Coordinated control system for precise positioning and emergency response of mine hoist cage
By adopting a single high-integrity hardware controller platform in the mine hoisting cage control system, dividing it into precision control and emergency response zones, and achieving strong logic isolation and collaborative control through a secure microkernel, the problems of cognitive conflict and logic stagnation in the system were solved, ensuring safe response and system reliability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ANHUI WANBEI COAL REFCO GRP LTD HANSHAN HENGTAI NONMETALLIC MATERIALS BRANCH
- Filing Date
- 2025-11-10
- Publication Date
- 2026-07-07
Smart Images
Figure CN121500837B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a collaborative control system for precise positioning and emergency response of mine hoisting cages, belonging to the field of industrial automatic control system technology. Background Technology
[0002] To ensure high system reliability, a common approach to manufacturing control systems is to establish a physically isolated dual-system architecture. This involves a precision control system, centered on a programmable logic controller (PLC) and a frequency converter, responsible for efficient operation, and a separate emergency braking system based on a safety PLC or hard-wired relays, responsible for ensuring safety in extreme situations. This architecture, which relies on physical hardware separation, can easily lead to cognitive conflicts between the two independent control logics at the control logic level when the system faces situations such as sensor drift or data inconsistency. For example, the precision control system's attempt to correct its course might be interpreted by the emergency response system as dangerous overspeeding and trigger braking.
[0003] In addition to the aforementioned architectural issues, existing technologies also suffer from limitations in logical cross-verification at the level of specific control methods. For example, Chinese invention patent CN108861903B discloses a mine hoisting cage berth system and method. This scheme attempts to improve positioning accuracy through dual position judgment, that is, its addressing host must simultaneously confirm that the calculated position from the travel length feedback module (such as an encoder) and the measured position from the position sensing module (such as a position sensor) are consistent before issuing a docking command. However, this control logic has an inherent defect: it places two different measurement principles (one is the wire rope length estimation, which is prone to cumulative errors, and the other is fixed-point measurement) on an equal footing. Once wire rope slippage, stretching, or encoder drift occurs, causing inconsistencies between the two position data, the system will be unable to determine the true position, thus causing its docking command control module to refuse to issue a docking command, which will also fall into an uncertain state of logical stagnation and cannot ensure a safe response at critical moments such as when sensor data conflict.
[0004] Therefore, the technical problem to be solved by this invention is how to innovate from the perspective of control system architecture, eliminate the cognitive conflict between precision control and emergency response, and achieve a control method that is both strongly isolated and intrinsically coordinated between the two under a single hardware platform. Summary of the Invention
[0005] This invention provides a collaborative control system for precise positioning and emergency response of mine hoisting cages. Its main purpose is to solve the problems of cognitive conflict and logical stagnation in the existing physically isolated dual-system architecture under critical conditions.
[0006] To achieve the above objectives, this invention provides a collaborative control system for precise positioning and emergency response of mine hoisting cages. Built on a single, high-integrity hardware controller platform, the collaborative control system includes a secure microkernel, a precision control partition, an emergency response partition, and a shared memory area.
[0007] A secure microkernel is used to divide the hardware resources of a single high-integrity hardware controller platform into a precision control partition and an emergency response partition, and to ensure strong logical isolation between the precision control partition and the emergency response partition.
[0008] The precision control partition is used to run precision positioning and speed control logic, and in each control cycle, it writes its control intent data and dynamically updated heartbeat signals to the shared memory area.
[0009] The emergency response partition is used to run emergency response safety logic and is configured with independent safety input / output (I / O) channels for acquiring independent sensor data. The emergency response partition also uses its emergency response safety logic to simultaneously set and execute the following collaborative operation rules: Rule 1: Based on a safety rule stored within the emergency response partition, determine whether the independent sensor data and control intent data are in a logical conflict state; Rule 2: Monitor the heartbeat signal in the shared memory area; Rule 3: When the rule's determination result is a logical conflict state, or when the monitoring result of Rule 2 is that the heartbeat signal has not been dynamically updated within a preset time stored in the emergency response partition, a hardware-level rejection or reset operation is forcibly executed on the precision control partition via the safety microkernel.
[0010] Preferably, the collaborative control system also includes an independent actuator status feedback channel, which is connected to an independent safety input / output (I / O) channel of the emergency response zone; the emergency response zone is also used to receive actuator status signals reflecting the actual working status of the actuators via the independent actuator status feedback channel; rule three of the emergency response zone further includes: when the control intent data is in a safe state but the actuator status signal is in a non-safe state, a hardware-level veto or reset operation of the precision control zone is also enforced via the safety microkernel.
