Loader brake pilot safe starting system

Abstract

The invention belongs to the technical field of loading machine brake safety, and discloses a loading machine brake pilot safety starting system, which adopts a framework that a dual-redundancy pilot pressure sensor is matched with hydraulic signal filtering and validity verification, and realizes dual acquisition and accurate verification of brake signals; the double sensors synchronously collect signals and complete noise reduction processing, the effectiveness of the signals is confirmed through contrastive analysis, and a pressure threshold value can be adaptively calibrated through an ECU to meet different braking requirements; once the signal is abnormal, the system is automatically switched to a standby sensor, and fault information is fed back at the same time; the problem of interlocking misjudgment caused by a single sensor fault is solved; working condition parameters are collected through inclination angle, gear and load multi-dimensional sensors, a three-level risk assessment system is built, and a dynamic adjustment mechanism is matched, so that safety is guaranteed, and operation flexibility is taken into consideration; in high-risk scenes such as ramps, heavy loads and gears, the system can be automatically prohibited from being started, and the braking force is enhanced.

Description

Technical Field

[0001] This invention belongs to the field of loading machine braking safety technology, specifically a loading machine braking pilot safety start system. Background Technology

[0002] Loaders are core equipment in the construction machinery field, widely used in mines, construction sites, ports, and other scenarios. The safety of their starting process directly affects the personal safety of operators and also relates to the safety of equipment and property at the work site. Currently, most existing loader brake-guided safety starting technologies in the industry employ a design combining a single hydraulic pilot pressure signal with electronic interlocking. This utilizes the hydraulic signal generated by braking, converting it into an electrical signal as a necessary prerequisite for machine starting, achieving a basic safety protection effect of braking before starting to a certain extent. However, existing technologies still have the following technical problems: The signal acquisition method is relatively simple, relying on a single pilot pressure switch. Once the sensor malfunctions, such as signal drift or open circuit, it is easy to cause misjudgment of safety interlock, which may lead to problems such as falsely allowing start-up or falsely prohibiting start-up. Overall, there is a lack of signal redundancy protection. Secondly, the complex working conditions of loaders during actual operation have not been fully considered. In dangerous scenarios such as working on slopes, heavy-load operation, and stopping in gear, relying solely on brake signals is insufficient to fully avoid risks such as sudden acceleration or slippage, and the safety protection is not targeted enough. In addition, the interlocking mechanism has a relatively simple hierarchy, and the start permission can be triggered by a single signal verification. It lacks the design of multi-level redundancy protection, and once a single point of failure occurs, it may cause the entire safety system to fail. Summary of the Invention

[0003] The purpose of this invention is to provide a loading mechanism brake pilot safety start system to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a loading mechanism brake pilot safety start system, comprising: Preferably, the redundant acquisition module includes a dual-redundant pilot pressure sensor, a hydraulic signal filtering unit, and a signal validity verification unit; When the operator presses the brake pedal, the hydraulic circuit generates pilot pressure. Dual redundant pilot pressure sensors synchronously collect pressure signals. After the filtering unit removes signal noise caused by hydraulic shock, the signal validity verification unit compares and analyzes the two signals. The pressure threshold can be adaptively calibrated by the ECU according to the hydraulic parameter range of the loading mechanism's braking system to adapt to different braking requirements: if the two signals are consistent and reach the preset pressure threshold, they are determined to be valid braking signals and are synchronously output to the primary interlocking unit of the electronic control core module and the multi-level interlocking module; if only one signal is valid or exceeds the preset deviation range, it is determined to be a signal abnormality, and a fault information is sent to the fault diagnosis module, triggering an alarm in the human-machine warning module, and automatically switching to the standby sensor's independent working mode to ensure that the basic braking signal acquisition is not interrupted, while recording the fault sensor information. Preferably, the working condition assessment module includes an inclination sensor, a gear position sensor, a load pressure sensor, and a risk level determination unit; The tilt sensor detects the loader's tilt angle in real time to determine if it is on a slope; the gear position sensor collects the current gear status; and the load pressure sensor detects the bucket load. The risk level determination unit integrates the above signals and also has a dynamic adjustment mechanism. When the loader is on a slope but the operator manually activates the slope assist braking function, the risk level can be reduced from high risk to medium risk, balancing safety and operational flexibility. Ultimately, the starting risk is divided into three levels and uploaded to the electronic control core module in real time. At the same time, it is synchronized to the human-machine warning module for display: low risk, medium risk, and high risk. In high-risk conditions, a start prohibition signal is fed back to the electronic control core module, triggering the electronic control core module to control the braking system to increase braking force.

