WO2021192586A1 - Control device, control method, and node system - Google Patents

Abstract

Provided is a control device for, in a system including a plurality of nodes that work together, mutually monitoring the state of each node and controlling the operation of its own node.　A control device that controls one node in a system including a plurality of nodes comprises: a holding unit which holds the state of its own node; an input unit which inputs the state of another node; and a determination unit which determines the state of the own node, on the basis of the state of the own node held in the holding unit and the state of the other node input from the input unit. The input unit invalidates the input of the state of the other node for a predetermined dead time period after a state release signal is input.

Description

Control devices and control methods, as well as node systems

The technology disclosed in the present specification (hereinafter referred to as "the present disclosure") relates to a control device and a control method for controlling each node in a system composed of a plurality of interlocking nodes, and a node system.

In the medical field, a master-slave type surgery support system is being introduced. Master-slave remote control systems are becoming widespread in various other industrial fields as well. A master-slave system is basically composed of a combination of a master-side device and a slave-side device. The master side device and the slave side device are interconnected via, for example, a wired or wireless communication medium, and the instruction input by the operator to the master side device is transferred via the communication medium, and the slave side device receives the instruction. The drive of the robot, manipulator, etc. is controlled according to the instructions given. In addition, the image of the camera that captures the operation of the robot or manipulator on the slave side is transferred via the communication medium, and the received image is displayed on the display on the master side device. Therefore, the operator can input the following instruction to the master side device while checking the image captured by the camera.

In a master-slave system, for example, bilateral feedback control is adopted between the master-side device and the slave-side device in order to match the input by the operator with the position of the robot or manipulator and the state of force. (See Patent Document 1).

The master-side device and the slave-side device in the master-slave system are independent devices, but they operate in cooperation with each other. For example, a control system that synchronizes a master-side device and a slave-side device by adopting a PLL (Phase Locked Loop) method has been proposed (see Patent Document 2).

Also, if either the master side device or the slave side device makes an emergency stop, it is necessary to compensate for the other stop. For example, a robot system has been proposed in which safety circuits are provided in each of the master-side device and the slave-side device to mutually monitor the master-side device and the slave-side device (see Patent Document 3).

Japanese Unexamined Patent Publication No. 2019-13602 Japanese Unexamined Patent Publication No. 2006-244264 JP-A-2017-100212

An object of the present disclosure is to provide a control device and a control method for mutually monitoring the state of each node and controlling the operation of the own node in a system composed of a plurality of interlocking nodes, and a node system.

The first aspect of the present disclosure is a control device that controls one node in a system consisting of a plurality of nodes.
A holding unit that holds the state of its own node,
Input section for inputting the status of other nodes,
A determination unit that determines the state of the own node based on the state of the own node held in the holding unit and the state of another node input from the input unit.
It is a control device provided with.

The holding unit holds the state of its own node until a state release signal is input. Further, the input unit invalidates the input of the state of the other node for a predetermined dead time period after the state release signal is input. The dead time is set based on the transmission delay between the nodes in the system.

The control device according to the first aspect further includes an integrated determination unit that integrates and determines a plurality of types of states in the own node and the states determined by the determination unit. The own node includes a plurality of drive units, and controls the output of control signals to each drive unit based on the determination result of the integrated determination unit.

The second aspect of the present disclosure is a control method for controlling one node in a system composed of a plurality of nodes.
A retention step that retains the state of its own node,
Input steps to enter the status of other nodes,
A determination step for determining the state of the own node based on the state of the own node held in the holding step and the state of another node input in the input step, and
It is a control method having.

In addition, the third aspect of the present disclosure is
Consists of multiple nodes, at least some of them
Based on the holding unit that holds the state of the own node, the input unit that inputs the state of the other node, the state of the own node held in the holding unit, and the state of the other node input from the input unit. Equipped with a monitoring device equipped with a judgment unit that determines the status of the own node,
It is a node system.

However, the "system" here means a logical assembly of a plurality of devices (or functional modules that realize a specific function), and each device or functional module is in a single housing. It does not matter whether or not it is.

According to the present disclosure, in a system consisting of a plurality of interlocking nodes, a control device that mutually monitors the state of each node and controls the operation of the own node by interlocking with the state of another node at high speed and with low delay. A control method as well as a node system can be provided.

It should be noted that the effects described in the present specification are merely examples, and the effects brought about by the present disclosure are not limited thereto. In addition to the above effects, the present disclosure may have additional effects.

Still other objectives, features and advantages of the present disclosure will be clarified by more detailed description based on embodiments and accompanying drawings described below.

FIG. 1 is a diagram showing a configuration example of the appearance of the surgery support system 1. FIG. 2 is a diagram illustrating the configuration of the appearance of the surgery support system 1. FIG. 3 is a diagram showing a configuration example of the mutual monitoring system 300. FIG. 4 is a diagram showing the network topology of the surgery support system 1 shown in FIG. FIG. 5 is a diagram showing a configuration example of the mutual monitoring system 500. FIG. 6 is a diagram showing a configuration example of the condition monitoring device 600. FIG. 7 is a flowchart showing a safe operation flow in the node equipped with the condition monitoring device 600 shown in FIG. FIG. 8 is a diagram showing a modified example of the network topology of the dual arm surgery support system. FIG. 9 is a diagram showing still another configuration example of the network topology of the surgery support system. FIG. 10 is a diagram showing still another configuration example of the network topology of the surgery support system. FIG. 11 is a diagram showing a state in which a delay measurement pulse output from one node returns back and forth between the nodes in the mutual monitoring system. FIG. 12 is a diagram showing a timing chart for transmitting and receiving delay measurement pulses in a mutual monitoring system. FIG. 13 is a diagram showing a network topology of a dual arm surgery support system. FIG. 14 is a diagram showing an operation mode and communication conditions of the surgery support system shown in FIG. FIG. 15 is a diagram showing a circuit configuration common to the safety torque off determination unit 621, the brake release determination unit 623, and the laser output on determination unit 625.

Hereinafter, the technology according to the present disclosure will be described in the following order with reference to the drawings.

A. System configuration B. Mutual monitoring system C.I. Mutual monitoring system built into a multi-node system D. Detailed configuration of the condition monitoring device E. Safe operation flow
F. Modification example of node system G. Dead time setting H. Operation mode and communication conditions I. effect

A. System Configuration FIG. 1 shows a configuration example of the appearance of the surgery support system 1 as an example of the master-slave system. The illustrated surgery support system 1 is a dual-arm master-slave system. The patient 12 is laid on his back on the operating table 11. A right-hand slave device 13 is installed on the right side of the operating table 11, and a left-hand slave device 14 is installed on the left side of the operating table 11. A treatment tool including forceps, a pneumoperitoneum tube, an energy treatment tool, tweezers, a retractor, or the like is attached to the tips of the right-hand slave device 13 and the left-hand slave device 14, respectively.

Further, on the right side and the left side of the operation table 15 located away from the operating table 1, the right hand master device 16 for remotely controlling the right hand slave device 13 and the left hand slave device 14 for remote control are used. The left-hand master device 17 is arranged respectively. An operation unit 18 held by the operator with the right hand is attached to the tip of the right-hand master device 16, and an operation unit 19 held by the operator with the left hand is attached to the tip of the left-hand master device 17.

