Patent Description:
As autonomous systems become ever more present in industrial environments, it becomes more difficult to assure correct operation. Current systems are certified by analyzing all possible states. However, such an approach becomes infeasible as the systems and the environments they operate in become more complex and unpredictable.

<CIT> provides a system and method for path planning of autonomous vehicles based on gradient. <CIT> provides multi-layer learning based control system and method for an autonomous vehicle or mobile robot. <CIT> provides systems and methods are provided for navigating an autonomous vehicle using reinforcement learning techniques.

According to the present invention, an autonomous system is provided, as defined by independent claim <NUM>. The system includes a vehicle operable to travel from a first point to a second point, a first actuator operable to adjust a speed of the vehicle, and a second actuator operable to adjust a direction of travel of the vehicle. A controller is operable to generate control signals to be sent to the first actuator and the second actuator to facilitate the transition of the system from a first state to a second state during travel between the first point and the second point. The controller employs a neural network model of the autonomous system to form the control signals. A reachability controller is coupled to the controller to receive the first state and the control signals and to analyze the first state and the control signals to determine if the second state is a safe state. The reachability controller includes an analytic model of the autonomous system. The analytical model is simpler than the neural network model such that the analytic model allows for a rapid calculation of states of the analytic model to determine if the states are safe or unsafe while allowing for a complete testing of all operating conditions.

According to the present invention, a method of operating an autonomous system is provided, as defined by independent claim <NUM>. The method includes providing a vehicle operable to travel from a first point to a second point, positioning a first actuator in a first position, the first actuator controlling the speed of the vehicle, and positioning a second actuator in a second position, the second actuator controlling a direction of travel of the vehicle, the first position and the second position defining a first state of the system. The method also includes generating, by a first controller, a control signal to be sent to one of the first actuator and the second actuator to change the state of the system, wherein the first controller includes a neural network model of the vehicle, analyzing, by a reachability controller, the first state and the control signal to determine a second state which would result when the control signals are implemented, wherein the reachability controller includes an analytical model of the vehicle, the analytical model being simpler than the neural network model such that the analytic model allows for a rapid calculation of states of the analytic model to determine if the states are safe or unsafe while allowing for a complete testing of all operating conditions, blocking the control signals in response to the analysis showing that the second state is not a safe state, and blocking the control signals in response to the analysis showing that additional safe states cannot be reached from the second state.

In another construction, an autonomous system includes a first actuator operable to adjust a first attribute of the system, a second actuator operable to adjust a second attribute of the system, and a controller operable to send control signals to the first actuator and the second actuator to facilitate the movement of the system from a first state to a second state during the performance of a task by the system. A reachability controller is coupled to the controller to receive the first state and the control signals and to analyze the first state and the control signals to determine if the system can reach a safe state from the resulting second state.

In another construction, an autonomous system includes a grid arranged to distribute electrical power to a plurality of power consumers, a plurality of distributed power generation units, each unit individually controllable and operable to deliver a quantity of power to the grid, and a plurality of switches arranged to control the flow of electrical power between the power generation units and the power consumers. A controller includes a neural network model of the grid, the plurality of distributed power generation units, and the plurality of switches and is operable to provide control signals to each unit of the plurality of distributed power generation units and each switch of the plurality of switches to transition the system from a first state. A reachability controller is coupled to the controller to receive the first state and the control signals and to analyze the first state and the control signals to determine a second state which will result if the control signals are implemented and to determine if the second state is a safe state.

The foregoing has outlined rather broadly the technical features of the present disclosure so that those skilled in the art may better understand the detailed description that follows. Additional features and advantages of the disclosure will be described hereinafter that form the subject of the claims. Those skilled in the art will appreciate that they may readily use the conception and the specific embodiments disclosed as a basis for modifying or designing other structures for carrying out the same purposes of the present disclosure. Those skilled in the art will also realize that such equivalent constructions do not depart from the scope of the disclosure in its broadest form.

