A safety self-locking control system for tailrace maintenance operations

Abstract

This invention relates to the field of industrial automatic control system device manufacturing technology, and discloses a safety self-locking state control system for tailrace maintenance operations, comprising: a multi-source heterogeneous signal acquisition unit for acquiring displacement, load, and environmental pressure signals of the controlled object; a logic verification controller for performing multi-dimensional state timing operations on the acquired signals based on zero-potential energy verification logic; and a physical blocking unit connected in series in the drive circuit. This invention utilizes the exponential decay and convergence characteristics of environmental pressure signals to construct zero-potential energy verification logic, solving the problem that static position detection cannot identify sensor dead values ​​or physical leaks; it uses environmental perturbation decoupling verification logic to use external water level fluctuations as detection excitation to achieve dynamic diagnosis of hidden seal failures; and it eliminates hidden faults of actuator contact welding through XOR verification of eccentric potential monitoring and physical blocking, improving the inherent safety and system stability of confined space maintenance operations.

Description

Technical Field

[0001] This invention relates to a safety self-locking state control system for tailrace maintenance operations, belonging to the field of industrial automatic control system device manufacturing technology. Background Technology

[0002] Currently, safety isolation during maintenance of the tailrace pipe of a hydro-generator unit typically employs a combination of mechanical limit switches and manual tagging and locking. The control system collects signals from the limit switches of the gate hydraulic cylinders or winches to determine whether the gate has reached the fully closed position. Once the limit switches are activated, the system recognizes that maintenance is possible. Maintenance personnel hang "Do Not Operate" signs on their work consoles or attach mechanical locks to the electrical cabinets to achieve safety interlocking at the management level. Based on position feedback control logic, the discrete signals from the limit switches represent the physical isolation status, and ideally, this meets basic safety isolation requirements.

[0003] However, the confined space environment of the tailrace pipe with high sediment deposition and strong pressure pulsation, relying solely on limit switches to characterize the safety status has inherent logical flaws. Limit switches only reflect the geometric position of the actuator and cannot characterize the actual isolation capability of the gate against the medium energy. For example, the utility model patent CN206032994U discloses a freight elevator roller shutter door that uses limit switches for safety limiting. Although it introduces a gravity sensing device in conjunction with the top limit switch to define the upper and lower limits and uses physical contact signals to confirm the closed state, it still does not escape the single logic category based on position or contact feedback. If the gate does not completely sink to the bottom due to sediment accumulation or the sealing strip is damaged, resulting in serious internal leakage, the limit switch may show that it is fully closed due to jamming or debugging errors. This may cause the control system to mistakenly open the maintenance permission when there is still high pressure water behind the gate. Existing self-locking mechanisms are mostly single-point cut-off of electrical circuits and lack forced logical locking based on physical energy status. When encountering strong electromagnetic interference from control system logic reset or human error, tailrace backflow accidents are easily caused.

[0004] Therefore, the technical problem to be solved by this invention is how to construct a control system that comprehensively verifies the mechanical positioning, unloading, and energy return to zero state without relying on a single position signal, and has a self-checking function for the integrity of the execution loop, thus solving the problem of decoupling state representation from physical substance under complex working conditions in the prior art. Summary of the Invention

[0005] To address the problems mentioned in the background art, the technical solution of the present invention is as follows: A safety self-locking state control system for tailrace maintenance operations, comprising: A multi-source heterogeneous signal acquisition unit is used to acquire in real time the mechanical displacement signal of the controlled object, the load status signal of the drive mechanism, and the environmental pressure signal inside the controlled space. The logic verification controller is connected to a multi-source heterogeneous signal acquisition unit and is pre-set with zero potential energy verification logic and dynamic trajectory correlation verification logic. The zero potential energy verification logic is used to perform multi-dimensional state timing calculations. When the mechanical displacement signal indicates that the machine is closed, the load status signal indicates that the power is unloaded, and the environmental pressure signal shows an exponential decay and converges to the atmospheric pressure reference range within a preset time sequence, a safe positioning flag is generated. The dynamic trajectory association verification logic stores the displacement and pressure association reference curve of the controlled object during the standard closing process. It is used to calculate the actual correlation characteristics of the mechanical displacement signal and the environmental pressure signal in real time during the closing action of the controlled object. When the deviation between the actual correlation characteristics and the association reference curve exceeds the preset dynamic tolerance band, a process abnormality blocking command is generated to prevent the generation of the safe positioning flag. The self-locking control execution unit, in response to the safety in place flag, outputs a self-locking enable command and enters a logical deadlock state that masks all control inputs except for the unlock command. The physical blocking unit is connected in series in the power transmission circuit of the drive mechanism. It operates in response to the self-locking enable command and physically cuts off the energy input channel of the drive mechanism.

[0006] Preferably, the multi-source heterogeneous signal acquisition unit is also used to acquire water level fluctuation signals outside the controlled space, and the logic verification controller is also configured with environmental perturbation decoupling verification logic; the environmental perturbation decoupling verification logic is used to continuously extract the time-domain fluctuation characteristics of the environmental pressure signal and the water level fluctuation signal within the sliding time window after the safe positioning flag is generated, and calculate the cross-correlation coefficient between the two according to the following formula. : ,in, For the environmental pressure signal in the first The value of each sampling point Let it be its mean over the sliding time window. For the water level fluctuation signal at the first The value of each sampling point Let it be its mean over the sliding time window. The total number of sampling points; when the cross-correlation number When the absolute value exceeds the preset coupling threshold, the logic verification controller determines that the controlled object's seal has failed and cancels the safety positioning flag.