Further, above the operating table 11, a camera unit 20 to which a camera for capturing the state of the affected area of the patient is attached to the tip is installed. The camera may be a stereo camera, and the camera unit 20 may capture a 3D image. The camera unit 20 may be operated by an operation unit operated by the operator to perform at least one of camera operations such as shooting angle, distance, and focus adjustment (in this case, the operation target by the right-hand or left-hand master device). , It is necessary to switch from the corresponding slave device to the camera unit), and the camera unit 20 may operate autonomously. On the other hand, a monitor 21 is installed in the vicinity of the operation table 15. An image of the affected area taken by the camera unit 20 is projected on the monitor 21. When the camera unit 20 shoots with a stereo camera, a 3D image is displayed on the monitor 21.

The operator (operator) operates the right-hand master device 16 with the right hand and the left hand while observing the state of the treatment tool and the affected area at the tips of the right-hand slave device 13 and the left-hand slave device 14 displayed on the monitor 21. Operate the left-hand master device 17 with. The right-hand slave device 13 and the left-hand slave device 14 move in synchronization with the movements of the right-hand master device 16 and the left-hand master device 17, respectively. In this way, the operator (operator) operates the right-hand master device 16 and the left-hand master device 17 with respect to the patient 12 on the operating table 11 with respect to the right-hand slave device 13 and the left-hand slave device. Remote surgery can be performed using 14.

FIG. 2 schematically shows an example of the functional configuration of the surgery support system 1. The surgery support system 1 is a dual-arm master-slave system, but it is assumed that bilateral feedback control is applied.

On the slave side, a camera unit 20 to which a camera (stereo camera) for capturing the state of the affected area of the patient is attached to the tip is installed above the operating table 11. The camera may be, for example, a microscope, an endoscope, or an endoscope. The CCU (Camera Control Unit) 123 processes the image captured by the camera and transfers it to the master side. On the master side, a monitor 21 is installed near the operation table 15. The monitor 21 displays an image of the affected area taken by the camera unit 20. When the camera unit 20 shoots with a stereo camera, the monitor 21 displays a 3D image.

The operator (operator) operates the right-hand master device 16 with the right hand and the left hand while observing the state of the treatment tool and the affected area at the tips of the right-hand slave device 13 and the left-hand slave device 14 displayed on the monitor 21. Operate the left-hand master device 17 with.

The right-hand master control device 111 and the control PC (Personal Computer) 113 generate a control signal of the right-hand slave device 13 according to the amount of operation of the right-hand master device 16 by the operator, and generate the control signal of the right-hand slave device 13 to the right-hand slave control device 121. Forward. Further, the left-hand master control device 112 and the control PC 113 generate a control signal of the left-hand slave device 14 according to the amount of operation of the left-hand master device 17 by the operator, and transfer the control signal to the left-hand slave control device 122.

It is assumed that the transfer of the video signal from the CCU 123 to the monitor 21 and the transfer of the control signal from the master control devices 111 and 112 to the slave control devices 121 and 122 are synchronized.

The control PC 113 passes through each of the right-hand master control device 111, the left-hand master control device 112, the right-hand slave control device 121, and the left-hand slave control device 122, and then the right-hand master device 16, the left-hand master device 17, and the right-hand master device 17. The motion control calculation of the slave device 13 for the left hand and the slave device 14 for the left hand is performed. Specifically, the control PC 113 reads the detection values of the encoders and force sensors mounted on the master device and the slave device, calculates the current command value of the motor, and performs calculations for controlling the electromagnetic brake of the motor. conduct.

The right-hand slave control device 121 controls the drive of the right-hand slave device 13 based on the control signal received from the right-hand master control device 111. Further, the left-hand slave control device 122 controls the drive of the left-hand slave device 14 based on the control signal received from the left-hand master control device 112.

Therefore, the right-hand slave device 13 and the left-hand slave device 14 move in synchronization with the movements of the right-hand master device 16 and the left-hand master device 17, respectively. In this way, the operator (operator) operates the right-hand master device 16 and the left-hand master device 17 with respect to the patient 12 on the operating table 11 with respect to the right-hand slave device 13 and the left-hand slave device. Remote surgery can be performed using 14.

The master and slave are usually placed at a distance of about 10 m. However, the master and the slave may be separated by more than that (for example, several tens of km). An optical fiber cable 130 is used for the connection between the master and the slave. However, another communication medium such as a coaxial cable or an Ethernet (registered trademark) cable may be used to connect the master and the slave.

The surgery support system 1 is basically a synchronous system in which each part operates in synchronization, except for safety monitoring. The control PC 113 supplies control signals to each part in the surgery support system 1. Then, the control software of each of the right-hand master control device 111, the left-hand master control device 112, the right-hand slave control device 121, and the left-hand slave control device 122 operates synchronously based on the control signal from the control PC 113. do.

B. Mutual monitoring system In the configuration of the surgery support system 1 shown in FIGS. 1 and 2, the master devices 16 and 17 and the slave devices 13 and 14 cooperate with each other, but are basically independent devices. , It is assumed that an emergency stop switch (not shown in FIGS. 1 and 2) is individually installed in each of them. When the operator (operator) who operates the master devices 16 and 17 notices that one of the master devices 16 and 17 has a failure or a malfunction, he presses the emergency stop switch of the device to stop the device. The other master device and slave devices 13 and 14 also need to respond to this at high speed and stop with a low delay. Further, when a surgical assistant or the like who assists the operation near the operating table 1 notices that one of the slave devices 13 and 14 has a failure or a malfunction, he / she presses the emergency stop switch of the device to stop the operation. The other slave device and master devices 16 and 17 also need to respond to this at high speed and stop with low delay.

The surgery support system 1 is basically a synchronized system, and is a master (right-hand master control device 111 and left-hand master control device 112) and a slave (right-hand slave control device 121 and left-hand slave control device 122). ), The camera (CCU123), and the control PC 113 are synchronized at the clock level by an external synchronization circuit.

On the other hand, for example, when the emergency stop switch is pressed on either the master or the slave, it is necessary for the other to respond at high speed and stop in conjunction with a low delay. For example, when attempting to perform safety monitoring of both the master and slave in a synchronous manner using a communication protocol such as Ethercat or Mechatrolink, it is detected that the emergency stop switch is pressed in a control cycle of 1 kHz, and the master and slave Both can be stopped, but it is hard to say that it is high speed and low delay. Therefore, the surgery support system 1 according to the present disclosure is configured by an asynchronous circuit that does not use a communication protocol for safety monitoring for the purpose of performing mutual monitoring between a master and a slave at high speed.

In the configuration of the surgery support system 1 shown in FIG. 2, the right-hand master control device 111, the left-hand master control device 112, the control PC 113, the right-hand slave control device 121, the left-hand slave control device 122, and the CCU 123 are individually configured. It is assumed that an emergency stop switch will be installed. Then, when the emergency stop switch of any one of these devices is pressed, all the other devices are also stopped asynchronously at high speed and with low delay.