[0011] Preferably, the precision control partition also includes a fault self-diagnosis module. When a non-fatal functional fault of the precision control partition itself is detected, the fault self-diagnosis module causes the precision control partition to write a degraded operation request code to the shared memory area. The emergency response partition is also used to respond to the request when the degraded operation request code is detected. First, it performs a hardware-level veto or reset operation on the precision control partition to take over all control. Then, it uses its own independent safe input / output (I / O) channel to execute a safe degraded operation procedure stored in the emergency response partition. The safe degraded operation procedure includes running at a safe low speed to a preset level position.
[0012] Preferably, the emergency response safety logic of the emergency response zone also includes a fault accumulation and tolerance module on the trigger path of the hardware-level rejection or reset operation. The fault accumulation and tolerance module is used to start a fault accumulation process when an original fault signal is detected for the first time. The original fault signal is either a logical conflict state as determined by rule one or a heartbeat signal that has not been dynamically updated within a preset time stored in the emergency response zone as determined by rule two. The hardware-level rejection or reset operation is only allowed to be finally executed when the original fault signal persists and exceeds a tolerance window stored in the emergency response zone.
[0013] Preferably, the single high-integrity hardware controller platform also includes a test signal injection circuit coupled to an independent safety input / output (I / O) channel of the emergency response zone; the emergency response zone is also used to: activate the test signal injection circuit to inject a reference test signal into the independent safety input / output (I / O) channel when the coordinated control system is determined to be in a non-operational safe state of cage safety station; compare the signal read by the emergency response zone through the independent safety input / output (I / O) channel with the reference test signal; and when the read signal and the reference test signal are inconsistent, determine that the independent safety input / output (I / O) channel of the emergency response zone itself has failed, and also force a hardware-level rejection or reset operation on the precision control zone via the safety microkernel.
[0014] Preferably, the fault accumulation and tolerance module is further configured to: store the continuous faults within the tolerance window corresponding to the faults stored in the emergency response partition. The number of times the original fault signal is detected within each scan cycle. Perform cumulative counting; where A preset integer greater than or equal to 1 stored in the emergency response partition; the condition under which the fault accumulation and tolerance module allows hardware-level negative or reset operations to be ultimately executed is... ;in Less than or equal to stored in the emergency response partition And a preset trigger threshold greater than or equal to 1.
[0015] Preferably, strong logical isolation includes a one-way communication mechanism enforced by a secure microkernel, which only allows the precision control partition to write data to the emergency response partition and prohibits the emergency response partition from writing any data to the precision control partition.
[0016] Preferably, the hardware-level veto or reset operation performed by the emergency response partition on the precision control partition is enforced via the secure microkernel without any software cooperation or permission from the precision control partition.
[0017] Preferably, a single, high-integrity hardware controller platform employs a physical redundancy architecture.
[0018] Preferably, the precision control zone is used to run the precision positioning and speed control logic, and the data it relies on includes data from one or more precision positioning sensors; the emergency response zone is used to acquire independent sensor data, and the independent sensor data comes from a safety sensor that is independent of one or more precision positioning sensors.
[0019] Compared with the prior art, the beneficial effects of the present invention are:
[0020] 1. By adopting a single high-integrity hardware controller platform and forcibly dividing it into a precision control zone and an emergency response zone with strong logical isolation, a novel control system architecture is constructed. The emergency response zone is not only equipped with an independent safety input / output channel that directly reaches the physical actuator, but its safety logic is also configured to simultaneously output an emergency response command to the outside and perform a hardware-level veto or reset operation on the precision control zone via the safety microkernel when triggered. This control mechanism, which enforces braking and reset simultaneously, avoids the possibility of logical conflict or competition between the two control wills at the system architecture level. It avoids the logical dangling risk that inevitably exists in the traditional dual-physical system when control is handed over, and keeps the system state under a single, definite control logic.
[0021] 2. The emergency response partition constructed in this invention possesses a dual supervision mechanism that spans both the logical and physical layers. On the one hand, it monitors the heartbeat signal of the dynamic updates written to the shared memory by the precision control partition to determine in real time whether there is a logical freeze or computational crash. On the other hand, it also directly obtains the actuator status signal reflecting the actual working state of the physical actuator through an independent actuator status feedback channel. This control method, which unifies logical liveness monitoring and physical fidelity monitoring, enables the security logic of the emergency response partition to simultaneously cover the failure of the control intention and the state betrayal of the physical execution, thereby constructing a closed-loop integrity verification from the control command to the physical execution.