[0007] Preferably, the signal output terminal of the physical blocking unit is provided with a potential monitoring circuit, which is connected to the logic verification controller. The logic verification controller is configured with execution integrity verification logic, which is used to monitor the voltage status of the potential monitoring circuit in real time and perform XOR logic verification when the self-locking control execution unit outputs a self-locking enable command. When the self-locking enable command is in a valid output state and the potential monitoring circuit detects a voltage signal, the execution integrity verification logic determines that the physical blocking unit has a contact sticking fault and triggers the disconnection command of the upper-level power supply.

[0008] Preferably, the system is also connected to a pressure relief actuator for connecting the controlled space with the external environment; the logic verification controller is configured with a perturbation response active diagnostic logic, which is used to send a short-time pulse start command to the pressure relief actuator at a preset cycle to apply negative pressure excitation during the period when the safety position mark is maintained; the logic verification controller collects the transient response waveform of the environmental pressure signal to the short-time pulse start command, and determines that there is a medium leakage in the controlled object when the pressure recovery rate of the transient response waveform exceeds the preset water replenishment model threshold.

[0009] Preferably, the logic verification controller further includes a parameter adaptive calibration module; the parameter adaptive calibration module is used to continuously read the real-time value of the environmental pressure signal when the controlled space is in a non-operational state connected to the atmosphere, and calculate the arithmetic mean as the sensor zero-point drift; the parameter adaptive calibration module uses the zero-point drift as a correction factor to dynamically update the upper and lower limit thresholds of the atmospheric pressure reference range in the energy zero potential verification logic.

[0010] Preferably, the zero potential energy verification logic also includes a signal validity prediction program; the signal validity prediction program is used to monitor the time change rate of the environmental pressure signal, and when the time change rate exceeds the preset fluid dynamics physical limit value, the environmental pressure signal is determined to be an invalid signal and the generation of the safe positioning mark is blocked; the physical limit value is calculated based on the bulk modulus of the medium in the controlled space and the flow cross-sectional area of ​​the pressure relief channel.

[0011] Preferably, the logical deadlock state in the self-locking control execution unit has non-volatile storage characteristics; after the system experiences a power failure restart or reset operation, the self-locking control execution unit is used to automatically read the status flag bit stored before the power failure; if the read status flag bit is a logical deadlock state, the self-locking control execution unit maintains the output of the self-locking enable instruction until it receives an unlocking instruction containing a specific multi-check code.

[0012] Preferably, the physical blocking unit adopts a dual-channel redundant architecture; the dual-channel redundant architecture includes two independent relays connected in series in the power transmission circuit of the drive mechanism; the self-locking control execution unit drives the two independent relays through two independent physical lines respectively, and the energy input channel of the drive mechanism is in a physically cut-off state only when both physical lines output self-locking enable commands.

[0013] Preferably, the multi-source heterogeneous signal acquisition unit is also used to acquire the drive motor current signal of the controlled object as a load status signal; the logic verification controller compares the drive motor current signal with a preset no-load current reference; when the value of the drive motor current signal is less than or equal to the no-load current reference for a preset stable time, the logic verification controller confirms that the load status signal indicates power unloading.

[0014] Preferably, the logic verification controller is also connected to an audible and visual alarm unit; when the environmental pressure signal does not exhibit exponential decay characteristics within a preset time sequence or the deviation between the actual correlation characteristics and the correlation reference curve exceeds the dynamic tolerance band, the logic verification controller generates a fault code and drives the audible and visual alarm unit to issue a corresponding alarm signal; the alarm signal is used to indicate the specific fault type of the controlled object, and the fault types include sensor failure, sealing structure failure, and foreign object jamming.

[0015] Compared with the prior art, the beneficial effects of the present invention are: 1. In the safe self-locking state of tailrace maintenance operations, a multi-dimensional state convergence verification model based on mechanical stroke, driving load, and fluid pressure attenuation characteristics is constructed to solve the problem that single position detection cannot truly represent the energy isolation state control. By using heterogeneous signal physical timing logic interlocking, the safety criterion is transformed from discrete geometric position to continuous medium energy zeroing confirmation, eliminating the risk of false safety signals caused by limit switch jamming, mechanical structure deformation, or foreign matter deposition at the bottom of the gate. Logic verification ensures that the self-locking command is generated under the condition of physical isolation and complete release of residual energy, avoiding the safety hazard of decoupling state representation from physical reality.