FIG. 3 shows a configuration example of the mutual monitoring system 300 applied to the surgery support system 1. In the actual surgery support system 1, between the right-hand master control device 111 and the right-hand slave control device 121, between the right-hand master control device 111 and the left-hand slave control device 122, and between the right-hand master control device 111 and the left-hand master control device. It is assumed that the mutual monitoring system 300 is incorporated into a combination of a plurality of devices for which emergency stop operations should be linked at high speed and with low delay, such as between 112. However, in FIG. 3, for convenience of explanation, it is simplified and drawn as a configuration example of the mutual monitoring system 300 in the case where one master side safety monitoring device 310 and one slave side safety monitoring device 320 are combined. The master side safety monitoring device 310 is, for example, either the right hand master control device 111 or the left hand master control device 112, and the slave side safety monitoring device 320 is, for example, the right hand slave control device 121 or the left hand slave control device 122. Is one of. Although not shown in FIGS. 2 and 3 for simplification, when the optical fiber cable 130 is used as the transmission medium, in the actual circuit configuration, for example, the transmitting side performs PS conversion for parallel serial conversion of the transmission data. It is equipped with an EO (Electrical / Optical) converter that converts an electric signal into an optical signal, and an OE (Optical / Electrical) converter that converts an optical signal into an electric signal on the receiving side and SP conversion that converts received data in serial parallel. It may be equipped with a vessel.

First, the configuration of the master side safety monitoring device 310 will be described. In the master side safety monitoring device 310, when the stop switch (for example, emergency stop switch) is pressed, the stop signal (for example, emergency stop signal) 311 is input to the master state determination unit 313 via the latch (LAT) 312. NS.

Once the emergency stop switch is pressed, the state in which the emergency stop switch is pressed remains held by the latch 312 even if the emergency stop switch is released. The latch 312 releases the emergency stop state of the emergency stop switch by the latch release signal 314. Therefore, the emergency stop signal 311 continues to be input to the master state determination unit 313 until the emergency stop switch is pressed once and the latch release signal 314 is input. It is assumed that the latch release signal 314 is output from, for example, the higher-level software of the master-side safety monitoring device 310. The higher-level software monitors the state of each part in the master in the return sequence of the master-side safety monitoring device 310, and determines whether or not it is possible to recover from the emergency stop. A sensor for monitoring the state of each part may be arranged in the master. Alternatively, the higher-level software may determine whether or not it is possible to recover from an emergency stop based on an instruction input from the outside such as an operator. The higher-level software outputs a latch release signal 314 when it is determined that the emergency stop state may be restored. The master-side safety monitoring device 310 operates asynchronously with the slave-side safety monitoring device 320, but the higher-level software that controls the return sequence is synchronized with the slave-side higher-level software based on the control signal from the control PC 113. Works like this.

Further, the status signal 327 (described later) of the slave side safety monitoring device 320 is propagated via the optical fiber cable 130 and input to the master side safety monitoring device 310. The status signal 327 of the slave-side safety monitoring device 320 is propagated via the optical fiber cable 130. The laser beam signal emitted from one of the optical modules of the master-side safety monitoring device 310 and the slave-side safety monitoring device 320 passes through the optical fiber cable 130 and is received and processed by the other, thereby monitoring the master-side safety. Communication between the device 310 and the slave-side safety monitoring device 320 is realized. If unnecessary laser light is irradiated from the device in the open state where the optical fiber cable 130 is disconnected, there is a risk of an accident due to exposure.

The wiring length of the optical fiber cable 130 is substantially equal to the distance between the master side safety monitoring device 310 and the slave side safety monitoring device 320, for example, about 10 m. Therefore, there is a transmission delay of about 1 to 10 microseconds before the status signal 327 of the slave-side safety monitoring device 320 propagates to the master-side safety monitoring device 310. This transmission delay includes a delay time in PS-SP conversion and EO-OE conversion during data transmission / reception via the optical fiber cable 130.

The master state determination unit 313 is composed of an AND (logical product) gate, and takes a logical product of the emergency stop signal 311 and the state signal 327 of the slave side safety monitoring device 320 to obtain a negated state in which the master itself has made an emergency stop. A status signal 317 indicating which of the asserted states in which the emergency stop has been released is output to the controlled device in the master safety monitoring device 310. The master state determination unit 313 receives a negated state signal 317 when an emergency stop signal 311 is input or when a state signal indicating a negated state (for example, an emergency stop state) is input from the slave side safety monitoring device 320. Is output. Then, the control target device (for example, the right-hand master device 16 and the left-hand master device 17) in the master stops the operation in the negate state and starts or restarts the operation in the assert state. Further, since the status signal 317 output from the master status determination unit 313 is also transmitted to the slave side, the slave side safety monitoring device 320 can make the slave emergency stop in conjunction with the emergency stop on the master side. ..

However, the status signal 327 transmitted from the slave-side safety monitoring device 320 is input to the master status determination unit 313 via the switch 315. Further, the dead time (DET) detection unit 316 detects that a predetermined dead time elapses after the latch release signal 314 is input when the master returns from the emergency stop. The switch 315 switches from off to on based on the result of the dead time detection unit 316 detecting that the dead time has elapsed since the latch was released. Therefore, the switch 315 is in the off state from the release of the latch until the dead time elapses, and the master state determination unit 313 ignores the state signal 327 of the slave side safety monitoring device 320 until the dead time elapses. Disable.

Here, the dead time is a time during which the master status determination unit 313 does not perform status determination on the master side when returning from an emergency stop. In other words, it means a time during which the master-side safety monitoring device 310 does not perform safety monitoring and becomes a dead zone. By the time the status signal 327 of the slave-side safety monitoring device 320 reaches the master-side safety monitoring device 310, a transmission delay corresponding to the wiring length of the optical fiber cable 130 occurs. This transmission delay includes a delay time in PS-SP conversion and EO-OE conversion during data transmission / reception via the optical fiber cable 130. For example, if the wiring length of the optical fiber cable 130 is 10 m, there is a transmission delay of about 1 to 10 microseconds. That is, there is a transmission delay before the slave side safety monitoring device 320 notifies the master side safety monitoring device 310 that the slave side has returned from the emergency stop.

A dead time (DET) consisting of a minimum time linked to the transmission delay time (or the wiring length of the optical fiber cable 130) is set in the dead time detection unit 316, and the dead time is set after the latch is released in the master. Until the time elapses, the switch 315 is turned off to provide a dead zone for the status signal 327 of the slave-side safety monitoring device 320. As a result, it is possible to avoid the situation where only the master side recovers from the emergency stop, and the master and the slave can work together to recover from the emergency stop. The switch 315 and the dead time detection unit 316 form a return circuit 318 (a region filled in gray in FIG. 3) that provides a dead time when the master returns from an emergency stop. The return circuit 318 includes a storage element such as a register for setting a dead time, a delay circuit for invalidating an input by the dead time, and the like.

Next, the operation of the master side safety monitoring device 310 will be described. Once the emergency stop switch is pressed, the latch 312 holds the state in which the emergency stop switch is pressed. Then, the master state determination unit 313 takes the logical product of the emergency stop signal 311 and the state signal 327 from the slave side safety monitoring device 320, and sets the state signal 317 as the state signal 317, and the master itself is in the negate state in which the emergency stop is performed. Outputs a negate signal indicating.

Further, when the state signal 327 of the slave side safety monitoring device 320 changes from the assert state to the negate state, the master state determination unit 313 logically ANDs the emergency stop signal 311 with the state signal 327 from the slave side safety monitoring device 320. As a state signal 317, a negate signal indicating that the master itself is in an emergency stopped negate state is output.

The control target device in the master (for example, the right-hand master device 16 and the left-hand master device 17) stops the operation in response to the determination result of the negate state by the master state determination unit 313. Further, the negated state signal 317 output from the master state determination unit 313 is also transmitted to the slave side.

Once the emergency stop switch is pressed on the master side, the state in which the emergency stop switch is pressed remains held by the latch 312 even if the emergency stop switch is released. The higher-level software running in the master determines whether it is okay to return from the emergency stop state to the normal operating state. Then, when the host software determines that the master can recover from the emergency stop, it outputs a latch release signal 314 to release the emergency stop state held by the latch 312. As a result, the emergency stop signal 311 indicating the release of the emergency stop is input to the master state determination unit 313.