[0005] Preferably, the electronic control core module consists of a main control chip, a logic operation unit, a fault diagnosis algorithm module, and a CAN bus communication unit; The system receives valid braking signals from the redundant acquisition module and risk level signals from the operating condition assessment module in real time via the CAN bus, while also receiving system fault status information from the fault diagnosis module. The logic operation unit's preset rules support online algorithm upgrades via the CAN bus, adapting to different regional safety standards and user-specific needs. Based on the combined conditions of a valid braking signal, a risk level of medium risk or below, and no system fault, the system performs a judgment: if the conditions are met, a start permission command is generated and sent to the multi-level interlocking module, while simultaneously sending a start condition fulfillment status signal to the human-machine warning module; if the conditions are not met, a start prohibition command is generated and synchronously fed back to the multi-level interlocking module and the human-machine warning module, triggering the corresponding warning.

[0006] The fault diagnosis algorithm module integrates threshold judgment, trend analysis, and comparative diagnosis to improve the accuracy of fault identification. It identifies the fault types of each module in real time through signal feature analysis. The command issuance adopts a priority mechanism, with the emergency stop command having the highest priority and capable of interrupting the execution of all other commands.

[0007] Preferably, the multi-level interlocking module includes a primary interlocking relay, a secondary interlocking relay, a tertiary interlocking relay, and an interlocking status feedback unit, and uses a waterproof and dustproof electromagnetic relay with a rated voltage of 24V and a contact current of 20A or more. The working principle is that three relays are connected in series and form signal verification connections with the front-end module respectively: receiving the effective braking signal from the redundant acquisition module, the primary relay is energized when the signal matches; receiving the working condition risk level signal forwarded by the electronic control core module, the secondary relay is energized when the condition is met; receiving the fault-free confirmation signal from the fault diagnosis module, the three-level interlocking relays are energized when the status is normal. Only when all three relays are energized is the start circuit conduction signal sent to the start control module. After each relay is engaged, it sends an acknowledgment signal to the electronic control core module via the feedback pin. If no acknowledgment signal is received within 50ms, the interlock is deemed to have failed, and the start-up circuit is immediately cut off. An alarm signal is also sent to the electronic control core module and the human-machine warning module. An additional independent emergency cut-off circuit is set up in parallel with the three-level interlock circuit. It can respond to the emergency stop signal of the human-machine warning module. When the system is powered on, it automatically performs relay engagement and disengagement cycle detection. The detection results are fed back to the fault diagnosis module for archiving.

[0008] Preferably, the human-machine early warning module includes a touch screen display, an audible and visual alarm unit, and an emergency stop button; The touch screen receives and displays the start-up condition status, risk level, and fault code sent by the electronic control core module in real time; when the start-up condition is not met, it receives the warning command from the electronic control core module, and the audible and visual alarm unit triggers a graded warning according to the cause: no braking, slope risk, sensor failure; After the emergency stop button is triggered, a cut-off signal is sent to the multi-level interlocking module and the start control module to cut off the start circuit and the brake maintenance circuit, thereby achieving emergency braking. At the same time, the emergency intervention status is fed back to the electronic control core module.

[0009] Preferably, the start control module consists of a start motor drive unit, a start timeout protection unit, a start interval protection unit, and a brake maintenance control unit; After receiving the conduction signal from the multi-level interlocking module, the motor drive unit starts the motor and sends a start-up status signal to the electronic control core module. The start-up timeout protection unit sets the maximum start-up time. If the motor fails to start within the timeout period, the circuit is automatically cut off, and a start-up timeout fault information is sent to the fault diagnosis module. The start-up interval protection unit sets the minimum start-up interval. After successful startup, the brake maintenance control unit detects the engine speed through the engine speed sensor. When the speed reaches 800 rpm or above and is determined to be stable, it controls the brake circuit to continue to maintain the braking state for 2 to 3 seconds before automatically releasing it. At the same time, it sends a startup success signal to the electronic control core module, triggering the human-machine warning module to update the status display.

[0010] Preferably, the fault diagnosis module includes a fault detection unit, a data storage unit, and a CAN bus export interface; The fault detection unit monitors the sensor status of the redundant acquisition module, the signal transmission status of the operating condition assessment module, the operation status of the electronic control core module, the relay status of the multi-level interlocking module, the alarm status of the human-machine early warning module, and the drive unit status of the start control module in real time via the CAN bus. Combined with the fault diagnosis results of the electronic control core module, it generates standardized fault codes. The fault information is synchronized to the electronic control core module and the human-machine early warning module in real time, triggering corresponding start prohibition commands and graded warnings. The data storage unit can store the most recent 100 fault records, and the data is not lost after power failure; maintenance personnel can read the fault data through the CAN bus export interface.