[0016] 2. Utilizing the natural fluctuations of the external water level in the controlled space as a non-intrusive detection excitation, a dynamic sealing monitoring logic based on the time-domain correlation analysis of internal and external signals is established. By calculating the co-frequency coupling characteristics between the internal pressure and the external water level, in the early stage before the absolute pressure value triggers the static threshold alarm, the system qualitatively identifies minor deterioration of the sealing structure or hidden leakage channels. The system transforms environmental noise into a diagnostic signal processing method, enabling the control device to distinguish between physical isolation and numerical artifacts caused by sensor zero-point drift during long-term maintenance. Under the standard industrial instrument accuracy constraints, the system can identify chronic physical failures. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the overall control architecture and multi-source signal closed-loop principle of the system of the present invention; Figure 2 This is a pressure transient characteristic curve under the active diagnostic mode of perturbation response of the present invention; Figure 3 This is a diagram illustrating the collaborative interaction and logical architecture of the three domains of perception, decision-making, and execution in this invention. Detailed Implementation

[0018] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0019] A safety self-locking state control system for tailrace maintenance operations upgrades the safety confirmation mechanism for confined space maintenance from traditional single discrete position determination to multi-dimensional state deterministic verification based on zero potential energy convergence. In terms of hardware topology, it mainly consists of a multi-source heterogeneous signal acquisition unit, a logic verification controller, a self-locking control execution unit, a physical blocking unit, and an audible and visual alarm unit. These units are connected via an industrial fieldbus or hardwired to form a closed-loop control circuit. The multi-source heterogeneous signal acquisition unit is used to acquire feature vectors representing the physical state of the controlled object in real time. It includes three independent signal acquisition channels, corresponding to the dimensions of mechanical position, driving load, and environmental pressure, respectively. The first channel is the mechanical displacement acquisition channel, which uses a magnetostrictive displacement sensor or a multi-turn absolute encoder installed on the end of the gate hydraulic cylinder or winch drum shaft to output the real-time mechanical displacement signal of the controlled object. The data update frequency of this signal is set to be no less than Hz, resolution better than The first channel, mm, is used to accurately characterize the geometric position of the actuator. The second channel is a load status acquisition channel. For hydraulic drive mechanisms, this channel uses a pressure transmitter to acquire the main oil circuit pressure; for motor drive mechanisms, this channel uses a Hall current sensor to acquire the drive motor current. This channel outputs a load status signal. The first channel is used to characterize the power unloading state of the drive mechanism and determine whether the gate has completely reached the bottom and achieved a seal by its own weight. The second channel is the environmental pressure acquisition channel, which uses a diffused silicon pressure transmitter. The probe is placed at the lowest elevation point or key water accumulation point inside the tailrace pipe. This channel outputs the environmental pressure signal inside the controlled space. The measurement range covers from vacuum to maximum hydrostatic head pressure, used to characterize the retention state of energy in the medium within the space. This unit is also connected to the power plant's existing tailrace water level monitoring instruments to acquire water level fluctuation signals outside the controlled space. This serves as external reference data for subsequent decoupling analysis of sealing performance.

[0020] The logic verification controller is the core of the system's operation. Implemented using a PLC or industrial control computer, it addresses the logical flaw of traditional limit switches in failing to detect false gate closures or physical leaks. This controller incorporates zero-potential energy verification logic and executes the following deterministic operational procedure: Step 1, Input signal reception and preprocessing, real-time reception... , and The signal is then digitally filtered to eliminate power frequency interference; step two involves state and threshold determination, performing a logical AND operation to determine... Is it within the preset full-closed zone, the entire journey? to Within the range; simultaneously determine Whether it is below the preset no-load threshold is obtained through on-site calibration, that is, by reading the average current value or oil pressure value when the gate is suspended in operation, and setting this benchmark value. to Set as the unloading decision line; Step 3, pressure convergence verification: when the above conditions are met, start the pressure convergence monitoring subroutine, which will run at a preset time. Inside, to Perform first derivative operation ,verify Does the trend of change conform to the characteristics of exponential decay? And does the final convergence value satisfy... The conditions, among which Based on the current atmospheric pressure benchmark, For the allowable sensor noise tolerance, for example kPa; Step 4, safety flag generation: When all the above logic is true, the controller generates a safety in place flag and sets the internal safety status register; To identify the risk of foreign object jamming or guide rail deformation during the shutdown process, the logic verification controller performs dynamic trajectory correlation verification in parallel. During the baseline model construction phase, the system undergoes a standard, fault-free shutdown process during the debugging phase, with a fixed sampling rate, for example... ms, synchronously record mechanical displacement Environmental pressure The corresponding relationship is used to generate a displacement-pressure correlation benchmark curve. The data is stored in the controller's non-volatile memory. During the real-time monitoring phase, the controller collects the current mechanical displacement in real time while the controlled object is performing a closing action. and environmental pressure The deviation between the actual pressure value and the theoretical pressure value of the benchmark model under the same displacement is calculated. The system has a preset dynamic tolerance band. For example, the benchmark value If continuous Each sampling point, for example ,satisfy If the process is abnormal, the controller will generate a process abnormality blocking command. This command has the highest priority, prohibits the generation of subsequent safe positioning flags, and drives the audible and visual alarm unit to output a trajectory deviation fault code.