[0022] 3. The control system architecture of this invention, in its safety logic execution mechanism, simultaneously constructs external resilience and internal self-checking. Firstly, it sets up a fault accumulation and tolerance module on the trigger path of the hardware veto operation, which can filter out self-recoverable logic blockages caused by transient electromagnetic interference through a preset tolerance window, avoiding unnecessary veto storms. Secondly, it utilizes the interval when the system is in an absolutely safe and static state to activate the test signal injection circuit, and actively excites and responds to verify the independent safety input and output channels of the emergency response zone itself. This collaborative mechanism of external tolerance and internal self-verification ensures that the safety foundation of the system can resist general external interference and periodically confirm its own absolute reliability. Attached Figure Description
[0023] Figure 1 This is a flowchart of the collaborative rules and security veto logic of the collaborative control system of the present invention;
[0024] Figure 2 This is a safety response speed curve under logical conflict failure of the present invention;
[0025] Figure 3 This is a schematic diagram of the partitioned hardware architecture and I / O loop for collaborative control of the present invention. Detailed Implementation
[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are only some embodiments of this invention, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0027] This invention provides a collaborative control system for precise positioning and emergency response of mine hoisting cages. This system architecture is built on a single, highly complete hardware controller platform. The platform can employ a physically redundant architecture, such as a dual-CPU 1002 configuration (either / or), to meet the high availability requirements of industrial safety control. The core of this system is a secure microkernel running within it. This secure microkernel can be a certified, simplified low-level system software that acquires hardware management privileges upon controller platform startup. The primary function of the secure microkernel is to perform resource partitioning, dividing the hardware resources of the single controller platform, such as CPU time slices and memory address space, into two or more logical partitions, including at least one precision control partition and one emergency response partition. Another function of the secure microkernel is to ensure strong logical isolation between these partitions. This isolation is achieved through a one-way communication mechanism executed by the microkernel at the hardware level. Specifically, this mechanism involves establishing a dedicated shared memory region and setting asymmetric access permissions, allowing only the precision control partition to perform write operations to this shared memory region, while the emergency response partition... The trusted partition can only perform read operations on it, and the emergency response partition is prohibited from writing any data to the precision control partition, thereby preventing the trusted partition from being contaminated by data from the untrusted partition at the control system level. The precision control partition, as the system's untrusted partition, is used to run complex, potentially frequently iterative, precision positioning and speed control logic. For example, this partition can execute multi-sensor fusion algorithms or V / F curve speed control algorithms for frequency converters based on data from one or more precision positioning sensors, such as high-line-count encoders and laser rangefinders. To achieve coordination with the emergency response partition, the precision control partition... In each control loop, such as a 10ms control cycle, two types of data must be written to a specified address in the shared memory region: the first is control intent data reflecting its decision, which can be a data structure containing fields such as {target speed: 5.2m / s, target position: 205.6m, control command: accelerate}; the second is a dynamically updated heartbeat signal reflecting its survival status, which can be a cyclically incrementing 32-bit integer counter. The precision control partition only increments this counter at the end of the control loop after all its logical operations have been completed normally.
[0028] To ensure consistency in data parsing between the precision control partition and the emergency response partition in the shared memory region, the system executes an interface contract solidification procedure during initialization. Specifically, the security microkernel retrieves a predefined data structure template describing control intent from the protected memory of the emergency response partition. This template explicitly defines the type, length, and physical meaning of each data field in the shared memory using byte alignment. The security microkernel grants read-only access to this template to the precision control partition. The precision control partition must write data according to this template format in its software logic, and the emergency response partition also reads and parses data according to this template. This mechanism ensures that algorithmic updates in the precision control partition do not cause the emergency response partition to fail in parsing its control intent. The emergency response partition, as the system's trusted partition, is only used to run simplified, verified emergency response security logic. To ensure its decision-making independence, the emergency response partition has its own dedicated, physically independent secure input / output (I / O) channel, which is not shared with the precision control partition. The O channel is used to connect a safety sensor independent of the aforementioned precision positioning sensor, such as a safety encoder that meets safety level certification, and is used to acquire independent current speed and position information of the cage. The core operating mechanism of the control system of this invention lies in the emergency response zone setting and executing a set of collaborative operating rules through its internally fixed emergency response safety logic. In each scan cycle, this safety logic first reads the control intent data and heartbeat signal of the precision control zone from the shared memory area, and reads independent sensor data from its dedicated I / O channel. Subsequently, the safety logic executes the rule judgment, which is based on a safety rule pre-stored in the trust memory of the emergency response zone. This safety rule can be a safety model that defines the maximum allowable speed of each section of the shaft. The judgment process involves substituting the read control intent data and independent sensor data into the safety rule for cross-validation. For example, when the independent sensor data shows that the cage has entered the terminal deceleration zone, such as a position greater than 800m, but the target speed in the control intent data is still 5.0m / s, this speed exceeds the 2 allowed by the safety rule of this area.If the heartbeat speed is 0 m / s, it is determined that the two are in a logical conflict state. Simultaneously, the security logic executes Rule Two's monitoring, which can be implemented through an internal timer. After reading the heartbeat signal, the security logic compares it with the value of the previous cycle. If the heartbeat signal does not dynamically update within a preset time, such as 100 ms (i.e., the value does not change), it is determined that the precision control partition is in a frozen or crashed state. Finally, the security logic executes Rule Three's ruling. When the result of Rule One is a logical conflict, or the monitoring result of Rule Two is a heartbeat timeout, if either condition is met, the emergency response partition will immediately perform a dual action: on the one hand, it sends a braking command to the physical brake through its dedicated secure I / O channel; on the other hand, it simultaneously sends a hardware-level veto or reset operation to the precision control partition's CPU hardware via the secure microkernel. This operation is executed through the secure microkernel, without requiring software cooperation from the precision control partition, thus avoiding control conflicts in the architecture.