[0011] The beneficial effects of this invention are as follows: 1. This invention employs a dual-redundant pilot pressure sensor architecture combined with hydraulic signal filtering and validity verification, achieving dual acquisition and accurate verification of braking signals. The dual sensors synchronously acquire signals and perform noise reduction processing. The validity of the signals is confirmed through comparative analysis, and the pressure threshold can be adaptively calibrated by the ECU to adapt to different braking requirements. Once a signal abnormality occurs, the system will automatically switch to the backup sensor and simultaneously provide fault information. This solves the problem of interlocking misjudgment caused by a single sensor failure, avoids situations where startup is mistakenly allowed or prohibited without cause, ensures the continuity and reliability of braking signal acquisition, and lays a solid signal foundation for the safe starting of the loader.

[0012] 2. This invention collects working condition parameters through multi-dimensional sensors of tilt angle, gear position, and load, establishing a three-level risk assessment system. Coupled with a dynamic adjustment mechanism, it ensures both safety and operational flexibility. In high-risk scenarios such as slopes, heavy loads, and gear shifting, the system automatically prohibits starting and enhances braking force. If the operator activates the slope assist braking function, the risk level can be appropriately lowered to better meet actual operational needs. It achieves accurate identification and graded prevention and control of risks in different operating scenarios, effectively avoiding potential safety hazards such as slope slippage and heavy load lurching, making safety protection more suitable for the diverse operating conditions of loaders.

[0013] 3. This invention adopts a three-level series interlocking structure to verify the braking signal, operating condition risk, and system status sequentially. The starting circuit is only activated when all three levels of verification meet the standards. It also adds an independent emergency cut-off circuit and a power-on self-test function. Furthermore, the fault diagnosis module monitors the entire system's operating status in real time, generates standardized fault codes, and stores the 100 most recent fault records. Data is not lost after power failure and can be exported and retrieved later. This multi-level redundant protection eliminates single-point fault risks and enables rapid fault location and efficient repair, improving system stability and maintainability, and ensuring the continued effectiveness of the safe start-up mechanism. Attached Figure Description

[0014] Figure 1 This is a flowchart of the overall system of the present invention; Figure 2 This is a connection diagram of the core electrical components of the present invention; Figure 3 This is a hardware topology diagram of the system of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] like Figures 1 to 3 As shown, an embodiment of the present invention provides a loading mechanism brake pilot safety start system, comprising: The redundant acquisition module is designed to achieve accurate and reliable acquisition of hydraulic signals for braking actions, avoiding signal failure caused by a single sensor malfunction. It includes a dual-redundant pilot pressure sensor, a hydraulic signal filtering unit, and a signal validity verification unit. The dual-redundant pilot pressure sensor includes a main sensor and a backup sensor, and uses a high-precision piezoresistive pressure sensor with a response time of 10ms or less. When the operator presses the brake pedal, the hydraulic circuit generates pilot pressure. Dual redundant pilot pressure sensors synchronously collect pressure signals. After the filtering unit removes signal noise caused by hydraulic shock, the signal validity verification unit compares and analyzes the two signals. The pressure threshold can be adaptively calibrated by the ECU according to the hydraulic parameter range of the loader braking system to adapt to different braking requirements such as no-load and heavy-load. If the two signals are consistent and reach the preset pressure threshold (0.8 to 1.2 MPa), they are determined to be valid braking signals and are synchronously output to the primary interlocking unit of the electronic control core module and the multi-level interlocking module. If only one signal is valid or exceeds the preset deviation range, it is determined to be a signal abnormality. In addition to immediately sending fault information to the fault diagnosis module and triggering the human-machine warning module alarm, it automatically switches to the standby sensor independent working mode to ensure that the basic braking signal acquisition is not interrupted, and at the same time records the fault sensor information for subsequent maintenance.

[0017] The dual-redundant pilot pressure sensor is an MPX5700 series sensor, installed on both sides of the oil inlet of the brake pilot hydraulic circuit, with the distance between the two sensors not exceeding 5cm. The hydraulic signal filtering unit adopts a second-order RC low-pass filter circuit with a cutoff frequency set to 10Hz, a filter capacitor of 10μF, and a resistor of 1.6kΩ. The preset deviation range of the signal validity verification unit is set to ±5%. When the difference between the two signals exceeds this range, it is determined that the signal is abnormal.

[0018] The trigger condition for ECU adaptive calibration is: within 3 consecutive start cycles, the actual threshold of the braking signal deviates from the preset threshold by ≥10%; the calibration process is: the ECU reads the hydraulic parameters of the braking system through the CAN bus, takes the actual pressure peak of each effective braking as a sample, takes the average of 10 consecutive samples as the new threshold, and the deviation after calibration is ≤3%; during the calibration process, the system maintains the original braking signal validity judgment logic, and automatically overwrites the original preset value after the new threshold takes effect, and at the same time stores the calibration record to the fault diagnosis module.