Also, before undertaking the Detailed Description below, it should be understood that various definitions for certain words and phrases are provided throughout this specification and those of ordinary skill in the art will understand that such definitions apply in many, if not most, instances to prior as well as future uses of such defined words and phrases. While some terms may include a wide variety of embodiments, the appended claims may expressly limit these terms to specific embodiments.

Various technologies that pertain to systems and methods will now be described with reference to the drawings, where like reference numerals represent like elements throughout. The drawings discussed below, and the various embodiments used to describe the principles of the present disclosure in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged apparatus. It is to be understood that functionality that is described as being carried out by certain system elements may be performed by multiple elements. Similarly, for instance, an element may be configured to perform functionality that is described as being carried out by multiple elements. The numerous innovative teachings of the present application will be described with reference to exemplary non-limiting embodiments.

Also, it should be understood that the words or phrases used herein should be construed broadly, unless expressly limited in some examples. For example, the terms "including," "having," and "comprising," as well as derivatives thereof, mean inclusion without limitation. The singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. Further, the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "or" is inclusive, meaning and/or, unless the context clearly indicates otherwise. The phrases "associated with" and "associated therewith," as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like.

Also, although the terms "first", "second", "third" and so forth may be used herein to refer to various elements, information, functions, or acts, these elements, information, functions, or acts should not be limited by these terms. Rather these numeral adjectives are used to distinguish different elements, information, functions or acts from each other. For example, a first element, information, function, or act could be termed a second element, information, function, or act, and, similarly, a second element, information, function, or act could be termed a first element, information, function, or act, without departing from the scope of the present disclosure.

In addition, the term "adjacent to" may mean: that an element is relatively near to but not in contact with a further element; or that the element is in contact with the further portion, unless the context clearly indicates otherwise. Further, the phrase "based on" is intended to mean "based, at least in part, on" unless explicitly stated otherwise. Terms "about" or "substantially" or like terms are intended to cover variations in a value that are within normal industry manufacturing tolerances for that dimension. If no industry standard as available a variation of <NUM> percent would fall within the meaning of these terms unless otherwise stated.

<FIG> schematically illustrates an autonomous system <NUM> that includes a physical device <NUM> that is controlled by a controller <NUM> and a reachability controller <NUM>. The controller <NUM> and the reachability controller <NUM> are each software-based controllers that are run by one or more computers <NUM>. While not illustrated herein, any autonomous system <NUM> would include one or more sensors that are connected to one or both of the controller <NUM> and the reachability controller <NUM> to sense various aspects of the environment. For example, optical sensors may be positioned to provide visual images of the environment. Another system may include a LIDAR system that detects the distance and direction to outside objects around the system <NUM>. Still other sensors could include RFID readers, bar code readers, infrared sensors, RADAR sensors, acoustic sensors, autonomic sensors, and the like.

As is well understood, the software aspects of the present invention could be stored on virtually any computer readable medium including a local disk drive system, a remote server, internet, or cloud-based storage location. In addition, aspects could be stored on portable devices or memory devices as may be required. The computer <NUM>, or computers generally includes an input/output device that allows for access to the software regardless of where it is stored, one or more processors, memory devices, user input devices, and output devices such as monitors, printers, and the like.

The processor, or processors could include a standard micro-processor or could include artificial intelligence accelerators or processors that are specifically designed to perform artificial intelligence applications such as artificial neural networks, machine vision, and machine learning. Typical applications include algorithms for robotics, internet of things, and other data-intensive or sensor-driven tasks. Often AI accelerators are multi-core designs and generally focus on low-precision arithmetic, novel dataflow architectures, or in-memory computing capability. In still other applications, the processor may include a graphics processing unit (GPU) designed for the manipulation of images and the calculation of local image properties. The mathematical basis of neural networks and image manipulation are similar, leading GPUs to become increasingly used for machine learning tasks. Of course, other processors or arrangements could be employed if desired. Other options include but are not limited to field-programmable gate arrays (FPGA), application-specific integrated circuits (ASIC), and the like.

