Method for extreme protection and fault tolerance processing

Abstract

The application relates to the technical field of intelligent control, and discloses a limit protection and fault-tolerant processing method, which comprises the following steps: deviation checking is performed on positive and reverse position data when a bidirectional limit is triggered and a diagnosis time position value, so that position difference data is obtained; sign identification is performed on an upper limit and a lower limit difference value, so that a safety mark and an out-of-bound mark are generated; based on the two, logical judgment is performed on state data and motion direction data, so that fault determination data is obtained; type identification is performed on a fault code, so that mode switching data is generated; and according to a failure mark, shielding processing is performed on a bidirectional limit mark, so that effective state marks are obtained; the effective state marks are used as auxiliary monitoring data; according to a takeover signal mark, control basis is switched to real-time position data, so that a fault-tolerant control mode is established; finally, boundary detection is performed on the real-time position data, and corresponding protection instructions are generated according to limit states; and the application can improve the efficiency of limit protection and fault-tolerant processing.

Description

Technical Field

[0001] This invention relates to the field of intelligent control technology, and in particular to a method for limit protection and fault tolerance. Background Technology

[0002] In existing motion control limit protection technologies, the system typically relies solely on the hard contact signals provided by limit switches installed at both ends of the mechanical travel as the sole basis for protection. This protection method, which solely depends on hardware signals, has significant reliability flaws. As mechanical or contact components, limit switches are prone to problems such as contact oxidation, mechanical fatigue, or foreign object jamming during long-term operation, leading to signal failure to trigger correctly. Simultaneously, strong electromagnetic interference in the field can also cause momentary signal jitter or false triggering. Since the control system lacks means to verify the validity of the signal, once these situations occur, the limit protection logic will directly generate erroneous actions or completely fail, potentially causing moving parts to exceed their permissible range, resulting in equipment damage or safety accidents.

[0003] Furthermore, existing technologies lack systematic diagnostic and fault-tolerant mechanisms when handling limit signal faults. When limit switches experience open circuits, short circuits, or poor signal line contact, the control system typically cannot identify the fault type and can only passively receive erroneous status information, unable to distinguish between a genuine out-of-bounds event and a sensor malfunction. After a fault occurs, the system lacks means to isolate the failed signal and the ability to dynamically switch control criteria, often resorting to simple shutdown and alarm measures, leading to production interruptions. Moreover, information on multiple fault states is scattered across different flag bits, lacking a unified encoding and parsing method, making fault location difficult, maintenance inefficient, and unable to maintain limited equipment operation while ensuring safety. Summary of the Invention

[0004] This invention provides a limit protection and fault tolerance method to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a limit protection and fault-tolerant processing method, comprising:

[0006] S1. The forward and reverse position data when the moving load triggers the bidirectional limit signal during the target process are respectively compared with the position value of the moving load at the diagnosis time to obtain the position difference data of the target process.

[0007] S2. Perform sign recognition on the upper limit difference and lower limit difference in the position difference data respectively to obtain the safety mark and boundary crossing mark of the target process;

[0008] S3. Based on the safety sign and the boundary crossing sign, perform logical judgment on the state data and motion direction data of the moving load to obtain the fault judgment data of the target process;

[0009] S4. The fault codes in the fault determination data are identified by type, the mode switching data of the target process is generated, and the positive limit sign and the reverse limit sign of the status data are masked according to the failure sign of the mode switching data to obtain the effective status sign of the target process.

[0010] S5. Using the effective status identifier as auxiliary monitoring data, and according to the takeover signal identifier in the mode switching data, cut off the original status data channel of the limit protection in the target process, and switch the control basis of the limit protection from the status data to the real-time position data of the moving load to obtain the fault-tolerant control mode of the target process.

[0011] S6. In the fault-tolerant control mode, boundary detection is performed on the real-time position data to obtain the limit state of the target process, and the corresponding drive command generated according to the limit state is used as the protection command of the target process.

