hardware control is based on the hardware control structure implementation, such as a hardware circuit such as a relay; when the software control is actually used to shut down, the software control may be due to program execution error, signal loss, Reasons such as voltage fluctuation or crash cause the shutdown operation cannot be carried out smoothly, therefore, the multiple safety control method of the robot in the embodiment of the present application is designed with hardware control as a remedial measure when the software control fails, so as to judge whether the software control fails based on the response time, and when the software control fails at a timeout, the robot is controlled to perform the forced stop with the highest degree of safety based on the hardware control.

The multiple safety control method of the robot in the embodiment of the present application is based on the watchdog timer, software control and hardware control to realize triple safety protection for the robot, and can perform shutdown operation according to the faults that occur in different situations during the operation of the robot, and can effectively avoid the occurrence of safety accidents and protect the user.

It should be noted that the forced stop in step S1, step S2 and step S3 refers to the same type of stop mode (such as a shutdown operation performed based on an immediate power failure), and is not limited to being performed based on the same kind of means.

In some preferred embodiments, a watchdog timer is based on the microcontrol unit and timed trigger resets to monitor the operation of the microcontrol unit.

Specifically, in this embodiment, the watchdog timer continuously counts to monitor whether the microcontrol unit has abnormal operation, generates a timeout signal when the counting value of the watchdog timer reaches the preset value, and the timeout signal is used for triggering the control robot to perform a forced stop; the microcontrol unit periodically resets the counting value of the watchdog timer to avoid the watchdog timer from generating a timeout signal; the monitoring logic is simple and effective, and can timely and accurately reflect whether the microcontrol unit has abnormal operation.

More specifically, the watchdog counter is monitored based on the count value, so it is not possible to know and evaluate the type and severity of the fault occurring in the microcontrol unit, and the loss of control of the microcontrol unit is a system-level error that can cause a serious accident, so the most safe forced stop needs to be performed in this case.

In some preferred embodiments, the steps of controlling the robot to perform a forced stop, a deceleration stop or a non-destructive stop based on the microcontrol unit software include:

S21. obtaining the safety level of equipment failure;

S22, based on the micro-control unit software, the robot is controlled to perform the shutdown operation corresponding to the safety level in forced stop, deceleration stop and non-destructive stop.

Specifically, the micro-control unit can collect various operating parameters and state parameters of the robot to control the complete specific production tasks of the robot, and can also analyze whether the robot has equipment failures based on various operating parameters and state parameters, so the severity of the fault can be analyzed to determine the safety level of the fault.

More specifically, different types of faults may cause production accidents of different severity, and different shutdown operation modes can also cause different degrees of damage to the robot, therefore, the multiple safety control methods of the robot in the embodiment of the present application need to distinguish the equipment faults, select the appropriate shutdown operation mode based on the safety level of the equipment failure, and select the appropriate shutdown operation on the premise of balancing the safety and the degree of damage of the robot.

In some preferred embodiments, the steps to obtain the safety level of a device failure include:

S211, obtain a security level based on the fault type and/or environmental state of the device failure.

Specifically, different fault types of equipment faults can cause different problems to determine that the robot will produce different fault actions, so the multiple safety control methods of the robot in the embodiment of the present application can obtain safety levels based on fault types.

More specifically, the environmental state can be the environmental parameters near the robot, and can also be the distribution characteristics of people and things near the robot; different environmental states will affect the probability of different production accidents triggered by the robot with equipment failure, such as when there are multiple users near the robot, it is more likely to have an accident that endangers personal safety, and when there are flammable materials around the robot and the air humidity is low, it is more likely to occur a fire accident, so the multiple safety control methods of the robot in the embodiment of the present application can obtain a safety level based on the environmental state.

More specifically, the security level can be selected based on a preset classification table, and in the embodiment of the present application, it is preferable to filter out the corresponding level from the classification based on the fault type and the environmental state.

More specifically, the environmental state can be determined based on the relevant data information obtained by various sensors mounted on the robot, such as judging whether there is a user near the robot based on the image sensor or human body sensor switch, and obtaining temperature and humidity data based on the temperature and humidity sensor.

In some preferred embodiments, the safety level comprises a first, second, and third level applied to triggering a forced stop, a deceleration stop, and a non-destructive stop, respectively;

The first level corresponds to equipment failures that endanger the safety of the user;

The second level corresponds to equipment failures that do not endanger the safety of the user and the shutdown is uncontrollable;

The third level corresponds to equipment failures that do not endanger the safety of the user and have controllable downtime.

Specifically, when a first-level equipment failure occurs, the multiple safety control method of the robot in the embodiment of the present application is based on the microcontrol unit software to control the robot to perform a forced stop, which can quickly stop the operation of the robot and cut off power, avoid the robot from continuing to run and endanger the user's safety, and effectively protect the user's personal safety.

More specifically, uncontrollable shutdown refers to the state that the robot cannot perform shutdown based on the shutdown process during normal operation; when a second-level equipment failure occurs, the multiple safety control method of the robot in the embodiment of the present application controls the robot to perform deceleration and stop based on the microcontrol unit software, so that the robot can carry out deceleration shutdown and power outage with less damage to the internal structure, and the mechanical structure of the robot is protected.