[0019] The working condition assessment module is designed to identify the current operating condition of the loader and assess the risk level of startup, providing a basis for the decision-making of the electronic control core module and the secondary verification of the multi-level interlocking module, thus solving the problem of the one-size-fits-all protection of traditional systems. It includes a tilt sensor, a gear position sensor, a load pressure sensor, and a risk level determination unit. The tilt sensor is used to detect the slope angle, with a measurement range of ±30° and a measurement accuracy of ±0.1°. The load pressure sensor is installed in the main oil circuit of the bucket hydraulic circuit.

[0020] The working principle is as follows: the tilt sensor detects the tilt angle of the loader in real time to determine whether it is in a slope condition. A slope of 5° or above is considered a high-risk slope. The gear position sensor collects the current gear status, including neutral, forward, and reverse. The load pressure sensor detects the bucket load. A load of 60% or above of the rated load is considered a heavy-load condition. The risk level determination unit integrates the above signals and also has a dynamic adjustment mechanism. When the loader is on a slope but the operator manually activates the slope assist braking function, the risk level can be reduced from high risk to medium risk, balancing safety and operational flexibility. Finally, the starting risk is divided into three levels and uploaded to the electronic control core module in real time. At the same time, it is synchronized to the human-machine warning module for display: low risk (neutral, flat ground, light load), medium risk (slope / heavy load, neutral), and high risk (in gear, slope and heavy load coexist). In the case of high-risk conditions, in addition to feeding back a prohibition signal to the electronic control core module, it will also trigger the electronic control core module to control the braking system to increase braking force and prevent the risk of slippage from escalating.

[0021] The weighting rules for the risk level determination unit are as follows: slope factor weight 0.5, load factor weight 0.3, gear factor weight 0.2; a new dynamic adjustment mechanism has been added: when the operator activates the heavy load stabilization mode under heavy load conditions, the risk level can be reduced from high risk to medium risk; details of the risk level determination thresholds have been clarified: low risk (slope < 5°, load < 60% of rated load, neutral), medium risk (slope 5°-15° and neutral, or load 60%-80% of rated load and neutral, or the original high-risk scenario after activating the ramp assist braking / heavy load stabilization mode), and high risk (slope > 15°, load > 80% of rated load, in gear, or ramp and heavy load coexisting and the corresponding auxiliary function is not activated).

[0022] The specific method for enhancing braking force in the braking system is as follows: the electromagnetic proportional valve of the brake master pump is controlled by the electronic control core module to increase the brake hydraulic pressure from 1.0-1.5MPa under normal starting conditions to 1.8-2.2MPa; the duration of enhanced braking force is linked to the risk level: it is maintained continuously when the high-risk condition has not been resolved, and the normal pressure is restored within 3 seconds after the risk level drops to medium risk; the load pressure sensor has a detection frequency of 10Hz and updates the load data in real time to dynamically adjust the braking force.

[0023] The core electronic control module is designed to integrate the input signals from the redundant acquisition module, operating condition assessment module, and fault diagnosis module, and to perform logical judgments, fault diagnosis, and command issuance. It consists of a main control chip, a logic operation unit, a fault diagnosis algorithm module, and a CAN bus communication unit. The main control chip is a 32-bit high-performance microcontroller with an operating frequency of 100MHz or higher, supporting multi-task parallel processing.

[0024] The system receives valid braking signals from the redundant acquisition module and risk level signals from the operating condition assessment module in real time via the CAN bus. It also receives system fault status information from the fault diagnosis module. The preset rules of the logic operation unit support online algorithm upgrades via the CAN bus to adapt to different regional safety standards and user-specific needs. The system performs judgments based on the joint conditions of "valid braking signal exists, risk level is medium or below, and there is no system fault": if the conditions are met, a start permission command is generated and sent to the multi-level interlocking module, and a "start condition met" status signal is sent to the human-machine warning module; if the conditions are not met, a start prohibition command is generated and synchronously fed back to the multi-level interlocking module and the human-machine warning module to trigger corresponding warnings.

[0025] The fault diagnosis algorithm module integrates threshold judgment, trend analysis, and comparative diagnosis methods to effectively improve the accuracy of fault identification. It identifies the fault types of each module in real time through signal feature analysis. The command issuance adopts a priority mechanism, with the emergency stop command having the highest priority and being able to interrupt the execution of all other commands to ensure rapid response in the event of a sudden danger.