The dead time (DET) detection unit 316 detects that a predetermined dead time has elapsed since the latch release signal 314 was input. The dead time is set to a minimum value linked to the transmission delay time (or the wiring length of the optical fiber cable 130) (described above). The switch 315 is in the off state from the release of the latch until the dead time elapses, and the master state determination unit 313 ignores the state signal 327 of the slave side safety monitoring device 320 until the dead time elapses. That is, the switch 315 is turned off until the dead time elapses after the latch 312 is released in the master, and a dead zone for the status signal 327 of the slave side safety monitoring device 320 is provided.

After that, the switch 315 switches from off to on based on the result that the dead time detection unit 316 detects that the dead time has elapsed since the latch was released. At this point, when the state signal 327 in the assert state is input from the slave side safety monitoring device 320 to the master state determination unit 313, the master state determination unit 313 takes the logical product of the inputs and states the assert state. The signal 317 is output. As a result, the controlled target device (for example, the right-hand master device 16 and the left-hand master device 17) in the master starts or restarts the operation. As a result, it is possible to avoid the situation where only the master side recovers from the emergency stop, and the master and the slave can work together to recover from the emergency stop. Further, the assert state state signal 317 output from the master state determination unit 313 is also transmitted to the slave side.

Next, the configuration of the slave-side safety monitoring device 320 will be described. The configuration of the slave-side safety monitoring device 320 is almost the same as that of the master-side safety monitoring device 310. When the emergency stop switch is pressed, the emergency stop signal 321 is input to the slave state determination unit 323 via the latch (LAT) 322. Once the emergency stop switch is pressed, the latch 322 holds the emergency stop state until the latch release signal 324 is input from the host software. In the return sequence of the slave-side safety monitoring device 320, the higher-level software monitors the state of each part in the slave and determines whether or not it is possible to recover from the emergency stop. A sensor for monitoring the state of each part may be arranged in the master. Alternatively, the higher-level software may determine whether or not it is possible to recover from an emergency stop based on an instruction input from the outside such as an operator. The higher-level software outputs a latch release signal 324 when it is determined that the emergency stop state may be restored. The slave-side safety monitoring device 320 operates asynchronously with the master-side safety monitoring device 310, but the higher-level software that controls the return sequence is synchronized with the higher-level software on the master side based on the control signal from the control PC 113. Works like this.

Further, the status signal 317 (described above) of the master side safety monitoring device 310 is propagated via the optical fiber cable 130 and input to the slave side safety monitoring device 320. The wiring length of the optical fiber cable 130 is, for example, about 10 m, and there is a transmission delay of about 1 to 10 microseconds until the status signal 317 of the master side safety monitoring device 310 propagates to the slave side safety monitoring device 320. be. This transmission delay includes a delay time in PS-SP conversion and EO-OE conversion during data transmission / reception via the optical fiber cable 130.

The slave state determination unit 323 is composed of an AND (logical product) gate, and takes a logical product of the emergency stop signal 321 and the state signal 317 of the master side safety monitoring device 310 to obtain a negated state in which the slave itself has stopped in an emergency. A status signal 327 indicating which of the asserted states in which the emergency stop has been released is output to the controlled device in the slave-side safety monitoring device 320. The slave state determination unit 323 receives a negated state signal 327 when an emergency stop signal 321 is input or when a state signal indicating a negated state (for example, an emergency stop state) is input from the master side safety monitoring device 310. Is output. Then, the control target device (for example, the right-hand slave device 13 and the left-hand slave device 14) in the slave stops the operation in the negate state and starts or restarts the operation in the assert state. Further, since the state signal 327 output from the slave state determination unit 323 is also transmitted to the master side, the slave side safety monitoring device 320 can make the master stop in an emergency in conjunction with the emergency stop on the slave side. ..

However, the status signal 317 transmitted from the master side safety monitoring device 310 is input to the slave status determination unit 323 via the switch 325. Further, the dead time (DET) detection unit 326 detects that a predetermined dead time elapses after the latch release signal 324 is input when the slave returns from the emergency stop. The switch 325 switches from off to on based on the result of the dead time detection unit 326 detecting that the dead time has elapsed since the latch was released. Therefore, the switch 325 is in the off state from the release of the latch until the dead time elapses, and the slave state determination unit 323 ignores the state signal 317 of the master side safety monitoring device 310 until the dead time elapses. .. The dead time means a time during which the slave-side safety monitoring device 320 does not perform safety monitoring and becomes a dead zone, and a value linked to the transmission delay between the master and the slave is set (same as above). The switch 325 and the dead time detection unit 326 constitute a return circuit 328 (a region filled in gray in FIG. 3) that provides a dead time when the slave returns from an emergency stop. The return circuit 328 includes a storage element such as a register for setting a dead time, a delay circuit for invalidating an input by the dead time, and the like.

Next, the operation of the slave side safety monitoring device 320 will be described. Once the emergency stop switch is pressed, the latch 322 holds the state in which the emergency stop switch is pressed. Then, the slave state determination unit 323 takes the logical product of the emergency stop signal 321 and the state signal 317 from the master side safety monitoring device 310, and sets the state signal 327 as a negate state in which the slave itself has stopped in an emergency. Outputs a negate signal indicating.

Further, when the state signal 317 of the master side safety monitoring device 310 changes from the assert state to the negate state, the slave state determination unit 323 logically ANDs the emergency stop signal 321 with the state signal 317 from the master side safety monitoring device 310. As a state signal 327, a negate signal indicating that the slave itself is in an emergency stopped negate state is output.

The control target device in the slave (for example, the right-hand slave device 13 and the left-hand slave device 14) stops the operation in response to the determination result of the negate state by the slave state determination unit 323. Further, the negated state signal 327 output from the slave state determination unit 323 is also transmitted to the master side.

Once the emergency stop switch is pressed on the slave side, the state in which the emergency stop switch is pressed remains held in the latch 322 even if the emergency stop switch is released. The host software running in the slave determines whether it is okay to return from the emergency stop state to the normal operating state. Then, when the host software determines that the master can recover from the emergency stop, it outputs a latch release signal 324 to release the emergency stop state held by the latch 322. As a result, the emergency stop signal 321 indicating the release of the emergency stop is input to the slave state determination unit 323.

The dead time (DET) detection unit 326 detects that a predetermined dead time has elapsed since the latch release signal 324 was input. The dead time is set to a minimum value linked to the transmission delay time (or the wiring length of the optical fiber cable 130) (described above). The switch 325 is in the off state from the release of the latch until the dead time elapses, and the slave state determination unit 323 ignores the state signal 317 of the master side safety monitoring device 310 until the dead time elapses. That is, the switch 325 is turned off until the dead time elapses after the latch 322 is released in the slave, and a dead zone for the status signal 317 of the master side safety monitoring device 310 is provided.

After that, the switch 325 switches from off to on based on the result that the dead time detection unit 326 detects that the dead time has elapsed since the latch was released. At this point, when the assert state state signal 317 is input from the master side safety monitoring device 310 to the slave state determination unit 323, the slave state determination unit 323 takes the logical product of the inputs and states the assert state. The signal 327 is output. As a result, the controlled target device (for example, the right-handed slave device 13 and the left-handed slave device 14) in the slave starts or restarts the operation. As a result, it is possible to avoid the situation where only the slave side recovers from the emergency stop, and the master and the slave can work together to recover from the emergency stop. Further, the assert state state signal 337 output from the slave state determination unit 323 is also transmitted to the master side.