[0021] To address the challenge of identifying minute leaks or sensor zero-point drift, this system utilizes external water level fluctuations as an excitation source to perform environmental perturbation decoupling verification. The controller then processes the acquired environmental pressure signal. and external water level fluctuation signals Perform DC removal processing and extract within a sliding time window, for example... The fluctuation components within a minute, the correlation calculation procedure, and after generating the safe positioning flag, the controller continuously calculates the cross-correlation coefficient between the two within the sliding time window. The calculation formula strictly follows the following mathematical relationship: ,in, For the environmental pressure signal in the first The value of each sampling point Let it be its mean over the sliding time window. For the water level fluctuation signal at the first The value of each sampling point Let it be its mean over the sliding time window. The system sets a coupling threshold based on the total number of sampling points, the decision logic, and the system settings. ,For example ,when When a hidden sealing failure is detected in the controlled object, the controller removes the safety positioning flag to prevent the system from maintaining self-locking in a non-physically isolated state. The self-locking control execution unit responds to the safety positioning flag by outputting a self-locking enable command. To eliminate false safety caused by welded actuator contacts, the system employs an architecture combining physical blocking and potential readback. The physical blocking unit consists of two guided safety relays connected in series in the drive mechanism's power transmission circuit, such as the motor contactor coil circuit. Responding to the self-locking enable command, these two relays activate, cutting off the energy input channel to the drive mechanism and ensuring that even if the controller program malfunctions and issues an action command... The actuator is also unable to obtain power. At the same time, a potential monitoring circuit is set at the signal output terminal of the physical blocking unit and connected to the digital input terminal of the controller. The controller runs the execution integrity verification logic, monitors the voltage status of the potential monitoring circuit in real time, and performs an XOR check with the self-locking enable command. When the self-locking enable command is in a valid output state, that is, the logic requires disconnection, and the potential monitoring circuit detects a voltage signal, that is, it is physically not disconnected, it is determined that the physical blocking unit has a contact adhesion fault. At this time, the controller triggers the disconnection command of the upper-level power supply, such as the main circuit breaker of the power cabinet, to force the system to disconnect power and ensure fault-oriented safety.

[0022] When the self-locking control actuator generates a safety-in-place flag and enters a logical deadlock state, it writes the flag into a non-volatile memory, such as a battery-powered RAM or EEPROM. This non-volatile memory is designed to handle unexpected power outages or controller resets that may occur during system operation. After the system is powered on again or a reset is completed, the self-locking control actuator is configured to prioritize executing a self-check procedure, reading the status flag stored before the power outage. If the read status flag indicates that the system is in a logical deadlock state, the self-locking control actuator will maintain the output of the self-lock enable command, bypassing all conventional startup logic, until it receives an unlock command containing a specific multi-checksum. This mechanism ensures that the system's safe state automatically converges to a preset fault-oriented safe state after any form of electrical interruption. The system is connected to a pressure relief actuator, such as an electric drain valve, to perform active health checks in conjunction with the perturbation response active diagnostic logic. The controller performs checks at a preset cycle, such as every... Within hours, a short-duration pulse start command is sent to the pressure relief actuator, with the start duration set as follows: Within seconds, a negative pressure excitation is applied, and simultaneously, the controller rapidly acquires the ambient pressure signal. The controller calculates the variance of the transient response waveform. If the variance is lower than a preset dead-zone threshold, it determines that the sensor value is frozen or the sampling channel is faulty. The controller then calculates the pressure recovery rate after the pulse ends. ,like If the preset water replenishment model threshold is exceeded, which is calculated based on the controlled space volume and the allowable leakage, it is determined that there is a medium leak in the controlled object, and the external water body is replenishing the pressure loss caused by the depressurization. This logic realizes the active detection of hidden leaks.

[0023] Example 1: In the scenario of tailrace maintenance of a large hydro-generator unit, the controlled object is under conditions of high siltation and frequent fluctuations in the external tailrace level due to tides or unit regulation. There is a potential risk that the gate may be mechanically positioned but the seal may fail due to bottom debris or rocks becoming stuck. Under these conditions, when the bottom edge of the gate presses against the sediment, the mechanical displacement signal output by the magnetostrictive displacement sensor installed on the hydraulic cylinder... The displayed value has entered the full travel phase. to Within the range, and because the hydraulic station subsequently performs an unloading operation, the pressure transmitter collects the load status signal. If the load falls below a preset no-load threshold, traditional limit switch-based control logic will misjudge the load. To mitigate this risk, the multi-source heterogeneous signal acquisition unit of this invention continuously acquires environmental pressure signals within the controlled space during this process. The logic verification controller receives the signal and executes the zero potential energy verification procedure. The controller follows a preset timing sequence. Internal Perform first derivative operation Monitoring found that although The instructions were in place, but... The downward curve did not show the same The exponential decay characteristic or its final convergence value is related to the atmospheric pressure reference. The deviation exceeds the allowable sensor noise tolerance. This indicates that there is still residual medium energy or continuous leakage replenishment within the controlled space. Based on this multi-dimensional state timing calculation result, the system blocks the generation of the safe in-place flag.