[0012] In a preferred embodiment, the step of verifying the deviation between the forward and reverse position data when the moving load triggers the bidirectional limit signal during the target process and the position value at the diagnostic time of the moving load to obtain the position difference data of the target process includes:

[0013] The difference between the diagnostic time position value and the positive position data is used as the first deviation of the target process;

[0014] The difference between the diagnostic time position value and the reverse position data is used as the second deviation of the target process;

[0015] The first deviation is used as the high-order data, and the second deviation is used as the low-order data, which are then concatenated to form the positional difference data of the target process.

[0016] In a preferred embodiment, the step of performing sign recognition on the upper and lower limit differences in the position difference data to obtain the safety flag and boundary crossing flag of the target process includes:

[0017] When the upper limit difference in the location difference data is greater than or equal to zero, a positive boundary crossing flag is generated for the target process; when the upper limit difference in the location difference data is less than zero, a positive safety flag is generated for the target process.

[0018] When the lower limit difference in the location difference data is less than or equal to zero, a reverse boundary crossing flag for the target process is generated; when the lower limit difference in the location difference data is greater than zero, a reverse safety flag for the target process is generated.

[0019] The forward boundary crossing sign, the forward safety sign, the reverse boundary crossing sign, and the reverse safety sign are collectively used as the safety sign and boundary crossing sign for the target process.

[0020] In a preferred embodiment, the step of performing logical judgments on the state data and direction data of the moving load based on the safety sign and the boundary crossing sign to obtain fault determination data for the target process includes:

[0021] A logical AND operation is performed on the positive boundary crossing flag, the positive limit status identifier in the status data, and the direction identifier in the motion direction data to obtain the first combined state value of the target process;

[0022] The logical product of the reverse boundary crossing flag, the reverse limit status identifier in the status data, and the direction identifier in the motion direction data is used as the second combined state value of the target process;

[0023] The positive safety sign and the positive limit status sign are combined to obtain the third combined state value of the target process;

[0024] An AND operation is performed on the reverse safety flag and the reverse limit status flag to obtain the fourth combined state value of the target process;

[0025] The first combined state value, the second combined state value, the third combined state value, and the fourth combined state value are concatenated bit by bit to obtain the fault determination data of the target process.

[0026] In a preferred embodiment, the step of identifying the type of fault codes in the fault determination data, generating mode switching data for the target process, and masking the positive and negative limit indicators of the status data based on the failure indicators of the mode switching data to obtain the valid status indicator of the target process includes:

[0027] The fault code is reverse-parsed to obtain the fault type identification result of the target process;

[0028] The positive failure identifier and the negative failure identifier in the fault type identification result are inverted respectively to obtain the positive enable signal and the negative enable signal of the target process.

[0029] The bits of the positive enable signal are used as a mask, and a bitwise AND operation is performed with the positive limit status identifier to obtain the masked positive identifier of the target process.

[0030] Using the reverse enable signal as a gating signal, the reverse limit state identifier is selected to obtain the shielded reverse identifier of the target process;

[0031] The positive shielding identifier and the negative shielding identifier are aggregated into a valid status identifier for the target process.

[0032] In a preferred embodiment, the formula for calculating the fault code includes:

[0033]

[0034] in, The fault code, The positive out-of-bounds signal is indicated in the fault determination data. The reverse out-of-bounds signal is not identified in the fault determination data. This is a positive false alarm identifier in the fault determination data. This is the reverse false alarm identifier in the fault determination data. For prime numbers, For modulo operation, It is the modulus.

[0035] In a preferred embodiment, the step of using the valid status identifier as auxiliary monitoring data and, based on the takeover signal identifier in the mode switching data, cutting off the original status data channel of the limit protection in the target process, and switching the control basis of the limit protection from the status data to the real-time position data of the moving load to obtain the fault-tolerant control mode of the target process includes:

[0036] The control basis switching process for triggering the target process is based on the valid status of the takeover signal identifier.