Therefore, according to the mutual monitoring system 300 as shown in FIG. 3, the master and the slave can each be asynchronously and at high speed in an emergency stop, and when one of the master and the slave is in an emergency stop, the other Can also be asynchronously linked at high speed to make an emergency stop. Further, when the master and the slave recover from the emergency stop, a dead time of a value linked to the transmission delay between the master and the slave is provided so that the states of each other can be confirmed. As a result, it is possible to avoid a situation in which one of the master and the slave returns first and the other returns later, and both can return in tandem.

The master side safety monitoring device 310 and the slave side safety monitoring device 320 may basically have the same configuration. The master-side safety monitoring device 310 and the slave-side safety monitoring device 320 can each be configured by any one of an FPGA (Field Programmable Gate Array), a gate IC (Integrated Circuit), a processor, or a combination thereof.

C. Mutual monitoring system incorporated in a multi-node system FIG. 3 shows a mutual monitoring system 300 incorporated in a two-node system consisting of a combination of one master and one slave for simplification. On the other hand, the surgery support system 1 shown in FIGS. 1 and 2 is a dual-arm master-slave system, and is a right-hand master control device 111, a left-hand master control device 112, a right-hand slave control device 121, and a left-hand master control device 121. It consists of four nodes of the slave control device 122.

In the surgery support system 1, when any one of the four nodes of the right-hand master control device 111, the left-hand master control device 112, the right-hand slave control device 121, and the left-hand slave control device 122 is in an emergency stop, The remaining three nodes also need to be asynchronously linked at high speed to make an emergency stop. Further, when these four nodes recover from the emergency stop, it is necessary to set a dead time of a value linked with the maximum transmission delay between the nodes and confirm each other's states.

FIG. 4 schematically shows the network topology of the surgery support system 1 shown in FIG. The network topology shown has a tree structure. Specifically, the right-hand master control device 111 (M1) and the right-hand slave control device 121 (S1) are interconnected via the optical fiber cable 130, and the left-hand master control device 121 (M2) and the left-hand master control device 121 (M2) are connected to each other. The slave control device 122 (S2) is interconnected via the optical fiber cable 130. Further, in the master, the right-hand master control device 111 (M1) and the left-hand master control device 112 (M2) are interconnected, and the right-hand master control device 111 (M1) and the control PC 113 are interconnected. .. The network topology of the node system to which this disclosure applies is basically a tree structure.

The transmission delay between the right-hand master controller 111 (M1) and the right-hand slave controller 121 (S1) is D ₁ , and the transmission delay between the right-hand master controller 111 (M1) and the left-hand master controller 112 (M2). Is D ₂ , and the transmission delay between the right-hand slave control device 121 (S1) and the left-hand slave control device 122 (S2) is D ₃ . The maximum transmission delay in a tree-structured node system is the transmission delay from the root to the node that is the longest distance. In the network topology shown in FIG. 4, the route is the right-hand master control device 111 connected to the control PC 113, and the node at the longest distance from this route is the left-hand slave control device 122 (S2). Therefore, in the node system having the network topology shown in FIG. 4, if the fiber length between the master and the slave is the same, the maximum transmission delay is D ₂ + D ₃ .

FIG. 5 schematically shows a configuration example of the mutual monitoring system 500 incorporated in the surgery support system 1. Here, the surgery support system 1 is a right-hand master control device 111, a left-hand master control device 112, a right-hand slave control device 121, and a left-hand slave control device 122, which are connected by the network topology shown in FIG. It is assumed to be composed of 4 nodes. However, in FIG. 5, the control PC 113 is not shown. The right-hand master control device 111 and the right-hand slave control device 121, and the left-hand master control device 112 and the left-hand slave control device 122 are interconnected via the optical fiber cable 130 as described above. The communication medium that interconnects the right-hand master control device 111 and the left-hand master control device 112, and the right-hand slave control device 121 and the left-hand slave control device 122 is not particularly limited.

A mutual monitoring subsystem 501 is arranged between the right-hand master control device 111 and the right-hand slave control device 121. Further, a mutual monitoring subsystem 502 is arranged between the right-hand master control device 111 and the left-hand master control device 112. Further, a mutual monitoring subsystem 503 is arranged between the left-hand master control device 112 and the left-hand slave control device 122.

Since each of the mutual monitoring subsystems 501 to 503 has the same configuration as the mutual monitoring system 300 shown in FIG. 3, detailed description thereof will be omitted here. However, a dead time linked to the maximum transmission delay of the surgery support system 1 is set in the dead time detection units of the mutual monitoring subsystems 501 to 503. If the fiber length between the master and slave is the same, the maximum transmission delay of the surgical support system 1 is D ₂ + D ₃ . If the fiber length is unknown, it is necessary to check the maximum transmission delay using a delay time measurement circuit. The details of the delay time measurement circuit will be described later.

In the right-hand master control device 111, the safety monitoring state of the mutual monitoring subsystem 501 and the mutual monitoring subsystem 502 is shared. Although the connection is omitted in FIG. 5, the status signal output by the status determination unit on the mutual monitoring subsystem 501 side is input to the status determination unit on the mutual monitoring subsystem 502 side in the right-hand master control device 111, and the mutual monitoring subsystem 502 side is input to the status determination unit. By inputting the status signal output by the status determination unit on the monitoring subsystem 502 side to the status determination unit on the mutual monitoring subsystem 501 side, the safety monitoring status of the mutual monitoring subsystem 501 and the mutual monitoring subsystem 502 is shared. Can be done.

Similarly, in the right-hand slave control device 121, the safety monitoring state of the mutual monitoring subsystem 501 and the mutual monitoring subsystem 503 is shared. Although the connection is omitted in FIG. 5, in the right-hand slave control device 121, the status signal output by the status determination unit on the mutual monitoring subsystem 501 side is input to the status determination unit on the mutual monitoring subsystem 503 side, and the mutual monitoring subsystem 503 is input to each other. By inputting the status signal output by the status determination unit on the monitoring subsystem 503 side to the status determination unit on the mutual monitoring subsystem 501 side, the safety monitoring status of the mutual monitoring subsystem 501 and the mutual monitoring subsystem 503 is shared. Can be done.

Therefore, according to the mutual monitoring system 500 shown in FIG. 5, when any one of the four nodes is in an emergency stop, the remaining three nodes can be asynchronously and at high speed in an emergency stop. Further, according to the mutual monitoring system 500, when these four nodes recover from an emergency stop, a dead time of a value linked with the maximum transmission delay between the nodes is set, and each other's status is confirmed. Can be done.

D. Detailed configuration of the condition monitoring device FIG. 3 shows the master side safety monitoring device 310 and the slave side safety monitoring device 320 that perform an emergency stop asynchronously and interlockingly in response to the operation of the emergency stop switch on each of the master side and the slave side. The basic configuration example of is shown. Actually, on each of the master side and the slave side, in addition to the safety state based on the operation of the emergency stop switch, various states are monitored, the operation is stopped, and the stopped state is released to restore the operation. There is a need.

The safety monitoring circuits 310 and 320 shown in FIG. 3 have a basic configuration for monitoring only the status signals of the emergency stop switch and other nodes. In an actual master control device or slave control device, in addition to the emergency stop switch, it is necessary to monitor various states such as an abnormality in the motor drive circuit, an abnormality signal from the control PC 113, and a cable connection state. Of course, it is assumed that the state to be monitored differs depending on the controlled device such as the master and the slave.