[0029] In one specific implementation, to address risks at the physical execution layer, the collaborative control system also includes an independent actuator status feedback channel. This channel uses the actual output current or actual output frequency signal of a critical actuator, such as the VVF of a frequency converter, as the actuator status signal and connects it to the independent safety I / O channel of the emergency response zone. Correspondingly, the rule three safety logic of the emergency response zone is further extended: when the control intent data is in a safe state (e.g., {target torque: 0 Nm}), but the actual current feedback from the actuator status signal is in an unsafe state, such as greater than 5A, indicating that the frequency converter power transistor is still outputting despite breakdown, the emergency response zone also determines that there is an execution layer risk and performs a hardware-level rejection or reset operation. In another specific implementation, to address rejection storms caused by transient interference (such as EMI) in the control system, the emergency response safety logic of the emergency response zone also includes a fault accumulation and tolerance module on the trigger path of its hardware-level rejection operation. This module is used to perform time integration processing on the original fault signal, i.e., the logical conflict determined by rule one or the heartbeat timeout detected by rule two. Its specific implementation can be: setting a tolerance window, for example... Each scan cycle, and a trigger threshold is set. When the original fault signal is detected for the first time, the module only starts one fault accumulation counter. And make it It was not immediately rejected; in subsequent... If the signal persists within a given period, then Value accumulation; only when (i.e., the fault occurs a total of 3 times within 10 cycles), or the original fault signal persists for more than the tolerance window. (For example, if a fault is detected for 10 consecutive cycles), the hardware-level veto operation is allowed to be finally executed; if the fault occurs... achieve If the previous event disappeared (indicating a transient disturbance), then the counter... The system was reset to zero, thus avoiding unnecessary downtime.
[0030] In another specific implementation, to address the issue of silent failure of the emergency response zone's own I / O channels, the single high-integrity hardware controller platform also includes a test signal injection circuit coupled to the emergency response zone's independent safety I / O channel (e.g., the input port of a safety encoder). The emergency response zone also performs self-test logic: first, it internally determines whether the system is in a safe, stationary, non-operational state, such as the cage being docked and the brakes applied. Upon confirmation of safety, the emergency response zone activates the test signal injection circuit, which physically disconnects from the external safety encoder and injects an internally generated, known reference test signal, such as a 100kHz pulse simulating a 5m / s velocity signal, into the emergency response zone's I / O input. The core logic of the emergency response zone then compares the read signal with the reference test signal. If they are inconsistent, for example, if the read signal is still 0Hz, it indicates that the I / O channel has failed or is stuck. The emergency response zone then determines that its own safety channel has failed and triggers a hardware-level rejection operation on the precision control zone, causing the entire system to enter a safety lockout state. Since the current partition can no longer reliably monitor the precision control partition, in another specific implementation, to address the pain point of unnecessary downtime in operation and maintenance, the system can construct a fault-operation mechanism. The precision control partition also includes a fault self-diagnosis module. When this module detects a non-fatal functional failure of the precision control partition itself, such as data loss of the precision positioning laser sensor due to dust obstruction, but the precision control partition's CPU is still running healthily, the precision control partition's logic is used to actively write a specific degraded operation request code to the shared memory area. When the emergency response partition's security logic detects this degraded operation request code, it will perform a tiered arbitration: it first responds to the request, performs a hardware-level veto operation on the precision control partition to take over control, ensuring that the precision control partition is stripped of control. However, immediately afterward, the emergency response partition does not trigger full emergency braking, but instead uses its own independent safety I / O channel (i.e., its independent safety encoder) to execute a preset safety degraded operation procedure instead. This procedure is a simplified control logic, for example, running at a safe low speed of 1.0 m / s to the nearest preset leveling position, then stopping and applying the brakes.
[0031] Example 1: In a mine hoisting cage descending to the middle of the shaft at a rated speed of 8 m / s, the precision control zone continuously writes control intent data to the shared memory area based on the input from its precision positioning sensors. This data represents the target speed as 8 m / s, and simultaneously updates its heartbeat signal dynamically. At this time, the emergency response zone, through its independent safety I / O channel, also displays a speed of 8 m / s from its independent sensor data. Its internal safety rules determine that the control intent and the independent sensor data are not in a logical conflict state, and the heartbeat signal monitoring is normal, so the system continues to run. At a certain moment, the precision control zone experiences a memory overflow due to its internal algorithm, causing its execution logic to freeze, i.e., silent failure. At the instant of this failure, the data written to the shared memory area remains in the valid state of the last frame, i.e., the control intent data remains at the speed of 8 m / s, and the heartbeat signal also stops dynamically updating.