[0026] The joint judgment of the logic operation unit adopts the "three-condition AND gate" logic, and generates a start permission command only when "valid braking signal exists", "risk level ≤ medium risk" and "no system fault" are met simultaneously; details of the fault diagnosis algorithm module: the signal deviation threshold of the threshold judgment method is ±5%, the time window of the trend analysis method is set to 100ms, and the comparison diagnosis method realizes fault identification by comparing the difference between the main and backup sensor signals with the preset deviation threshold; the automatic triggering scenario of the emergency stop command has been added: failure of the multi-level interlocking module, and brake maintenance circuit pressure <0.5MPa or >2.0MPa; the preset rules of the logic operation unit are upgraded online to support the CAN bus 2.0B protocol, and the upgrade data packet encryption method adopts AES-128.

[0027] The priority order for multi-task parallel processing is as follows: emergency stop command processing (highest priority) > fault diagnosis signal processing > risk level signal processing > braking signal processing > start permission command generation > online upgrade task (lowest priority); the main control chip is STM32H743VIT6, the CAN bus communication rate is set to 250kbps, and the signal transmission delay is ≤20ms; the joint judgment response time of the logic operation unit is ≤50ms to ensure rapid execution of start decisions.

[0028] The multi-level interlocking module is designed to receive the start-up permission command from the core electronic control module, and, in conjunction with the verification signals from the redundant acquisition module and the fault diagnosis module, to achieve on / off control of the start-up circuit through multi-level interlocking verification, thus eliminating safety hazards caused by single-point interlocking failure. It includes a primary interlocking relay (braking signal verification), a secondary interlocking relay (operating condition risk verification), a tertiary interlocking relay (fault status verification), and an interlocking status feedback unit. Waterproof and dustproof electromagnetic relays are selected, with a rated voltage of 24V and a contact current of 20A or higher, suitable for the harsh operating environment of construction machinery.

[0029] The working principle is that three relays are connected in series and form signal verification connections with the front-end module respectively: ① Primary interlock: Receives the valid braking signal from the redundant acquisition module. If the signal matches, the primary relay is energized; ② Secondary interlock: Receives the working condition risk level signal forwarded by the electronic control core module. If the risk level is medium or below, the secondary relay is energized; ③ Tertiary interlock: Receives the fault-free confirmation signal from the fault diagnosis module. If the status is normal, the tertiary interlock relay is energized. Only when all three relays are energized is the start circuit conduction signal sent to the start control module.

[0030] After each relay is activated, it sends an acknowledgment signal to the electronic control core module via the feedback pin. If no acknowledgment signal is received within 50ms, it is determined that the interlock has failed. The starting circuit is immediately cut off, and an alarm signal is sent to the electronic control core module and the human-machine warning module. The interlock circuit is additionally equipped with an independent emergency cut-off circuit, which runs in parallel with the three-level interlock circuit. It can directly respond to the emergency stop signal of the human-machine warning module, further eliminating the risk of interlock failure. When the system is powered on, it will automatically perform relay activation and deactivation cycle detection, and the detection results will be fed back to the fault diagnosis module for archiving.

[0031] The three-level interlocking relay selected is model HF32FA-024-Z (waterproof and dustproof electromagnetic relay), with normally open contacts. The interlocking self-test process is as follows: After the system is powered on, the primary, secondary, and tertiary relays are sequentially controlled to engage for 30ms and then disengage. Each relay completes the engagement-disengagement cycle twice, with a cycle interval of 50ms. Failure to act according to the instruction is considered a self-test failure. The emergency cut-off circuit is connected to the main starting circuit in parallel, and the cut-off signal is transmitted via a standard CAN bus frame. The status feedback signal after the relay engages is a 5V high-level active signal with a feedback delay of ≤10ms.

[0032] The emergency cut-off circuit has a response time of ≤10ms, and the cut-off signal is active at a high level (voltage ≥12V). When the system fails to power on and self-test, all three interlocking relays remain open and send a "interlocking self-test failure" fault code to the human-machine warning module, prohibiting the start-up circuit from conducting. The mechanical life of the relay contacts is ≥100,000 times and the electrical life is ≥50,000 times, meeting the long-term operation requirements of engineering machinery.

[0033] The human-machine early warning module is designed to visualize the startup status, provide fault warnings, and enable emergency intervention. It also serves as an interaction hub between the operator and the system, connecting the core electrical control module, multi-level interlocking module, and startup control module to enhance the operator's right to know and emergency response capabilities. It includes a touchscreen display, an audible and visual alarm unit, and an emergency stop button. The touchscreen display is a 3.5-inch high-definition color screen with a brightness of 500 cd / m². 2 The engine is caliber 2000 and above, visible in sunlight, and the operating buttons are waterproof. The audible and visual alarm unit uses a graded alarm speaker and LED indicator. The emergency stop button is installed on the right-side handrail of the cab, with a protective cover to prevent accidental touch, and needs to be rotated to reset after being pressed.