The computer <NUM> may also include communication devices that would allow for communication between other computers or computer networks, as well as for communication with other devices such as machine tools, work stations, actuators, controllers, sensors, and the like.

Returning to <FIG>, the controller <NUM> preferably includes a neural network model <NUM> of the physical device <NUM> and the expected environment in which the physical device <NUM> will operate. As one of ordinary skill will understand, neural network models are very complicated programs that are challenging to test under all operating conditions. For example, an autonomous vehicle such as an automobile may be relatively simple to model. However, the environment in which the automobile operates is extremely dynamic making it very difficult to test all possible operating conditions. Any one operating condition or state can lead to virtually infinite other states, and those states lead to infinitely more options, rapidly leading to a very complicated model to analyze and test.

During operation of the system <NUM>, it is desirable to maintain the physical device <NUM> in a stable or safe state, or to adjust the physical device <NUM> as may be required to complete a goal. For example, a user may provide inputs to the physical device <NUM>. These inputs are converted to signals <NUM> that are transmitted to the controller <NUM> and can be transmitted to the reachability controller <NUM>. The controller <NUM> generates control signals <NUM> that are sent to various components in the physical device <NUM> to transition the physical device <NUM> between states as the controller <NUM> deems necessary to achieve the goals of the physical device <NUM>. This operation will be described in greater detail with regard to the examples of <FIG>.

The reachability controller <NUM> is positioned between the controller <NUM> and the physical device <NUM> to analyze the control signals <NUM> and the potential changes being made to the physical device <NUM> to assure that those changes result in the physical device <NUM> moving into an acceptable state. In preferred constructions, the reachability controller <NUM> includes an analytical model <NUM> of the physical device <NUM> and the environment. The analytical model <NUM> includes a dynamical model of the physical device <NUM> that is far simpler than the neural network model <NUM> of the physical device <NUM>. The simplicity of the analytical model <NUM> allows for the rapid calculation of states of the model to determine if those states are acceptable or unacceptable, but more importantly allows for the complete testing of all operating conditions. The reachability controller <NUM> will receive data indicative of the current state of the physical device <NUM> and the control signals <NUM> and operates to determine the likely new state of the physical device <NUM> from that data. The reachability controller <NUM> then analyzes that second state to determine if the physical device <NUM> should be allowed to transition to that state. If the analysis concludes that the transition should occur, the signals <NUM> are passed to the physical system <NUM> as control signals 35a. In some cases, the signals 35a passed to the physical system are modified slightly by the reachability controller <NUM> to assure that a safe state is reached, in other cases, the signals <NUM> are passed to the physical system as signals 35a with no changes. If the analysis concludes that the transition should not occur, some systems pass a feedback signal <NUM> from the reachability controller <NUM> to the controller <NUM> to further "teach" the controller <NUM> and thereby improve future decision-making,.

Before proceeding further, the term "states" should be clarified. Any system is operable in one of many different states. The states may be represented by control device positions, outside parameters of the system, or any other distinguishing feature. For example, an autonomous automobile may have a first state in which it is moving forward at <NUM>/hr in a straight line. If the automobile changes to <NUM>/hr it has changed to a second state. Each state can be generically classified as one of two types of states. The first state type is referred to herein as known, acceptable, or safe with other terms also being possible. These states are typically states in which the autonomous system is operating in a stable manner and is not at risk of failing, becoming unstable, or causing harm to outside observers or equipment. The second state type is referred to herein as unknown, unacceptable, or unsafe with other terms also being possible. These states are typically states or conditions in which the system is unstable, is about to fail, places the system in an undesirable position, or could cause harm to outside observers and equipment.

<FIG> schematically illustrates several examples of moving between states. In <FIG>, the space within boundaries <NUM> represent the safe states, while states outside of the boundaries <NUM> are unsafe states. The space might represent the travel direction of the physical device <NUM> with the distance from the center of the space representing the speed of travel.