[0024] During the gate closing process, the dynamic trajectory correlation verification logic works in parallel, calculating the actual pressure value and the pre-stored displacement-pressure correlation benchmark curve in real time. Deviation between When a foreign object at the bottom causes a slight change in the gate's motion characteristics, even if the torque protection has not yet been triggered, continuous Deviation of each sampling point Exceeding the dynamic tolerance band Based on this, the controller identifies anomalies in the fluid-mechanical coupling characteristics and prioritizes generating process anomaly blocking commands before the gate reaches the fully closed position, achieving early intervention in process risks, even when the gate appears to be completely closed and During the static maintenance phase where the numerical value approaches atmospheric pressure, the environmental perturbation decoupling verification logic is continuously extracted. External water level fluctuation signals The fluctuation characteristics within the sliding time window are analyzed, and the cross-correlation coefficient is calculated based on the formula. When external tailwater fluctuates, if the calculation shows... Continuously exceeding the coupling threshold This indicates that the internal pressure of the controlled space responds in sync with the external water level. The system determines that there is a hidden sealing failure channel and immediately removes the safety positioning sign. When all logic verifications pass, the self-locking control execution unit drives the physical blocking unit connected in series in the power transmission circuit to act. The XOR verification of the potential monitoring circuit confirms that the physical breakpoint has actually formed, thereby constructing a deterministic safety barrier based on energy physics facts rather than a single sensor signal.

[0025] Example 2: This experiment simulates chronic leakage and hardware failure in the execution loop during tailrace maintenance. Through quantitative data comparison, it verifies the practical effectiveness and engineering adaptability of the environmental perturbation decoupling verification logic and execution integrity verification logic in this invention. The experiment is conducted on a physical simulation device used to replicate high-noise industrial electromagnetic environments and water fluctuation conditions. The data acquisition system has… ms scan cycle kPa pressure measurement resolution, and superimposed Hz power frequency interference harmonics; the experiment set up three control groups for comparison: control group 1 used position signals Single logic lock; control group 2 adopted Combined with static pressure threshold The simple logic of kPa is used for locking; the sample of this invention adopts complete zero-potential energy verification logic and environmental perturbation decoupling verification. Logical and execution integrity checks.

[0026] The first phase of the experiment verified the chronic leak detection capability. This phase simulated a blind zone where static thresholds are prone to failure. After the gate entered the locked state, the test personnel... Simultaneously, a small amount of water is injected into the tailrace pipe at a rate of kPa / h to simulate leakage, while an external water level signal is received. Set as Random low-frequency fluctuations in kPa; control group 1 could not detect leakage; control group 2, due to its slow leakage rate, showed that the system... Minutes later An alarm is triggered when the static threshold is exceeded, and the system remains in an incorrect safety judgment state throughout this period. In contrast, the logic verification controller in the prototype of this invention continuously calculates... and cross-correlation coefficient Because the leak establishes a coupling channel between the internal pressure and the external environment, only after the leak begins... minutes, calculated That is, the coupling threshold is exceeded for the first time. The system will revoke the security flag.

[0027] The second phase of the experiment verified the fault tolerance capability of the execution circuit. The experimenters simulated the physical blocking unit's contacts outputting a self-locking enable command, i.e., the logic... When welding occurs, the output voltage remains at a high level, i.e., physical welding occurs. In control groups 1 and 2, the system logic indicated that the circuit was locked, but the actual power circuit was open. The prototype of this invention then initiated the execution integrity verification logic. This involved performing an XOR check on the self-locking enable command and the potential monitoring circuit signal. When the command was detected... And physics When an inconsistent state occurs, a disconnection command is triggered from the upstream power supply. The delay time from the occurrence of the fault to the operation of the main circuit breaker is recorded as follows: This response speed is much faster than any manual intervention or secondary protection. Table 1 clearly shows the performance comparison of different control logics under critical fault modes.

[0028] Table 1: Performance Comparison of Different Control Logics under Critical Failure Modes ; in, Decoupling is used for environmental perturbation decoupling verification logic. threshold for , Static threshold for kPa, the test results show that by introducing a logic interlocking mechanism of multidimensional heterogeneous signals, the present invention improves the determination of the safety status from dependence on a single signal to closed-loop confirmation of the physical energy isolation status. This technical approach has strong adaptability in high-risk conditions such as chronic leakage and actuator hardware failure.

[0029] Example 3: This example combines Figures 1 to 3 A description of a safety self-locking control system for tailrace maintenance operations, such as... Figure 1 As shown, the overall architecture of the system consists of a multi-source heterogeneous signal acquisition unit, a logic verification controller, a self-locking control execution unit, a physical blocking unit, a pressure relief actuator, and an audible and visual alarm unit, forming a closed-loop control circuit. Among them, the multi-source heterogeneous signal acquisition unit is responsible for acquiring mechanical displacement signals in real time. Load status signal Or drive motor current, ambient pressure signal and external water level fluctuation signals The real-time data stream is transmitted to the logic verification controller, which serves as the core computing unit. Internally, it integrates parallel logic for zero-potential energy verification based on pressure exponential decay and convergence verification; dynamic trajectory correlation verification logic based on displacement-pressure baseline curve deviation monitoring; environmental perturbation decoupling verification logic based on internal and external fluctuation cross-correlation coefficient calculation; perturbation response active diagnosis logic based on negative pressure pulse recovery rate analysis; execution integrity verification logic based on instruction and feedback XOR verification; and a parameter adaptive calibration module responsible for sensor zero-point drift dynamic updates. The logic verification controller connects to an audible and visual alarm unit for fault triggering and code indication, and to a self-locking control execution unit with logic deadlock and non-volatile storage characteristics. It outputs a self-locking enable command to a physical blocking unit employing a dual-channel redundant architecture and physical cutoff mechanism. The output of the physical blocking unit feeds back an integrity verification signal to the controller via a potential monitoring loop. Simultaneously, the controller connects to a pressure relief actuator to send short-time pulses and monitor the response.