[0034] The working principle is that the touch screen receives and displays the start-up condition status (braking signal, operating condition risk, system fault), risk level, and fault code sent by the electronic control core module in real time; when the start-up condition is not met, it receives the warning command from the electronic control core module, and the audible and visual alarm unit triggers a graded warning according to the cause: no braking, slope risk, sensor failure; when there is no braking, the red LED is constantly lit and there is a continuous buzzer; when there is a slope risk, the yellow LED flashes and there is an intermittent buzzer; when there is a sensor failure, the orange LED is constantly lit and the fault code is announced by voice, supporting Chinese and English switching.

[0035] Once the emergency stop button is triggered, it directly sends a cut-off signal to the multi-level interlocking module and the start control module, cutting off the start circuit and the brake maintenance circuit to achieve emergency braking, and at the same time feeding back the emergency intervention status to the electronic control core module.

[0036] The operation logic of the touch screen is as follows: a short press (≤1 second) switches the display page, and a long press (≥3 seconds) enters the parameter setting interface; the parameter setting interface requires a password and supports modification of parameters such as start-up timeout duration, start-up interval duration, and alarm volume; the volume range of the sound and light alarm unit is 60-100dB, supports 3 levels of adjustment, and the default volume is 80dB; the luminous intensity of the LED indicator is ≥2000mcd to ensure visibility in harsh lighting conditions.

[0037] The starting control module is designed to receive the activation signals from the multi-level interlocking module, precisely control the operating status of the starter motor, optimize the starting process, and simultaneously provide feedback on the operating status to the electronic control core module and the fault diagnosis module to prevent damage to starting components and the risk of sudden vehicle acceleration after starting. It consists of a starter motor drive unit, a starter timeout protection unit, a starter interval protection unit, and a brake maintenance control unit. The starter motor drive unit has an overcurrent protection threshold of 30A and an overtemperature protection threshold of 85℃, and automatically resets after a 30-second delay following protection activation.

[0038] The working principle is as follows: after receiving the conduction signal from the multi-level interlocking module, the motor drive unit starts the motor and sends a "starting" status signal to the electronic control core module. The start timeout protection unit sets the maximum start time (3 to 5 seconds, calibrable). If the motor does not start within the timeout period, the circuit is automatically cut off and a "start timeout" fault message is sent to the fault diagnosis module. The start interval protection unit sets the minimum start interval (10 to 15 seconds) to avoid frequent starts that could cause the motor to overheat.

[0039] After successful startup, the brake maintenance control unit detects the engine speed through the engine speed sensor. When the speed reaches 800 rpm or above and is determined to be stable, it controls the brake circuit to continue to maintain the braking state for 2 to 3 seconds before automatically releasing it to prevent the vehicle from lurching forward. At the same time, it sends a "start successful" signal to the electronic control core module, triggering the human-machine warning module to update the status display.

[0040] The start-up timeout protection duration is calibrated as follows: 3 seconds for engine displacement 1.5-3.0L, 4 seconds for 3.0-5.0L, and 5 seconds for above 5.0L; the start-up interval protection duration can be manually adjusted via the touch screen, with an adjustment range of 5-20 seconds; the engine speed sensor uses a Hall effect sensor, and the signal is transmitted to the brake holding control unit via the CAN bus; the delay time for releasing the brake supports adaptive operation: extended to 3-4 seconds under slope conditions, and maintained at 2 seconds under flat, light-load conditions; the overcurrent protection threshold of the starter motor drive unit is 30A, and the overtemperature protection threshold is 85℃, and it automatically resets after a 30-second delay after triggering the protection.

[0041] The normal operating pressure range of the brake holding circuit is 0.8-1.5MPa. When the pressure is lower than 0.5MPa or higher than 2.0MPa, the brake holding control unit will immediately trigger a fault alarm. The drive voltage of the starter motor drive unit is 24V, and the output power is ≥5kW, which is suitable for the normal starting power requirements of the loader. The signal sampling frequency of the engine speed sensor is 50Hz to ensure the accuracy of speed detection.

[0042] The fault diagnosis module is designed to monitor the operating status of all modules in real time, store fault information and synchronize it to relevant modules, thereby achieving status integration with the entire system and improving system maintainability. It includes a fault detection unit, a data storage unit, and a CAN bus export interface. The data storage unit uses a non-volatile Flash memory with a storage capacity of 1MB or more, which can cyclically overwrite old data. The CAN bus export interface supports the CAN2.0A / B protocol and can read data through a dedicated diagnostic instrument or a mobile APP.