[0032] The system then enters a state of silent failure: the cage continues to descend at a speed of 8 m / s under the influence of physical inertia and gravity, and begins to enter the preset deceleration zone at the end of the shaft. The precision control zone has stopped responding and cannot update its control intent. For a traditional dual-system architecture that relies solely on logic comparison, the control intent (8 m / s) read by the safety system is consistent with the actual speed (8 m / s) monitored by its independent sensors, thus not triggering the safety logic. Under the collaborative control system architecture of this invention, the safety logic of the emergency response zone is triggered simultaneously in the following scan cycle by two monitoring rules: First, the emergency response zone learns from its independent sensor data that the cage has entered the deceleration zone, and its safety rules determine that the zone is permissible. The speed should be less than 4 m / s, but the control intent data read from shared memory is still at 8 m / s. Therefore, rule one of the emergency response partition is triggered, and the system is determined to be in a logical conflict state. Secondly, the heartbeat monitoring timer inside the emergency response partition does not detect a dynamic update of the heartbeat signal within the preset 100ms time, so rule two is triggered, and the precision control partition is determined to be invalid. Since both rule two and rule three are met, rule three of the emergency response partition is executed immediately. The emergency response partition does not depend on any state of the precision control partition, but through the security microkernel, it forcibly performs a hardware-level veto or reset operation on the precision control partition, and at the same time outputs braking commands to the actuator through its independent I / O channel.
[0033] Example 2: This example objectively verifies the deterministic response of the collaborative control system implemented in the specific embodiment compared to the traditional physically isolated dual-system architecture when facing two typical control system failure conditions in mine hoisting control. The test platform is constructed using hardware-in-the-loop simulation, which includes a real-time simulation unit and a controller hardware test bench. The real-time simulation unit is used to run physical models of the mine hoisting cage, motor drive, and shaft environment. The model is solved in 1ms increments and is used to simulate the signal outputs of precision positioning sensors and independent safety sensors. The controller hardware test bench is used to install the control system under test. Two groups of test objects are set up: one is the control group, which adopts the physically isolated dual-system architecture of the background technology, i.e., a precision control PLC and an emergency braking safety PLC coexist, and the two communicate through the industrial Ethernet protocol; the other is the sample group of this invention, which adopts a collaborative control system built on a single high-integrity hardware controller platform, which has internally partitioned and strongly isolated the precision control partition and the emergency response partition through a secure microkernel.
[0034] During the experiment, two preset fault signals were injected into the two groups of tested objects: Fault 1, namely logical conflict, when the cage descends into the terminal deceleration zone, the simulation unit simulates the precision positioning sensor experiencing data drift, causing it to output an incorrect position signal indicating that the cage is still in the middle high-speed zone, while the independent safety sensor still outputs the correct position signal; Fault 2, namely silent failure, when the cage is running at high speed, the simulation unit simulates the CPU of the precision control PLC (control group) or precision control partition (sample group of this invention) experiencing a dead loop, causing its logic operation to freeze and stop external communication and data updates; In the experiment, for the emergency response partition of the sample group of this invention, the preset time for monitoring the heartbeat signal under rule 2 was set to 100ms; for the safety PLC of the control group, the monitoring time for communication timeout was also set to 100ms; The experiment recorded the response time required for both groups of objects after receiving the fault injection until the system entered a deterministic safety state, i.e., the emergency braking was executed, as well as their final system state. Specific experimental data are shown in Table 1.
[0035] Table 1: Comparison of Fault Response Tests for Different Control System Architectures
[0036]
[0037] Experimental data shows that when the control group faced fault one, a cognitive conflict arose between its two independent controllers. The precision control PLC attempted to maintain high speed, while the safety PLC attempted to brake. The communication arbitration mechanism they relied on resulted in a response delay of 785.4ms, leaving the system in an uncertain state for an extended period. When facing fault two, the safety PLC in the control group could only monitor the control intent of the precision control PLC but not its survivability. Consequently, after the precision control PLC's logic froze, it failed to trigger any safety response, and the system entered a state of continuous dangerous operation. When facing fault one, the emergency response partition of this invention, through rule one, determined within 42.6ms that the control intent and independent sensor data were in a logical conflict state and immediately executed a hardware-level veto without communication arbitration. When facing fault two, its emergency response partition, through rule two, determined that the heartbeat signal had timed out 104.3ms after the preset 100ms timeout, i.e., a scan cycle delay, and similarly triggered a hardware-level veto.