[0030] like Figure 2As shown, the graph uses time (in seconds) as the horizontal axis, covering a range of 0 to 30 seconds, and ambient pressure (in kPa) as the vertical axis, covering a range of 0 to 1.0 kPa. The graph contains three curves representing different physical states. The solid line represents the normal pressure recovery curve, showing the characteristic of a gradual pressure recovery in the controlled space after a pulse excitation or dead zone of 0 to 5 seconds. The dashed line represents the water replenishment model threshold, which appears as a linear growth boundary with a fixed slope. The dotted line represents the leakage pressure recovery curve, showing that after t=4 seconds, the recovery rate of the ambient pressure signal is higher than that of the normal pressure recovery curve and the water replenishment model threshold, intuitively reflecting the physical phenomenon of external fluid rapidly replenishing the pressure of the controlled space through the leakage channel.

[0031] like Figure 3 As shown, the logical control architecture of the system is revealed from the perspective of functional domain interaction. The system is divided into three interconnected logical modules: the perception domain, the decision domain, and the execution domain. The perception domain is a multi-source heterogeneous acquisition module that integrates mechanical displacement sensors, environmental pressure transmitters, load current / pressure monitoring, and external water level monitoring. It is responsible for unidirectionally transmitting multi-dimensional status signals to the decision domain. The decision domain is the logic control center, which includes a logic verification controller that runs the core algorithm and verifies zero potential energy, an audible and visual alarm unit, and a power disconnection module. The decision domain sends self-locking / blocking commands to the execution domain based on the received signals and receives potential monitoring feedback signals from the execution domain to form a closed loop. The execution domain is the safety blocking and defense module, which includes a dual-channel redundant mechanism for physical blocking units and a pressure relief actuator. The decision domain can also send active diagnostic requests to the perception domain or the entire system. The active diagnostic excitation of the pressure relief actuator enables dynamic exploration of the system status.

[0032] Example 4: This example addresses the engineering traceability issues faced by logic verification controllers during long-term operation, including parameter reference drift, dynamic model inaccuracy, and lack of active diagnostic thresholds. It elucidates the core parameter adaptive calibration and model building procedures. The system needs to periodically execute the zero-point weighting procedure of the parameter adaptive calibration unit to correct environmental pressure signals. Zero-point drift that occurs during long-term operation will trigger the controller when the gate is fully open or open to the atmosphere. Signal acquisition, acquisition system Continuous sampling at Hz seconds The original data stream, and the calculation of that... The arithmetic mean of the sampling points is used as the current actual atmospheric pressure benchmark. The convergence target value used in the zero potential energy verification logic is calculated by the controller within the acquisition window. Standard deviation of data stream and noise tolerance Set as times the standard deviation, i.e. This allows for a statistical distinction between the inherent noise of the sensor itself and the actual leakage signal, ensuring the stability of the system's judgment under static environmental conditions.

[0033] Simultaneously, the logic verification controller maintains the displacement-pressure correlation benchmark curve required in the dynamic trajectory correlation verification logic. and dynamic tolerance band , for building The controller synchronously collects data during the predetermined standard shutdown action. and The signal is processed and the data is segmented and stored. The controller then... The signal undergoes piecewise linear fitting to construct a smooth, continuous function. It is used to characterize the coupling relationship between fluid dynamics and mechanical motion, in order to determine Controller statistics In the secondary standard closing action signal relative to Maximum absolute deviation and the dynamic tolerance band Set as times This setting is used to allow acceptable fluid disturbances during normal system operation, ensuring that a process anomaly shutdown command is triggered only when the deviation exceeds this range.

[0034] In addition, the water replenishment model threshold required in the proactive diagnostic logic It has clear engineering traceability basis, is used to quantitatively determine the leakage rate of the tailrace pipe, and the controller pre-stores the equivalent effective volume of the controlled space. The unit is and the maximum leakage flow rate allowed by the maintenance safety specifications. The unit is When the active diagnostic logic is activated and a negative pressure pulse excitation is applied, the controller... Signal in transient recovery window Perform linear regression to calculate the pressure recovery rate. The unit is The controller will replenish the water model threshold. Set as with Proportional to, and The inversely proportional physical constraint values ​​are calculated according to the following proportional function: Should The constraint value characterizes the theoretical rate of pressure recovery within the tailrace pipe cavity under the maximum permissible safe leakage flow rate. When the calculated... Exceed When the system determines that the actual leakage rate has exceeded the safe range, it transforms the abstract problem of leakage diagnosis into a quantitative judgment based on the system's geometric characteristics and fluid dynamics principles.

[0035] Example 5: Before the newly deployed tailrace gate control system is put into use, a standardized engineering procedure needs to be executed, which includes the solidification of logical deadlock procedures and the calibration of emergency unlocking quantitative criteria. This aims to ensure that the system parameters can accurately match the hydraulic environment and mechanical characteristics of the drive mechanism at this specific work station. This calibration procedure is divided into two main stages: dynamic model establishment and the solidification of leakage model parameters. In the dynamic model establishment stage, the displacement-pressure correlation benchmark curve is constructed and optimized. and dynamic tolerance band The controller executes continuously The on-load gate closing action is synchronously recorded by the multi-source heterogeneous signal acquisition unit. and Signal, logic verification controller for this Piecewise linear fitting is performed on the time series data to construct a smooth, continuous function. This is used to characterize the coupling relationship between fluid dynamics and mechanical motion, in order to determine... Controller calculation During the next closing action Compared to Maximum absolute deviation and the dynamic tolerance band Set as times This setting is used to allow for acceptable fluid disturbances during normal system operation, ensuring that no false interruptions occur.