More specifically, the shutdown controllable refers to the state that the robot can perform the shutdown based on the shutdown process during normal operation; when a third-level equipment failure occurs, the multiple safety control methods of the robot in the embodiment of the present application control robot are based on the microcontrol unit software to control the robot to perform non-destructive stopping, so that the robot can be shut down based on the shutdown process during normal operation, and the internal structure of the robot is avoided as much as possible.

In some preferred embodiments, the microcontrol unit sends a stop signal based on the pin for software control of the robot.

Specifically, the microcontrol unit sends the stop signal of the corresponding shutdown operation to each equipment module in the controlled robot based on the transmitting pin, so that the robot can perform the corresponding shutdown operation in whole or part of the equipment module.

More specifically, forced-stop, deceleration-stop, and lossless stop configurations have different stop signals.

In some preferred embodiments, the steps for the hardware-controlled robot to perform a forced stop when the software control response times out include:

S31. Judge whether the software control has a response timeout according to the time threshold corresponding to the shutdown operation, and when the response times out, the hardware controls the robot to perform a forced stop.

Specifically, the embodiment method judges whether the software control responds to a timeout based on a time threshold, and can trigger the robot to perform a forced stop in a timely and accurate manner; wherein, because in the software control, different types of shutdown operations require different durations to complete the shutdown, the step S31 preferably judges whether the software control has a response timeout based on the time thresholds of different sizes configured for different shutdown operations, so as to trigger the robot to perform a forced stop in a more timely and accurate manner.

In some preferred embodiments, the software control of the microcontrol unit comprises a manual control stop mode and an automatic control stop mode, wherein the control mode of step S2 belongs to the automatic control stop mode; under the condition that the software control of the micro control unit is switched to the manual control stop mode, when the micro control unit runs normally and equipment failure occurs, the system generates fault prompt information for the user to select a suitable shutdown operation to stop the robot operation.

Second, please refer to Figure 2, some embodiments of the present application also provide a plurality of safety control devices of a robot, and the shutdown operation that the robot can perform comprises a forced stop, a deceleration stop and a non-destructive stop;

The multiple safety controls of the robot in the embodiment of the present application comprise:

the first stop module 201 is used for monitoring the operation of the microcontroller based on the watchdog timer, and when the microcontroller runs abnormally, the control robot is triggered to perform a forced stop based on the watchdog timer;

the second stop module 202 is used for controlling the robot to perform forced stop, deceleration stop or lossless stop based on the microcontrol unit software when the microcontrol unit is running normally and equipment failure occurs;

the third stop module 203 is used for hardware control robot to perform a forced stop when the software control response times out.

The multiple safety control device of the robot in the embodiment of the present application realizes triple safety protection to the robot based on the watchdog timer, software control and hardware control, and can perform shutdown operation according to the faults that occur in different situations in the operation process of the robot, and can effectively avoid the occurrence of safety accidents and protect the user.

It should be noted that the multiple safety control device of the robot is preferably the upper computer that is electrically connected with the microcontrol unit.

In some preferred embodiments, the plurality of safety control devices of the robot in the embodiment of the present application are used for performing the plurality of safety control methods of the robot provided in the first aspemblication.

Thirdly, please refer to Figure 3, some embodiments of the present application also provide a schematic diagram of the structure of an electronic device, the present application provides an electronic device, comprising: a processor 301 and a memory 302, a processor 301 and a memory 302 through a communication bus 303 and/ or other forms of connecting mechanisms (not indicated) are interconnected and communicate with each other, the memory 302 stores executable computer-readable instructions of the processor 301, and when the electronic device is running, the processor 301 executes the computer-readable instructions to execute the method in any of the optional embodiments of the above embodiment when executed.

Fourth, the embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, executes a method in any of the optional embodiments of the above embodiment. Among them, computer-readable storage media can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory, EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic memory, flash memory, disk or optical disc.

In summary, the embodiment of the present application provides a plurality of safety control methods, devices, electronic equipment and storage medium of the robot, wherein the multiple safety control method of the robot of the embodiment of the present application realizes triple safety protection to the robot based on the watchdog timer, software control and hardware control, can perform shutdown operation according to the faults that occur in different situations in the operation process of the robot, can effectively avoid the occurrence of safety accidents and protect the user.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be realized by other means. The device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be another division mode when the actual implementation is realized, and for example, a plurality of units or components can be combined or can be integrated into another system, or some features can be ignored, or not executed. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be indirect coupling or communication connection through some communication interface, device or unit, which may be in electrical, mechanical or other form.

In addition, the cells described as detached parts may or may not be physically separated, and the parts shown as units may or may not be physical units, i.e., they may be located in one place, or they can be distributed across multiple network units. Some or all of these units can be selected according to actual needs to realize the purpose of the present embodiment.

Furthermore, each functional module in each embodiment of the present application may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

For the purposes of this article, relational terms such as first and second, etc., are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or sequence between those entities or operations.

The foregoing is only an embodiment of the present application and is not intended to limit the scope of protection of the present application, which is subject to various changes and variations for those skilled in the art. Any amendments, equivalent replacements, improvements, etc., made within the spirit and principles of this application shall be included in the scope of protection of this application.