<FIG> schematically illustrates the physical device <NUM> in a first safe state <NUM>. The controller <NUM> has generated control signals <NUM> to move the system <NUM> to a second state <NUM>. The reachability controller <NUM> receives information indicative of the first state <NUM> and the control signals <NUM> being generated by the controller <NUM>. The reachability controller <NUM> determines the likely second state <NUM> based on the input of those control signals <NUM> to determine where that second state <NUM> falls in the illustration of <FIG>. The reachability controller <NUM> than makes two determinations. First, the reachability controller <NUM> determines if the second state <NUM> is a safe state. If it is not, the second determination does not need to be made and the control signals <NUM> are blocked to prevent transition of the physical device <NUM> to the second state <NUM>. However, if the second state <NUM> is a safe state, the reachability controller <NUM> determines if additional safe states <NUM> can be reached from the second state <NUM>. If additional safe states <NUM> are available, the control signals <NUM> pass to the physical device <NUM> and the physical device <NUM> transitions to the second state <NUM>. However, if there are no additional safe states <NUM> to which the physical device <NUM> can transition from the second state <NUM>, the reachability controller <NUM> will block the control signals <NUM> and the physical device <NUM> will not transition to the second state <NUM>. Thus, in order for the transition to occur, both determinations must be positive. If either determination results in a negative answer, the control signals <NUM> are blocked and the physical device <NUM> remains in the first state <NUM>.

In the first example of <FIG>, the second state <NUM> is calculated as being a safe state. In addition, the reachability controller <NUM> further determines that there are multiple additional safe states <NUM> into which the physical device <NUM> could transition from the second state <NUM>. In this situation, the reachability controller <NUM> will allow the control signals <NUM> to pass to the physical device <NUM> and the physical device <NUM> will transition to the second state <NUM>.

In a second example, the control signals <NUM> are generated to transition from a first state 50a to a second state 55a. The second state 55a is calculated as being a safe state but one that is surrounded by fewer safe states 60a. In this case, the reachability controller <NUM> still finds that there are sufficient additional safe states 60a that can be reached from the second state 55a and the control signals <NUM> are allowed to pass to transition the physical device <NUM> to the second state 55a.

In a third example, control signals <NUM> are generated to transition from a first state 50b to a second state 55b. The reachability controller <NUM> determines that the likely second state 55b is a safe state. However, the second state 55b is surrounded by unsafe states and no additional safe states can be reached from this second state 55b. In this case, the reachability controller <NUM> will block the control signals <NUM> to prevent transition to the second state 55b.

In a fourth example, control signals <NUM> are generated to transition from a first state 50c to a second state 55c. The reachability controller <NUM> determines that the likely second state 55c is an unsafe state. In this case, the second determination is not made, and the reachability controller <NUM> blocks the control signals <NUM> to prevent transition to the second state 55c.

The ability to reach a safe state from a given state means different things in different examples and situations. The following specific examples better illustrate this, as well as the operation of the controller <NUM> and the reachability controller <NUM>.

<FIG> illustrates an example of an autonomous system including a physical device <NUM> in the form of an autonomous vehicle <NUM>. While the vehicle <NUM> will be discussed as an automobile, it could be any over the road vehicle or could be an aerial vehicle including fixed wing aircraft, rotary aircraft, or other craft. The vehicle includes a throttle and brake arrangement <NUM> that is moved to control the speed of the vehicle <NUM> and a steering mechanism <NUM> that can be adjusted to control the direction of travel of the vehicle <NUM>. In the case of electrically-powered vehicles <NUM>, the throttle may include a variable frequency drive or other mechanism that controls the power being delivered to the engines. A first actuator <NUM> is positioned to adjust the position of the throttle and brake arrangement <NUM> and a second actuator <NUM> is positioned to adjust the steering mechanism <NUM>. Of course, additional actuators and devices can be employed and are generally employed in autonomous devices. For example, in one application, one actuator controls a throttle while a separate actuator controls the brakes. A user or other system may provide input data <NUM> to the controller <NUM>. For example, a user may enter a new destination or set a new speed for the automobile <NUM>. The controller <NUM> collects that information and determines if the current state of the automobile <NUM> needs to be adjusted. If an adjustment is required, control signals <NUM> are sent to the reachability controller <NUM> along with the current state of the automobile <NUM>. The reachability controller <NUM> determines if the control signals <NUM> should be passed as discussed with regard to <FIG>, and if they should be, passes them to the various actuators <NUM>, <NUM> which then make the necessary adjustments.