FIG. 6 shows a configuration example of a condition monitoring device 600 configured to monitor various states of the controlled device in addition to the safety state based on the operation of the emergency stop switch.

In addition to the status signal 604 output from the safety monitoring device 603, the status determination unit 601 includes a UI (User Interface) switch signal 602, a motor drive circuit status signal 605, a Watch Dog signal 606 indicating the status of the host software, and communication. A communication ALIVE signal 607 or the like indicating the connection state of the cable is input. Since the configuration and operation of the safety monitoring device 603 have already been described with reference to FIG. 3, detailed description thereof will be omitted here. The Watch Dog signal 606 is output when an abnormal state of the software is detected. Further, the communication ALIVE signal 607 is output when an abnormality occurs in the cable connecting the own node and another node.

The state determination unit 601 is composed of an AND gate, and takes the logical product of the input signals 601 to 607, ... Output.

The safety torque off (Safe Torque Off) determination unit 621 takes a logical product of the overall status signal 610 output from the status determination unit 601 and the safety torque off release signal 611 output from the host software, and motors (not shown). A safety torque off release signal 622 is output to indicate whether or not to release the safety torque off.

The brake release determination unit 623 takes a logical product of the overall state signal 610 output from the state determination unit 601 and the brake release signal 612 output from the host software, and electromagnetically transmits the motor (not shown) to the motor (not shown). A brake release signal 624 indicating whether or not to release the brake is output.

The laser output on determination unit 625 takes a logical product of the overall state signal 610 output from the state determination unit 601 and the laser output on signal 613 output from the host software, and outputs the laser output on to a laser (not shown). Outputs a laser output on signal 626 indicating whether or not to turn on. The higher-level software carefully decides whether to turn on the laser output in order to avoid exposure due to unnecessary laser light output.

The condition monitoring device 600 can be equipped on each of the right-hand master control device 111, the left-hand master control device 112, the right-hand slave control device 121, and the left-hand slave control device 122.

The safety torque off determination unit 621, the brake release determination unit 623, and the laser output on determination unit 625 are all composed of AND gates, but the state determination unit 601 is hardware-like based on the states of the own node and other nodes. It is common in that it takes the logical product of the state signal determined to be safe or not and the control signal from the host software and outputs the control signal to the device (see FIG. 15). The devices referred to here are a motor drive circuit, an electromagnetic brake of a motor, a laser light module, and the like.

In the configuration example of the state monitoring device 600 shown in FIG. 6, the UI switch signal 602, the motor drive circuit state signal 605, the Watch Dog signal 606, and the communication ALIVE signal 607 are all directly connected to the state determination unit 601 (or). Although it is input (via a buffer), each of these signals is provided with a latch on the transmission path and connected to the input terminal of the state determination unit 601. It may be configured to hold the state of the latch until.

E. Safe operation flow
FIG. 7 shows a safe operation flow in the node equipped with the condition monitoring device 600 shown in FIG. 6 in the form of a flowchart. The illustrated safe operation flow is performed by higher-level software running on the node. The node referred to here corresponds to at least one of the right-hand master control device 111, the left-hand master control device 112, the right-hand slave control device 121, and the left-hand slave control device 122.

First, the initial setting is performed on the control PC 113 (step S701). The initial setting process includes the process of acquiring information necessary for detecting dead time such as cable length or maximum propagation time in the node system, and whether the master-slave system is dual-armed or single-armed (in other words,). , The number of nodes in the system) is acquired. Each node in the node system acquires the information of the initial setting performed by the control PC 113.

Next, the state in the own node is read (step S702). When the node includes the condition monitoring device 600 shown in FIG. 6, it reads the UI switch signal 602, the emergency stop switch signal 604, the motor drive circuit state signal 605, the Watch Dog signal 606, the communication ALIVE signal 607, and so on. Then, it is checked whether or not an abnormality has occurred in the own node (step S703).

Here, if an abnormality is detected from the signal read in the own node (Yes in step S703), a safety sequence is executed in this node (step S709). The content of the safety sequence is arbitrary and may differ from node to node. The details of the safety sequence will be omitted here.

On the other hand, if no abnormality is detected from the signal read in the own node (No in step S703), the dead time in the safety monitoring device is set based on the information acquired in the initial setting in step S701 (No in step S703). Step S704). Subsequently, the state of the other node is read (step S705), and it is checked whether or not an abnormality has occurred in any of the other nodes (step S706).

If an abnormality is detected in any of the other nodes (Yes in step S706), a safety sequence is executed in this node (step S709). The content of the safety sequence is arbitrary.

If no abnormality is detected in either the own node or the other node (No in step S706), this node is the own node and the other by the safety monitoring device shown in FIG. 3 or the condition monitoring device shown in FIG. Steady monitoring of the node of (step S707) is started. Then, when an abnormality is detected in either the own node or the other node (Yes in step S708), a safety sequence is executed in this node (step S709). The content of the safety sequence is arbitrary.

F. Modification example of the node system FIG. 4 shows the network topology of the dual arm surgery support system 1 shown in FIG. FIG. 8 shows a modified example of the network topology of the dual arm surgery support system. In the network topology shown in FIG. 8, the right-hand master control device (M1) and the right-hand slave control device (S1) are interconnected, and the right-hand master control device (M1) and the left-hand master control device (M2) are included in the master. Is interconnected, and the left-hand master control device (M2) and the left-hand slave control device (S2) are interconnected.

The transmission delay between the right-hand master controller (M1) and the right-hand slave controller (S1) is D ₁ , the transmission delay between the right-hand master controller (M1) and the left-hand master controller (M2) is D ₂ , _{Let D 3 be} the transmission delay between the left-hand master controller (M2) and the left-hand slave controller (S2). The maximum transmission delay in a tree-structured node system is the transmission delay from the root to the node that is the longest distance. In the network topology shown in FIG. 8, the route is the left-hand master control device (M2) connected to the control PC. If the fiber length between the master and slave is the same, the node at the longest distance from this route is the right-hand slave controller (S1), and the maximum transmission delay of the node system shown in FIG. 8 is D ₁ + D ₂ Is. If the fiber length is unknown, it is necessary to use a delay time measurement circuit to find out the maximum transmission delay of the node system shown in FIG. The details of the delay time measurement circuit will be described later.

FIG. 9 shows yet another configuration example of the network topology of the surgery support system. The surgery support system is a three-armed system including a first to third master and a first to third slave (neither is shown), and is a first master control device (M1) that controls the first master. ), The second master control device (M2) that controls the second master, the third master control device (M3) that controls the third master, and the first slave control device (M3) that controls the first slave. S1), a second slave control device (S2) that controls the second slave, and a third slave control device (S3) that controls the third slave are assumed. In the network topology shown in FIG. 9, the first master control device (M1) and the second master control device (M2) are interconnected in the master, and the second master control device (M2) and the third master control device (M2) are connected. The master control unit (M3) is interconnected. Then, the first master control device (M1) is interconnected with the first slave control device (S1), the second master control device (M2) is interconnected with the second slave control device (S2), and the second master control device (M2) is interconnected with the second slave control device (S2). The third master control device (M3) has a tree structure in which it is interconnected with the third slave control device (S3).