[0043] The fault detection unit monitors the sensor status of the redundant acquisition module, the signal transmission status of the operating condition assessment module, the operation status of the electronic control core module, the relay status of the multi-level interlocking module, the alarm status of the human-machine warning module, and the drive unit status of the start control module in real time via the CAN bus. Combined with the fault diagnosis results of the electronic control core module, it generates standardized fault codes. The first two digits are the module number, and the last two digits are the fault type number, such as "P01 Brake sensor 1 fault" and "P02 Ramp sensor signal abnormality", which facilitates rapid identification. The fault information is synchronized to the electronic control core module and the human-machine warning module in real time, triggering the corresponding start prohibition command and graded warning.

[0044] The data storage unit can store the most recent 100 fault records, including fault codes, occurrence time, and operating parameters. The data is not lost after power failure. Maintenance personnel can read the fault data through the CAN bus export interface to quickly locate the fault point.

[0045] Standardized fault code coding rules: Module number (01-Redundant acquisition module, 02-Operating condition assessment module, 03-Electrical control core module, 04-Multi-level interlocking module, 05-Human machine early warning module, 06-Start control module, 07-Fault diagnosis module), fault type number (01-Sensor fault, 02-Signal transmission fault, 03-Relay fault, 04-Start timeout, 05-Interlock failure, 06-Pressure abnormality, 07-Power supply fault); Data storage unit uses Flash memory; CAN bus export interface adopts DB9 physical interface, supporting CAN2.0A / B protocol; Mobile APP connection supports Bluetooth 5.0 protocol, communication distance ≤10 meters, data transmission format is JSON.

[0046] The fault record is stored in the following format: fault code + occurrence time + operating parameters at that time (slope, load, gear, brake pressure); the fault detection unit has a detection cycle of 50ms and scans the status of each module in real time; when the fault occurs 3 times in a row and is not resolved, the system automatically switches to emergency mode, which can only be started under low-risk operating conditions, and the operator needs to confirm the emergency start command.

[0047] The system's operating power supply range is 24V±10%, supporting wide voltage input to adapt to loader power fluctuations; each module has an IP65 protection rating, can withstand an operating temperature range of -40℃ to 85℃, and a relative humidity range of 10%-95% (non-condensing); the overall system power consumption is ≤30W, and the peak power consumption at startup is ≤80W, which does not affect the normal operation of other electrical equipment on the loader.

[0048] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0049] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A loader brake pilot safety start system characterized by, Comprise: Redundant acquisition module: adopt double redundant acquisition architecture, integrated signal noise reduction and effectiveness verification function, double synchronous acquisition brake related signal, after processing verification standard to electric control core module and multi-stage interlock module bidirectional output effective signal, abnormal automatic switching to standby acquisition unit and feedback fault information; Working condition evaluation module: collect attitude, gear, load and other working condition parameters, with dynamic risk adjustment mechanism, divide multi-stage starting risk and realize signal synchronization with electric control core module and man-machine warning module, build safety protection mode suitable for different operation scenarios; Electric control core module: integrated control, logic operation, fault diagnosis and bus communication function, based on multi-condition joint judgment to generate starting permission or prohibition instruction, use priority instruction mechanism to ensure emergency response, realize two-way signal and instruction coordination flow with each module; Multi-stage interlock module: adopt three-stage series interlock structure, integrated state feedback function, verify brake signal, working condition risk and system state respectively, add independent emergency shutdown circuit and self-checking function, form multiple protection through multi-module signal verification; Man-machine warning module: integrated visual display, hierarchical warning and emergency control function, receive associated module signals and feedback operation state, reduce the probability of misoperation; Starting control module: integrated drive, starting protection and brake maintenance control function, with starting protection and delay unbraking function, form closed loop control through state feedback; Fault diagnosis module: integrated fault detection, data storage and information export function, generate standardized fault code and synchronize to associated module, store fault record for maintenance to quickly locate fault.

2. The loader brake lead safety shutdown system of claim 1, wherein, The redundant acquisition module includes double redundant pilot pressure sensor, hydraulic signal filter unit and signal effectiveness verification unit; when the operator steps on the brake pedal to generate pilot pressure, the double redundant pilot pressure sensor synchronously acquires the pressure signal, after noise reduction by the filter unit, the signal effectiveness verification unit performs double signal comparison and analysis, and the pressure threshold can be calibrated by the ECU; when the two signals are consistent and reach the preset pressure threshold, it is determined as an effective brake signal and is synchronously output to the electric control core module and the primary unit of the multi-stage interlock module; when the signal is abnormal, send fault information to the fault diagnosis module, trigger the man-machine warning module alarm, automatically switch to the standby sensor and record fault information.