In the case of the automobile <NUM>, safe states may be states that maintain the position of the automobile <NUM> on the road, traveling below a given speed or speed limit, and safely spaced from other vehicles or objects. In one situation, the automobile <NUM> might be approaching a parked vehicle in its path. If the user attempts to accelerate, the controller <NUM> would generate the necessary control signals <NUM> and send them to the reachability controller <NUM>. The reachability controller <NUM> will determine if the automobile <NUM> can still stop before hitting the parked vehicle, before passing the control signals <NUM> to the actuators <NUM>, <NUM>. Thus, the acceleration leads to a safe state, but the reachability controller <NUM> determines if other safe states <NUM> can be reached from that new higher speed state, specifically if the vehicle <NUM> can stop before striking the parked vehicle. What might normally be considered a safe state may not be a safe state due to outside conditions.

<FIG> illustrates another example of an autonomous system <NUM> that includes a controller <NUM> and a reachability controller <NUM>. In this example, the autonomous system <NUM> includes a physical device <NUM> in the form of a power grid <NUM> that operates to receive generated electrical power and distribute that power to a plurality of power consumers <NUM> or users. A plurality of distributed power generators <NUM> can include multiple different power sources that each operate to generate electrical power for delivery to the power grid <NUM> and distribution to the users <NUM>. Each of the power generation units <NUM> is individually controllable to deliver a desired amount of power at a desired time. A plurality of switches <NUM> is provided to selectively connect or disconnect individual power generation units <NUM> and power consumers <NUM> as may be required. As is well known, other components such as energy storage units, transformers, and the like are also included in typical power grid systems <NUM> and further complicate the control of the power grid <NUM>.

As with prior examples, the controller <NUM> includes a neural network model <NUM> of the power grid system <NUM> and its operating environment. However, the complexity of the neural network model <NUM> makes complete and thorough testing of all possible situations challenging if not impossible. The reachability controller <NUM> includes a simpler analytical model <NUM> of the power grid system <NUM> to allow the analytical model <NUM> to be more completely tested to assure that the reachability model <NUM> does not allow the system <NUM> to enter an unsafe state.

During operation of the power grid system <NUM>, a user may provide inputs <NUM> such as system limitations, power generator outages, and the like. The controller <NUM> uses those inputs as well as inputs from various sensors to control the power generators <NUM> and the switches <NUM> to achieve the desired results. Each time the controller <NUM> determines that an adjustment to the system <NUM> is required, control signals <NUM> are generated and sent to the reachability controller <NUM>. The control signals <NUM> are configured to control one or more actuators or system controls <NUM> as required. The reachability controller <NUM>, receives or determines the current state of the system <NUM>, analyzes the control signals <NUM>, and determines a second state that would result if the control signals <NUM> were implemented. As discussed with previous examples, if the second state is a safe state, and the power grid system <NUM> could transition from the second state to other safe states, the control signals <NUM> are passed to the power grid system <NUM>. However, if either of these questions are answered in the negative, the control signals <NUM> are not forwarded to the power grid system <NUM>.

<FIG> illustrates an example of an autonomous factory <NUM> that includes multiple robots <NUM> and could include other controllable components such as conveyors, machine tools, inventory control systems, and the like. It should be clear that while the following example discusses controlling a robot, the system could control virtually any device within the factory. Any device that includes motors or other controllable actuators as well as sensors that can sense the external environment and report the operation of the device within that environment can utilize the system described herein.