[0038] Example 3: The test platform in this example uses the Hardware-in-the-Loop (HIL) simulation platform of Example 2. Two groups of test objects are set up: a control group and the sample group of this invention. Both groups use a collaborative control system built on a single high-integrity hardware controller platform as described in the specific implementation, and both internally divide the system into a precision control zone and an emergency response zone. The only difference between the two test objects is that the safety logic of the emergency response zone in the control group is instantaneously triggered for determining heartbeat timeout or logic conflict, i.e., it does not have the fault accumulation and tolerance module of the specific implementation; the emergency response zone of the sample group of this invention has a fault accumulation and tolerance module installed, and its tolerance window is adjusted according to the specific implementation. Set to 10 scan cycles, corresponding to 100ms, trigger threshold. The test was set to run 3 times. The test process simulated the cage running continuously for 60 minutes in the middle section of the shaft. During this period, the simulation unit injected 6 independent transient EMI pulse interference signals, each with a duration of less than 20ms, into the controller. This interference signal was used to simulate the objective interference that caused the heartbeat signal of the precision control zone to have a single cycle, i.e., 10ms, and to cause a pause under field conditions. The test recorded the number of unnecessary shutdowns and the total operational availability of the two systems during the 60-minute test cycle. The test results are shown in Table 2.
[0039] Table 2: Comparison of anti-interference tests for fault accumulation and tolerance modules
[0040]
[0041] Experimental data shows that the emergency response partition of the control group, due to its instantaneously triggered safety logic, judged every transient, self-recoverable heartbeat pause as a permanent silent failure, triggering 6 unnecessary hardware-level rejections and shutdowns. Each shutdown and reset process consumed approximately 1.75 minutes, resulting in a decrease in overall operational availability. The fault accumulation and tolerance module of this invention, upon detecting a single-cycle original fault signal, accumulates a fault count. Only 1, the trigger threshold has not been reached. In the next scan cycle, the heartbeat signal of the precision control zone returns to normal, and the module counter... The status was reset to zero; the module filtered out all transient disturbances with a duration less than the tolerance window, and no unnecessary downtime occurred (99.8% availability was included in regular maintenance time).
[0042] Example 4: This example combines Figures 1 to 3 A description of the collaborative control system for precise positioning and emergency response of mine hoisting cages, such as... Figure 1 As shown, precision positioning sensors, such as high-line-count encoders, input data to the precision control partition. After running the precision positioning and speed control logic, this partition outputs control commands to actuators such as VVFs and writes its 1. control intent data and 2. dynamic heartbeat signals to the shared memory area. The emergency response partition is equipped with an independent safety I / O channel. When running the emergency response safety logic, it reads data from the shared memory area and simultaneously receives independent sensor data from independent safety sensors such as safety encoders and feedback signals from independent actuator status feedback channels. Based on the above information, the emergency response partition executes collaborative operation rule judgments, specifically including rule 1: whether the logic conflicts, rule 2: whether the heartbeat times out, and rule 3: whether the execution betrays the rules. When the judgment result is normal, the system continues to run. When any condition is met and a fault is determined, the fault signal will first be sent to the fault accumulation and tolerance module. This module is used to filter transient interference, avoid unnecessary rejection, and after confirming a permanent fault, triggers the safety microkernel, which is responsible for dividing the partition and performing strong isolation to enforce hardware-level rejection or reset operations on the precision control partition.
[0043] like Figure 2As shown, the horizontal axis represents time (ms) and the vertical axis represents velocity (m / s). The control intention velocity remains at 8 m / s from 0 to 190 ms. The safety rule allows the velocity to decrease from 8 m / s to 4 m / s at t=100 ms and remain at this 4 m / s limit. The independent sensor velocity remains at 8 m / s before t=100 ms, then begins to decrease, reaching 0 m / s at 190 ms. This graph clearly reveals a conflict between the control intention velocity of 8 m / s and the safety rule-permitted velocity of 4 m / s after 100 ms. Figure 3 As shown, the system mainly includes field sensing devices, a single high-integrity hardware controller platform, and a shaft actuator. The field sensing devices include precision positioning sensors and independent safety sensors, which provide inputs to the precision control partition and emergency response partition within the controller platform, respectively. The single high-integrity hardware controller platform can adopt a physical redundancy architecture. Internally, a secure microkernel is responsible for resource partitioning and strong isolation to divide the precision control partition and the emergency response partition. Data from the precision control partition is unidirectionally transmitted to the emergency response partition through a shared memory area. On the output side, the precision control partition sends precision speed control commands to the frequency converter in the shaft actuator, while the emergency response partition sends emergency braking commands to the physical brake. In addition, the system also includes an independent actuator status feedback channel to feed back the actual status of the frequency converter to the emergency response partition, and a test signal injection circuit is coupled to the independent safe input path of the emergency response partition to perform injection / comparison self-test operations.