[0036] During the leakage model solidification phase, precision measuring tools were used to determine the equivalent effective volume of the controlled space in the tailrace pipe. The unit of volume is And input the maximum permissible leakage flow rate for this workstation according to the power plant safety regulations. The unit of this flow rate is The controller will replenish the water model threshold. Set as with Proportional to, and The inversely proportional physical constraint value is used to determine whether a media leak exceeds the safety boundary, and its calculation relationship follows the following proportional function: Should Thresholds are embedded in the active diagnostic logic, serving as an objective basis for determining whether media leakage exceeds safety boundaries. This procedure, by parameterizing actual physical characteristics, ensures that the system has a judgment basis highly matched to the field conditions from the first day of operation. During the engineering initialization phase, the logic verification controller executes the baseline environment feature extraction procedure, embedding background noise parameters in the zero potential energy verification logic. The procedure is initiated when the controlled object is fully open and the flow channel is stationary. The multi-source heterogeneous signal acquisition unit... Sampling frequency for acquiring environmental pressure signals and external water level fluctuation signals Sampling time not less than The system covers the complete cycle of low-frequency hydraulic fluctuations within seconds; the controller performs statistical operations on the discrete data stream within the sampling window, calculates the mean of the environmental pressure signal as the zero-point reference, and calculates the standard deviation of the time series. ,Will Double standard deviation The lower limit of the dynamic tolerance band for static pressure monitoring is set and written into the non-volatile parameter register to replace the empirical fixed value. This allows the pressure convergence judgment benchmark to automatically adapt to the specific fluid pulsation background and sensor inherent noise level in the power station tailrace. It also provides a threshold for the active diagnostic logic logic replenishment model for perturbation response. A deterministic calibration method based on physical entity parameters is adopted, without relying on pure theoretical estimation. The controller parameter configuration interface input is based on the equivalent effective volume of the controlled tailrace pipe section calculated from civil engineering drawings or measured by water injection tests. The maximum permissible leakage flow rate is determined in accordance with the safety standards for the maintenance of hydro-generator units in the power industry. The logic verification controller has a preset linear transformation algorithm based on the physical constraint formula. Calculate the critical threshold for pressure recovery rate. The compressibility constant is determined by the fluid bulk modulus and the current water temperature; the calculated value is... The value is solidified as the sole quantitative basis for judging media leakage. When active negative pressure pulse excitation is executed, the controller outputs a binary judgment signal indicating the presence of sealing failure based solely on the comparison result between the slope of the real-time monitored pressure recovery rate and the solidification threshold.

[0037] Example 6: Before maintenance work begins, the system enters a safety self-locking state. At this time, the logic verification controller executes a logic deadlock mechanism to ensure that the gate drive mechanism is in an absolutely safe shutdown state during long maintenance cycles. This procedure solidifies the state of the maintenance self-locking flag in the controller's non-volatile storage unit and shields all opening or action output commands for the gate at the software level. The procedure for releasing the deadlock state is divided into two methods: authorized unlocking and emergency automatic unlocking. For authorized unlocking, the controller receives an unlocking command containing specific multi-keys. Only after the digital signature validity and the highest-level password verification are passed can the maintenance self-locking flag be revoked, and a safety blocking signal be output to release the physical blocking unit from cutting off the power transmission circuit. At the same time, the controller performs timing checks, only when... The current value of the signal is below the emergency unlock threshold. Only when the physical blockage is lifted will a safety blocking signal be output.

[0038] For emergency automatic unlocking, the controller continuously monitors environmental pressure signals. The changing trend is the criterion used to trigger the unlocking process. instantaneous rate of change of the signal continued The time exceeds the preset pressure rise rate threshold ,at the same time The absolute value exceeds the emergency unlock threshold The threshold is set to kPa, The value is much higher than the statistically determined sensor noise. This ensures that in the event of unforeseen failure of sensors or actuators leading to accidental water backflow, the logic system can proactively release the lock on control based on the deterioration of physical reality, thereby initiating a higher-level emergency response procedure.

[0039] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0040] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A safety self-locking state control system for a tail water maintenance operation, characterized by, include: A multi-source heterogeneous signal acquisition unit is used to acquire in real time the mechanical displacement signal of the controlled object, the load status signal of the drive mechanism, and the environmental pressure signal inside the controlled space. The logic verification controller is connected to a multi-source heterogeneous signal acquisition unit and is pre-set with zero potential energy verification logic and dynamic trajectory correlation verification logic. The zero potential energy verification logic is used to perform multi-dimensional state timing calculations. When the mechanical displacement signal indicates that the machine is closed, the load status signal indicates that the power is unloaded, and the environmental pressure signal shows an exponential decay and converges to the atmospheric pressure reference range within a preset time sequence, a safe positioning flag is generated. The dynamic trajectory association verification logic stores the displacement and pressure association reference curve of the controlled object during the standard closing process. It is used to calculate the actual correlation characteristics of the mechanical displacement signal and the environmental pressure signal in real time during the closing action of the controlled object. When the deviation between the actual correlation characteristics and the association reference curve exceeds the preset dynamic tolerance band, a process abnormality blocking command is generated to prevent the generation of the safe positioning flag. The self-locking control execution unit, in response to the safety in place flag, outputs a self-locking enable command and enters a logical deadlock state that masks all control inputs except for the unlock command. The physical blocking unit is connected in series in the power transmission circuit of the drive mechanism. It operates in response to the self-locking enable command and physically cuts off the energy input channel of the drive mechanism.