The transmission delay between the first master control device (M1) and the first slave control device (S1) is D ₁ , and the transmission delay between the first master control device (M1) and the second master control device (M2). D ₂ , the transmission delay between the second master controller (M2) and the second slave controller (S2) is D ₃ , the second master controller (M2) and the third master controller (M3) the transmission delay between D _4, the transmission delay between the third master controller and (M3) third slave controller (S3) and D _5. The maximum transmission delay in a tree-structured node system is the transmission delay from the root to the node that is the longest distance. In the network topology shown in FIG. 9, the route is a third master control device (M3) connected to the control PC. If the fiber length between the master and slave is the same, the node at the longest distance from this route is the first slave controller (S1), and the maximum transmission delay of the node system shown in FIG. 9 is D ₁ + D. ₂ + D ₄ . If the fiber length is unknown, it is necessary to use a delay time measurement circuit to find out the maximum transmission delay of the node system shown in FIG. The details of the delay time measurement circuit will be described later.

Note that both FIGS. 8 and 9 show the network topology of the surgery support system in which the master and the slave have a one-to-one correspondence. A surgical support system in which a plurality of slaves are connected to one master or one slave is connected to a plurality of masters is also envisioned. In FIG. 10, a first master control device (M1) that controls a first master (not shown), a first slave control device (S1) that controls a first slave (not shown), and a first slave control device (S1) are shown. It shows a network topology in which a second slave control device (S2) for controlling two slaves (not shown) is connected in series.

G. Dead Time Setting As described above, the dead time detection unit in the safety monitoring device is set with a dead time of a value linked to the maximum transmission delay in the node system. The delay time depends on the length of the cable connecting the nodes. Therefore, the transmission delay between the nodes can be estimated by using the wiring length or delay time measurement circuit.

When the nodes are connected using an optical fiber cable, the cable length can be estimated based on the level of the light emitted from one node and received by the other node.

In addition, the transmission delay can be estimated based on the round trip time until the delay measurement pulse that reaches the other node returns to the one node by outputting the delay measurement pulse from one node. For example, in the mutual monitoring system 300 shown in FIG. 3, a delay measurement circuit can be incorporated in the return circuit to output a delay measurement pulse. FIG. 11 shows how the delay measurement pulse output from one node reciprocates between the nodes and returns. Further, FIG. 12 shows a timing chart when the delay measurement pulse incorporated in the return circuit transmits the delay measurement pulse and receives the delay measurement pulse returned from the other node. FIG. 12 shows the delay time due to the transmission delay between the nodes.

In short, using a method of measuring the cable length based on the received level of the laser beam emitted from one node at the other node, a method of measuring the delay time based on the round trip time of the delay measurement pulse, and the like. , The transmission delay between nodes can be estimated. In the node system, the transmission delay may be automatically measured, and the dead time linked to the transmission delay may be automatically set in the safety monitoring circuit of each node. Of course, the dead time based on the measurement result of the transmission delay between the nodes may be manually set in the safety monitoring circuit of each node.

H. Operation mode and communication conditions In a node system consisting of a plurality of nodes connected by a cable, the operation mode is switched from the cable connection state between the nodes.

For example, as shown in FIG. 13, the right-hand master control device (M1) and the right-hand slave control device (S1) are interconnected, and the right-hand master control device (M1) and the left-hand master control device (M2) are included in the master. ) Are interconnected, and the left-hand master control device (M2) and the left-hand slave control device (S2) are interconnected. It has three operation modes: R) mode, single arm (L) mode in which the master and slave for the left hand operate, dual arm mode in which the master and slave for both hands operate, and a stop mode in which all operations are stopped. .. However, the control PC is interconnected with the right-hand master control device (M1), and the right-hand master control device (M1) is the root of the tree structure.

In FIG. 13, the cable connecting the right-hand master control device (M1) and the right-hand slave control device (S1) is C1, and the cable connecting the right-hand master control device (M1) and the left-hand master control device (M2) is connected. C2, the cable connecting the left-hand master control device (M2) and the left-hand slave control device (S2) is referred to as C3. The communication conditions of the cables C1 to C3 in each operation mode of the single arm (R) mode, the single arm (L) mode, the double arm mode, and the stop mode are as shown in FIG.

In the single arm (R) mode, only the cable C1 connecting the right-hand master control device (M1) and the right-hand slave control device (S1) needs to be connected. In the single arm (L) mode, the cable C3 connecting the left-hand master control device (M2) and the left-hand slave control device (S2) is connected, and the left-hand master control device (M2) is the root. It is necessary that the connection state is turned on with the right-hand master control device (M1). Further, in the dual arm mode, all the cables C1 to C3 are in the connected state. On the other hand, in the stop mode, all cables C1 to C3 are in the connection state off.

In the control PC connected to the right-hand master control device (M1), for example, in the initial setting executed in step S701 of the safe operation flow shown in FIG. 7, the operation support system simply sets the operation support system based on the connection state between the nodes. Mode switching such as arm (R) mode, single arm (L) mode, double arm mode, and stop mode is performed. Then, the drive conditions of the drive units such as the motors, brakes, and lasers of the master device and the slave device are determined according to the operation mode. Further, since the maximum transmission delay is determined according to the determined operation mode, a dead time linked to the transmission delay according to the operation mode is set in the dead time detector in the safety monitoring device (see FIG. 3). do.

For example, when the surgery support system is switched from the dual arm mode to the single arm (R) mode, the cable length is shortened. Therefore, by switching the dead time set in the safety monitoring device to a short value according to the cable length, The recovery time from an emergency stop can be shortened.

I. Effects The effects obtained by applying this disclosure to a surgical support system or node system are summarized.

(1) In an asynchronous mutual monitoring system, a dead time linked to the cable length connecting the nodes or the maximum transmission delay is set in the safety monitoring device of each node. Therefore, each node can make an emergency stop asynchronously and at high speed, and other nodes can also make an emergency stop asynchronously at high speed, and a dead time is set when returning from the emergency stop to change the state between the nodes. You can check each other. Further, the return time can be shortened by setting a short dead time according to the mode switching of the node system (for example, when switching from the dual arm mode to the single arm mode).

(2) The condition monitoring circuit (see FIG. 6) of each node is switched in conjunction with the insertion / removal or disconnection of the cable connecting the nodes. As a result, it is possible to avoid runaway of the motor, forgetting of the electromagnetic brake, and exposure due to unnecessary laser light irradiation from the optical fiber cable in the open state.

(3) The mode of the node system can be automatically switched (for example, switching between the dual arm mode, the single arm mode, and the stop mode in the surgical support system) by inserting / removing or disconnecting the cable connecting the nodes.

The present disclosure has been described in detail with reference to the specific embodiment. However, it is self-evident that a person skilled in the art can modify or substitute the embodiment without departing from the gist of the present disclosure.

Although the present specification has mainly described embodiments in which the present disclosure is applied to a master-slave type surgical support system, the gist of the present disclosure is not limited to this. The present disclosure can be similarly applied to master-slave systems used in various industrial fields other than medical treatment. Further, the scope of application of the present disclosure is not limited to the master-slave system, and the same applies to various types of systems in which a master-slave relationship is not necessarily established between each node, which consists of a plurality of interlocking nodes. The present disclosure can be applied.

In short, the present disclosure has been described in the form of an example, and the contents of the present specification should not be interpreted in a limited manner. In order to judge the gist of this disclosure, the scope of claims should be taken into consideration.