[0044] Example 5: This example illustrates a reproducible engineering calibration procedure for determining key control parameters and safety models for emergency response zones in a collaborative control system, eliminating uncertainties in parameter settings. This procedure is executed during the commissioning phase of a single high-integrity hardware controller platform deployed on a mine hoisting system. First, a safety model for rule-based decision-making in the emergency response zone is constructed and solidified. This model is implemented in engineering as a one-dimensional lookup table. The lookup table uses the cage position indicated by independent sensor data (e.g., downward displacement from the wellhead) as the input index and the maximum permissible safe speed corresponding to that position as the output value. The table is constructed based on the mine's existing safety regulations, for example: {Index: 0m to 800m (mid-section), Output value: 8.0m / s}, {Index: 800m to 950m (deceleration zone), Output value: 4.0m / s}, {Index: 950m to 1000m (creep zone), Output value: 1.0m / s}. This lookup table is stored in the emergency response zone's... The system is protected in trusted memory; secondly, the emergency response partition is calibrated for a preset time to monitor the heartbeat signal under Rule 2; the calibration of this parameter balances the two control requirements of avoiding misjudgment and rapid response; the calibration steps are as follows: First, load all the complex positioning and speed control logic of the precision control partition, and apply the maximum computational load to it on the hardware-in-the-loop simulation platform, for example, simulating simultaneous input from all sensors and executing the most complex coordinate transformation and filtering algorithms; second, run 10,000 control cycles continuously, monitor and record its longest single control cycle execution time (WCET); in this calibration, the measured WCET is 65.8ms; third, add a safety margin (e.g., 50%) to the WCET to cope with occasional system scheduling jitter, resulting in 98.7ms; based on this, the preset time is determined in engineering to be a normalized value greater than 98.7ms, i.e., 100ms; this setting allows the precision control partition to have enough time to update the heartbeat even under worst conditions, while limiting the maximum response delay of the system to silent failures.
[0045] Finally, the parameters of the fault accumulation and tolerance module are calibrated. (Tolerance Window) and (Trigger threshold); This calibration balances the conflict between combating transient interference and responding to permanent faults; The calibration steps are as follows: First, on the hardware-in-the-loop simulation platform, inject a transient EMI interference model commonly found in industrial settings into the controller. This interference causes single or double occurrences in the precision control zone. or The heartbeat signal update failed; the second step is to set up a set of... Values (e.g.) Each cycle corresponds to 100ms), and different tests are performed. Value; experimental data show that when or At that time, the system cannot filter the above. or Transient interference can cause unnecessary shutdowns; when At that time, the system can filter all The transient disturbance; the third step is to inject a permanent fault model (i.e., continuous freezing of the precision control partition); experimental data show that, Under the window settings, Available A veto is triggered after a continuous failure (i.e., 3 cycles), and this response time is acceptable for the control system; after comprehensive consideration, the following is determined: and The combination forms a set of calibration parameters that balance toughness and sensitivity.
[0046] Example 6: This example illustrates the operating mechanism of a cooperative control system with an added independent actuator status feedback channel in the face of control execution failure. In this system, the independent safety I / O channel of the emergency response zone is also connected to the actual output current feedback terminal of the frequency converter (VVF) to obtain the actuator status signal. In a situation where a cage decelerates and approaches the target leveling position, the speed regulation logic of the precision control zone (UP) writes control intent data, {target torque: 0 Nm}, to the shared memory area in its control loop, indicating that its intent is to safely stop the cage at the leveling position. At this time, its heartbeat signal is dynamically updated; at this moment, a power transistor of the frequency converter (VVF) suffers a physical breakdown fault, causing it to betray the zero torque intention of the precision control zone and still output a dangerous drive current to the motor, which is enough to cause the cage to overshoot; under this condition, the emergency response zone (TP) executes its normal safety logic judgment: rule one (logic conflict) is not triggered because the control intention (0 torque) of the precision control zone is not logically conflicted with its independent sensor data (cage close to 0 speed); rule two (heartbeat timeout) is also not triggered because the precision control zone itself is operating normally.
[0047] However, the extended safety logic of the Emergency Response Zone (TP), namely the further inclusion of Rule 3 in the specific implementation, is triggered: the TP reads the actuator status signal through its independent actuator status feedback channel, which shows that the actual output current is 30A, indicating an unsafe state; the TP's safety logic determines that the control intent data indicates a safe state, which contradicts the actuator status signal indicating an unsafe state; the Emergency Response Zone (TP) immediately determines that the system is in a dangerous state of execution betrayal, and similarly through the safety microkernel, forces a hardware-level veto operation on the precision control zone, and simultaneously triggers physical braking through its independent I / O channel, thereby providing final safety assurance at the physical execution level of control.
[0048] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.
[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.