3. The loader brake lead safety shutdown system of claim 2, wherein, The working condition evaluation module includes an inclination sensor, a gear position sensor, a load pressure sensor and a risk level determination unit; the inclination sensor detects the inclination angle of the loader to determine the slope working condition, the gear position sensor acquires the gear state, the load pressure sensor detects the bucket load, and the risk level determination unit integrates the above signals and adapts to the operation demand through dynamic adjustment mechanism, divides the starting risk into low, medium and high levels and uploads to the electric control core module in real time, and simultaneously synchronizes to the man-machine warning module display; under high risk working condition, feedback the prohibition starting signal to the electric control core module, and trigger the electric control core module to control the brake system to enhance the braking force.

4. The loader brake pilot safety shutdown system of claim 3, wherein, The electric control core module includes a main control chip, a logic operation unit, a fault diagnosis algorithm module and a CAN bus communication unit; the effective braking signal of the redundant acquisition module, the risk level signal of the working condition evaluation module and the system fault state information of the fault diagnosis module are received in real time through the CAN bus, the preset rule of the logic operation unit supports online upgrade through the CAN bus; based on the joint conditions of the existence of the effective braking signal, the risk level being medium risk or below and no system fault, if the conditions are met, a start permission instruction is generated and sent to the multi-stage interlock module and the state is fed back to the man-machine early warning module, if the conditions are not met, a start prohibition instruction is generated and the corresponding warning is triggered; the fault diagnosis algorithm module integrates multiple diagnosis methods to improve the recognition accuracy, and the instruction sending adopts a priority mechanism, and the emergency stop instruction has the highest priority.

5. The loader brake pilot safety shutdown system of claim 4, wherein, The multi-stage interlock module includes a primary interlock relay, a secondary interlock relay, a tertiary interlock relay and an interlock state feedback unit; the tertiary relays are connected in series and respectively form signal verification connection with the redundant acquisition module, the electric control core module and the fault diagnosis module: after receiving the effective braking signal, the primary relay is attracted, after receiving the working condition risk level signal, the secondary relay is attracted, after receiving the no system fault signal, the tertiary relay is attracted, and when all the tertiary relays are attracted, a start loop guide signal is sent to the start control module; after each relay is attracted, a confirmation signal is sent to the electric control core module, and if the signal is not received within a timeout, it is determined that the interlock fails, the start loop is immediately cut off and an alarm signal is sent; an independent emergency cut-off loop is added to the interlock loop, and when the system is powered on, the interlock self-check is automatically performed and the result is fed back to the fault diagnosis module for archiving.

6. The loader brake pilot safety shutdown system of claim 5, wherein, The man-machine early warning module includes a touch display screen, an audible and visual alarm unit and an emergency stop button; the touch display screen displays the start condition state, the risk level and the fault code in real time; when the start condition is not met, the audible and visual alarm unit triggers a hierarchical warning according to different reasons such as no braking, slope risk and sensor failure; after the emergency stop button is triggered, a cut-off signal is sent to the multi-stage interlock module and the start control module to cut off the start and brake maintenance loop to realize emergency braking, and the emergency intervention state is fed back to the electric control core module.

7. The loader brake pilot safety shutdown system of claim 6, wherein, The start control module includes a start motor driving unit, a start timeout protection unit, a start interval protection unit and a brake maintenance control unit; after receiving the guide signal of the multi-stage interlock module, the driving unit controls the motor to start and feeds back the start state; the timeout protection unit sets the maximum start time, and if the start is not successful within the timeout, the loop is cut off and fault information is sent to the fault diagnosis module; the start interval protection unit sets the minimum start interval; after the start is successful, the brake maintenance unit detects that the engine speed reaches 800 rpm or above to determine that it is stable, then the brake state is maintained for 2 to 3 seconds and then automatically released, a start success signal is fed back and the man-machine early warning module is triggered to update the state.

8. The loader brake pilot safety shutdown system of claim 7, wherein, The fault diagnosis module comprises a fault detection unit, a data storage unit and a CAN bus export interface; the fault detection unit monitors the working state of each module in real time through the CAN bus, generates a standardized fault code in combination with the diagnosis result of the electric control core module, and synchronizes the fault information to the electric control core module and the man-machine early warning module in real time and triggers the corresponding prohibition start instruction and hierarchical early warning; The data storage unit stores fault records and does not lose power, and the maintenance personnel can read fault data through the export interface.

Images