As with prior examples, each robot <NUM> or autonomous device includes an actuator <NUM> that may comprise multiple actuators or other control devices (e.g., motors, VFDs, etc.) that in turn control the movements or actions of the robot <NUM>. A controller <NUM> includes a neural network model <NUM> of the controllable devices within the factory <NUM>, or possibly the entire factory <NUM>. One or more users may provide inputs <NUM> to the controller <NUM> that set parameters for the factory <NUM> such as production rates, production steps, and the like. The controller <NUM> uses those inputs and data provided by various sensors or other input devices to determine if the state of the factory <NUM> needs to change. The controller <NUM> generates control signals <NUM> that are first sent to a reachability controller <NUM> if a change of state is required. The reachability controller <NUM> analyzes the control signals <NUM> in view of the current state of the factory <NUM> to determine the likely second state of the factory <NUM> should the control signals <NUM> be implemented. If the reachability controller <NUM> determines that the second state is a safe state and that other safe states can be reached from the second state, the control signals <NUM> are passed to the robots <NUM> and other devices within the factory <NUM>.

<FIG> illustrates an example of an autonomous process plant <NUM> such as an oil refinery or chemical plant that includes multiple processes, valves, and other components <NUM> specific to the process being employed. As with prior examples, each process or device <NUM> includes an actuator <NUM> that may comprise multiple actuators or other control devices that in turn control the movements or actions of the process or device <NUM>. A controller <NUM> includes a neural network model <NUM> of the controllable devices <NUM> within the process plant <NUM>, or possibly the entire plant <NUM>. One or more users may provide inputs <NUM> to the controller <NUM> that set parameters for the process plant such as production rates, production steps, and the like. The controller <NUM> uses those inputs and data provided by various sensors or other input devices to determine if the state of the process plant <NUM> needs to change. The controller <NUM> generates control signals <NUM> that are first sent to a reachability controller <NUM>. The reachability controller <NUM> analyzes the control signals <NUM> in view of the current state of the process plant <NUM> to determine the likely second state of the process plant <NUM> should the control signals <NUM> be implemented. If the reachability controller <NUM> determines that the second state is a safe state and that other safe states can be reached from the second state, the control signals <NUM> are passed to the devices <NUM> within the process plant <NUM>.

As discussed, the use of a reachability controller <NUM> is particularly advantageous for complex autonomous systems in which a controller <NUM> including a neural network model <NUM> cannot reasonably be tested for all possible scenarios. In these cases, a simple analytical model <NUM> can be completely tested and used in the reachability controller <NUM>. The reachability analysis will likely provide fewer safe states than what the neural network model <NUM> would provide, but the more complete testing assures that the reachability controller <NUM> will not allow the system to transition to a state that is undesirable.

Claim 1:
An autonomous system (<NUM>) comprising:
a vehicle (<NUM>) operable to travel from a first point to a second point;
a first actuator (<NUM>) operable to adjust a speed of the vehicle (<NUM>);
a second actuator (<NUM>) operable to adjust a direction of travel of the vehicle;
a controller (<NUM>) operable to generate control signals to be sent to the first actuator (<NUM>) and the second actuator (<NUM>) to facilitate the transition of the system (<NUM>) from a first state to a second state during travel between the first point and the second point, wherein the controller (<NUM>) employs a neural network model of the autonomous system (<NUM>) to form the control signals; and
a reachability controller (<NUM>) coupled to the controller (<NUM>) to receive the first state and the control signals and to analyze the first state and the control signals to determine if the second state is a safe state, wherein the reachability controller (<NUM>) includes an analytical model of the autonomous system (<NUM>), the analytical model being simpler than the neural network model such that the analytic model allows for a rapid calculation of states of the analytic model to determine if the states are safe or unsafe while allowing for a complete testing of all operating conditions.