Claims
1. A collaborative control system for precise positioning and emergency response of mine hoisting cages, built on a single high-integrity hardware controller platform, characterized in that, The collaborative control system includes a secure microkernel, a precision control partition, an emergency response partition, and a shared memory region. A secure microkernel is used to divide the hardware resources of a single high-integrity hardware controller platform into a precision control partition and an emergency response partition, and to ensure strong logical isolation between the precision control partition and the emergency response partition. The precision control partition is used to run precision positioning and speed control logic, and in each control cycle, it writes its control intent data and dynamically updated heartbeat signals to the shared memory area. The emergency response partition is used to run emergency response safety logic and is configured with independent safety input / output I / O channels for acquiring independent sensor data. The emergency response partition also uses its emergency response safety logic to simultaneously set and execute the following collaborative operation rules: Rule 1: Based on a safety rule stored in the emergency response partition, determine whether the independent sensor data and control intent data are in a logical conflict state; Rule 2: Monitor the heartbeat signal in the shared memory area; Rule 3: When the rule's determination result is a logical conflict state, or when the monitoring result of Rule 2 is that the heartbeat signal has not been dynamically updated within a preset time stored in the emergency response partition, a hardware-level rejection or reset operation is forcibly executed on the precision control partition via the safety microkernel. In addition, the emergency response security logic of the emergency response zone also includes a fault accumulation and tolerance module in the trigger path of the hardware-level rejection or reset operation. The fault accumulation and tolerance module is used to initiate a fault accumulation process when a raw fault signal is detected for the first time. The raw fault signal is either a logical conflict state as determined by Rule 1 or a heartbeat signal that has not been dynamically updated within a preset time stored in the emergency response partition as determined by Rule 2. Hardware-level rejection or reset operations are only allowed to be finally executed when the raw fault signal persists and exceeds a tolerance window stored in the emergency response partition.
2. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, The collaborative control system also includes an independent actuator status feedback channel, which is connected to the independent safety input / output I / O channel of the emergency response zone. The emergency response zone is also used to receive actuator status signals that reflect the actual working status of the actuators via the independent actuator status feedback channel. Rule 3 of the emergency response zone further includes: when the control intent data is in a safe state but the actuator status signal is in a non-safe state, a hardware-level veto or reset operation is enforced on the precision control zone via the safety microkernel.
3. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, The precision control partition also includes a fault self-diagnosis module, which is used to write a degraded operation request code to the shared memory area when a non-fatal functional fault of the precision control partition itself is detected. The emergency response zone is also used to respond to requests when a degraded operation request code is detected. It first performs a hardware-level veto or reset operation on the precision control zone to take over full control. It then utilizes its own independent safety input / output I / O channels to execute a safety degradation operation procedure stored in the emergency response partition. The safety degradation operation procedure includes running at a safe low speed to the preset level position.
4. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, The single high-integrity hardware controller platform also includes a test signal injection circuit coupled to an independent safety input / output I / O channel of the emergency response zone; the emergency response zone is also used to: activate the test signal injection circuit to inject a reference test signal into the independent safety input / output I / O channel when the coordinated control system is determined to be in a non-operational safety state where the cage is safely stationary; and compare the signal read by the emergency response zone through the independent safety input / output I / O channel with the reference test signal; When the read signal is inconsistent with the benchmark test signal, the independent safety input / output I / O channel of the emergency response partition is determined to be faulty, and the hardware-level rejection or reset operation of the precision control partition is forcibly executed through the safety microkernel.
5. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, The fault accumulation and tolerance module is also used for: the continuous fault accumulation and tolerance corresponding to the tolerance window stored in the emergency response partition. Within each scan cycle, the number k of times the original fault signal is detected is cumulatively counted; where The value is a preset integer greater than or equal to 1 stored in the emergency response partition; the condition for the fault accumulation and tolerance module to allow the hardware-level veto or reset operation to be finally executed is k≥K; where K is a preset integer less than or equal to 1 stored in the emergency response partition. And a preset trigger threshold greater than or equal to 1.
6. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, Strong logical isolation includes a one-way communication mechanism enforced by a secure microkernel, which only allows the precision control partition to write data to the emergency response partition and prohibits the emergency response partition from writing any data to the precision control partition.
7. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, The hardware-level veto or reset operations performed by the emergency response partition on the precision control partition are enforced via the secure microkernel without any software cooperation or permission from the precision control partition.
8. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, A single, high-integrity hardware controller platform employs a physically redundant architecture.
9. The collaborative control system for precise positioning and emergency response of a mine hoisting cage according to claim 1, characterized in that, The precision control zone is used when running precision positioning and speed control logic, and the data it relies on includes data from one or more precision positioning sensors; the emergency response zone is used when acquiring independent sensor data, and the independent sensor data comes from a safety sensor that is independent of one or more precision positioning sensors.