The present disclosure may also have the following configuration.
(1) A control device that controls one node in a system consisting of a plurality of nodes.
A holding unit that holds the state of its own node,
Input section for inputting the status of other nodes,
A determination unit that determines the state of the own node based on the state of the own node held in the holding unit and the state of another node input from the input unit.
A control device comprising.
(2) The holding unit holds the state of its own node until a state release signal is input.
The input unit invalidates the input of the state of another node for a predetermined dead time period after the state release signal is input.
The control device according to (1) above.
(3) The holding unit holds the state indicated by the emergency stop signal based on the operation of the emergency stop switch of the own node, and holds the state in response to the emergency stop release signal from the software executed on the own node. Release,
The control device according to (2) above.
(4) The dead time is set based on the transmission delay between the nodes in the system.
The control device according to any one of (1) to (3) above.
(5) The dead time is set based on the wiring length of the cable connecting the nodes in the system.
The control device according to (4) above.
(6) The dead time is set based on the wiring length of the cable connecting the nodes in the system or the measurement result by the delay time measurement circuit between the nodes.
The control device according to any one of (4) and (5) above.
(7) The delay time measuring circuit estimates the transmission delay between nodes based on the round trip time of the signal between the nodes.
The control device according to (6) above.
(8) The dead time is set according to the switching of the operation mode of the system based on the connection state between the nodes.
The control device according to any one of (4) to (7) above.
(9) A storage element for setting a dead time in the input unit, or a delay circuit for invalidating the input by the dead time is provided.
The control device according to any one of (2) to (8) above.
(10) It further includes an integrated determination unit that integrates and determines a plurality of types of states in the own node and the states determined by the determination unit.
The control device according to any one of (1) to (9) above.
(11) The own node includes a plurality of drive units and includes a plurality of drive units.
The output of the control signal to each drive unit is controlled based on the determination result of the integrated determination unit.
The control device according to (10) above.
(12) A control method for controlling one node in a system consisting of a plurality of nodes.
A retention step that retains the state of its own node,
Input steps to enter the status of other nodes,
A determination step for determining the state of the own node based on the state of the own node held in the holding step and the state of another node input in the input step, and
Control method having.
(13) Consists of multiple nodes, at least some of them
Based on the holding unit that holds the state of the own node, the input unit that inputs the state of the other node, the state of the own node held in the holding unit, and the state of the other node input from the input unit. Equipped with a monitoring device equipped with a judgment unit that determines the status of the own node,
Node system.
(14) The holding unit holds the state of its own node until a state release signal is input.
The input unit invalidates the input of the state of another node for a predetermined dead time period after the state release signal is input.
The node system according to (13) above.
(15) The holding unit holds the state indicated by the emergency stop signal based on the operation of the emergency stop switch of the own node, and holds the state in response to the emergency stop release signal from the software executed on the own node. unlock,
The node system according to (14) above.
(16) The dead time is set based on the transmission delay between the nodes in the system.
The node system according to (13) to (15) above.
(17) The dead time is set according to the switching of the operation mode of the system based on the connection state between the nodes.
The node system according to (16) above.
(18) The input unit includes a storage element for setting a dead time, or a delay circuit for invalidating the input by the dead time.
The node system according to (14) to (17) above.
(19) It further includes an integrated determination unit that integrates and determines a plurality of types of states in the own node and the states determined by the determination unit.
The control device according to any one of (13) to (18) above.
(20) The own node includes a plurality of drive units, and the at least a part of the nodes control the output of the control signal to each drive unit based on the determination result of the integrated determination unit.
The node system according to (19) above.

1 ... Surgery support system, 11 ... Operating table, 13 ... Right hand slave device 14 ... Left hand slave device, 15 ... Operation table, 16 ... Right hand master device 17 ... Left hand master device, 18, 19 ... Operation unit, 20 ... Camera unit 21 ... Monitor 111 ... Right-hand master control device, 112 ... Left-hand master control device 113 ... Control PC, 121 ... Right-hand slave control device 122 ... Left-hand slave control device, 123 ... CCU
300 ... Mutual monitoring system, 310 ... Master side safety monitoring device 311 ... Emergency stop signal, 312 ... Latch, 313 ... Master status determination unit 314 ... Latch release signal, 315 ... Switch 316 ... Dead time (DET) detection unit, 317 ... Status signal 318 ... Return circuit 320 ... Slave side safety monitoring device, 321 ... Emergency stop signal 32 ... Latch 323 ... Slave status determination unit 324 ... Latch release signal 325 ... Switch 326 ... Dead time (DET) detection unit 327 ... Status signal, 328 ... Return circuit 500 ... Mutual monitoring system, 501 to 503 ... Mutual monitoring subsystem 600 ... Status monitoring circuit, 601 ... Status determination unit 602 ... UI switch signal, 603 ... Safety monitoring device, 604 ... Status signal 605 ... Motor drive circuit status signal, 606 ... Watch Dog signal 607 ... Communication ALIVE signal, 610 ... Overall status signal 611 ... Safety torque off release signal, 612 ... Brake release signal 613 ... Laser output on signal 621 ... Safety torque off judgment unit, 622 ... Safety Torque off release signal 623 ... Brake release judgment unit, 624 ... Brake release signal 625 ... Laser output on judgment unit, 626 ... Laser output on signal

Claims (13)

1. A control device that controls one node in a system consisting of multiple nodes.
   A holding unit that holds the state of its own node,
   Input section for inputting the status of other nodes,
   A determination unit that determines the state of the own node based on the state of the own node held in the holding unit and the state of another node input from the input unit.
   A control device comprising.
2. The holding unit holds the state of its own node until a state release signal is input.
   The input unit invalidates the input of the state of another node for a predetermined dead time period after the state release signal is input.
   The control device according to claim 1.
3. The holding unit holds the state indicated by the emergency stop signal based on the operation of the emergency stop switch of the own node, and releases the held state in response to the emergency stop release signal from the software executed on the own node. ,
   The control device according to claim 2.
4. The dead time is set based on the transmission delay between the nodes in the system.
   The control device according to claim 1.
5. The dead time is set based on the length of the cable connecting the nodes in the system.
   The control device according to claim 4.
6. The dead time is set based on the wiring length of the cable connecting the nodes in the system or the measurement result by the delay time measurement circuit between the nodes.
   The control device according to claim 4.
7. The delay time measuring circuit estimates the transmission delay between nodes based on the round trip time of the signal between the nodes.
   The control device according to claim 6.
8. The dead time is set according to the switching of the operation mode of the system based on the connection state between the nodes.
   The control device according to claim 4.
9. The input unit includes a storage element for setting a dead time, or a delay circuit for invalidating the input by the dead time.
   The control device according to claim 2.
10. It further includes an integrated determination unit that integrates and determines a plurality of types of states in the own node and the states determined by the determination unit.
    The control device according to claim 1.
11. The own node includes multiple drive units and
    The output of the control signal to each drive unit is controlled based on the determination result of the integrated determination unit.
    The control device according to claim 10.
12. A control method that controls one node in a system consisting of multiple nodes.
    A retention step that retains the state of its own node,
    Input steps to enter the status of other nodes,
    A determination step for determining the state of the own node based on the state of the own node held in the holding step and the state of another node input in the input step, and
    Control method having.
13. Consists of multiple nodes, at least some of them
    Based on the holding unit that holds the state of the own node, the input unit that inputs the state of the other node, the state of the own node held in the holding unit, and the state of the other node input from the input unit. Equipped with a monitoring device equipped with a judgment unit that determines the status of the own node,
    Node system.

Images