2. The safety self-locking state control system for tailrace maintenance operations according to claim 1, characterized in that, The multi-source heterogeneous signal acquisition unit is also used to acquire water level fluctuation signals outside the controlled space, and the logic verification controller is also equipped with environmental perturbation decoupling verification logic. The environmental perturbation decoupling verification logic is used to continuously extract the time-domain fluctuation characteristics of the environmental pressure signal and the water level fluctuation signal within the sliding time window after the safe positioning flag is generated, and calculate the cross-correlation coefficient between the two according to the following formula. : ,in, For the environmental pressure signal in the first The value of each sampling point Let it be its mean over the sliding time window. For the water level fluctuation signal at the first The value of each sampling point Let it be its mean over the sliding time window. The total number of sampling points; when the cross-correlation number When the absolute value exceeds the preset coupling threshold, the logic verification controller determines that the controlled object's seal has failed and cancels the safety positioning flag.

3. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The signal output terminal of the physical blocking unit is equipped with a potential monitoring circuit, which is connected to the logic verification controller. The logic verification controller is configured with execution integrity verification logic. This logic is used to monitor the voltage status of the potential monitoring circuit in real time and perform XOR logic verification when the self-locking control execution unit outputs a self-locking enable command. When the self-locking enable command is in a valid output state and the potential monitoring circuit detects a voltage signal, the execution integrity verification logic determines that the physical blocking unit has a contact sticking fault and triggers the disconnection command of the upper-level power supply.

4. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The system is also connected to a pressure relief actuator for connecting the controlled space with the external environment; the logic verification controller is equipped with perturbation response active diagnostic logic, which is used to send short-time pulse start commands to the pressure relief actuator at preset intervals to apply negative pressure excitation during the safe position mark holding period; The logic verification controller collects the transient response waveform of the environmental pressure signal to the short-time pulse start command, and determines that there is a medium leak in the controlled object when the pressure recovery rate of the transient response waveform exceeds the preset water replenishment model threshold.

5. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The logic verification controller also includes a parameter adaptive calibration module; the parameter adaptive calibration module is used to continuously read the real-time value of the environmental pressure signal when the controlled space is in a non-operational state connected to the atmosphere, and calculate the arithmetic mean as the sensor zero-point drift. The parameter adaptive calibration module uses the zero-point drift as a correction factor to dynamically update the upper and lower limit thresholds of the atmospheric pressure reference range in the energy zero potential verification logic.

6. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The zero potential energy verification logic also includes a signal validity prediction procedure; the signal validity prediction procedure is used to monitor the time change rate of the environmental pressure signal. When the time change rate exceeds the preset fluid dynamics physical limit value, the environmental pressure signal is determined to be an invalid signal and the generation of the safe positioning mark is blocked; the physical limit value is calculated based on the bulk modulus of the medium in the controlled space and the flow cross-sectional area of ​​the pressure relief channel.

7. The safety self-locking state control system for tailrace maintenance operations according to claim 1, characterized in that, The logical deadlock state in the self-locking control execution unit has non-volatile storage characteristics; After a power outage and restart or reset operation, the self-locking control execution unit automatically reads the status flag bit stored before the power outage. If the read status flag bit is in a logical deadlock state, the self-locking control execution unit maintains the output of the self-locking enable instruction until it receives an unlocking instruction containing a specific multi-check code.

8. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The physical blocking unit adopts a dual-channel redundant architecture; the dual-channel redundant architecture includes two independent relays connected in series in the power transmission circuit of the drive mechanism; the self-locking control execution unit drives the two independent relays through two independent physical lines respectively, and the energy input channel of the drive mechanism is in a physically cut-off state only when both physical lines output self-locking enable commands.

9. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The multi-source heterogeneous signal acquisition unit is also used to acquire the drive motor current signal of the controlled object as a load status signal; the logic verification controller compares the drive motor current signal with the preset no-load current reference; when the value of the drive motor current signal is less than or equal to the no-load current reference for a preset stable time, the logic verification controller confirms that the load status signal indicates power unloading.

10. The safety self-locking state control system for tail water maintenance operation according to claim 1, characterized in that, The logic verification controller is also connected to an audible and visual alarm unit. When the environmental pressure signal does not exhibit exponential decay characteristics within a preset time sequence or when the deviation between the actual correlation characteristics and the correlation reference curve exceeds the dynamic tolerance band, the logic verification controller generates a fault code and drives the audible and visual alarm unit to issue a corresponding alarm signal. The alarm signal is used to indicate the specific fault type of the controlled object. Fault types include sensor failure, sealing structure failure, and foreign object jamming.

Images