[0037] In the control basis switching process, the main input source of the limit protection determination is switched from the bidirectional limit status identifier in the status data to the real-time position data to obtain the fault-tolerant control mode identifier of the target process.

[0038] The fault-tolerant control mode identifier is stored together with the auxiliary monitoring data to obtain the fault-tolerant control mode.

[0039] In a preferred embodiment, the control basis switching process that triggers the target process based on the valid state of the takeover signal identifier includes:

[0040] The takeover signal identifier is periodically sampled to obtain the historical binary value and the instantaneous binary value of the takeover signal identifier; a difference operation is performed on the instantaneous binary value and the historical binary value to obtain the difference result of the takeover signal identifier;

[0041] The rising edge component of the difference result is used as a pulse source and assigned to the edge triggering variable of the target process to obtain the rising edge triggering pulse of the target process.

[0042] The control basis for initiating the target process is the switching procedure, which uses the rising edge trigger pulse as a switching command.

[0043] In a preferred embodiment, in the fault-tolerant control mode, boundary detection is performed on the real-time location data to obtain the limit state of the target process, and the corresponding drive command generated based on the limit state is used as the protection command for the target process, including:

[0044] The difference between the real-time location data and the forward location data is used as the forward remaining travel data of the target process;

[0045] The difference between the real-time location data and the reverse location data is used as the reverse remaining travel data of the target process;

[0046] If the remaining forward travel data is less than or equal to zero, a positive limit trigger flag for the target process is generated; if the remaining forward travel data is greater than zero, a positive safety flag for the target process is generated.

[0047] If the reverse remaining travel data is greater than or equal to zero, a reverse limit trigger flag for the target process is generated; if the forward remaining travel data is less than zero, a reverse safety flag for the target process is generated.

[0048] The protection command for the target process is determined based on the logical combination of the positive limit trigger flag and the reverse limit trigger flag.

[0049] In a preferred embodiment, determining the protection instruction for the target process based on the logical combination of the positive limit trigger identifier and the reverse limit trigger identifier includes:

[0050] If the logical value of the positive limit trigger flag is true, a positive stop instruction for the target process is generated;

[0051] If the logical value of the reverse limit trigger flag is true, a reverse stop instruction for the target process is generated;

[0052] If both the forward limit trigger flag and the reverse limit trigger flag have true logical values, an emergency stop command for the target process is generated.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] 1. This technology significantly improves the accuracy and anti-interference capability of limit protection logic by constructing a multi-level fusion fault judgment mechanism. In the fault judgment stage, the out-of-bounds flag, limit status indicator, and direction indicator are logically ANDed. This multi-condition composite verification method effectively distinguishes between genuine out-of-bounds events and sensor false alarms. Only when the position calculation, hardware trigger, and movement direction all point to the same limit direction will a corresponding combined state value be generated, thus greatly reducing the probability of false alarms caused by single signal jitter or drift. Subsequently, through reverse parsing of fault codes and generation of enable signals, the system can accurately identify the specific fault type and use masking and gating mechanisms to shield the limit signals in the failed direction, allowing only the limit status in the valid direction to enter subsequent logic. This isolation mechanism ensures that even if some sensors fail, the protection functions in the remaining normal directions can still operate reliably without interference, thereby improving the overall accuracy of limit protection under fault conditions.

[0055] 2. This technology achieves more refined and reliable protection capabilities in fault-tolerant control mode through dynamic switching of control basis and bidirectional remaining travel calculation based on real-time position. When the takeover signal triggers the switching process, the main input source of the limit protection changes from potentially failing hardware limit signals to real-time sensor position data. This shift fundamentally cuts off the fault propagation path of the original signal channel, making subsequent protection decisions entirely based on continuous physical position information, thus providing fault tolerance for sensor signal loss or false alarms. Based on this, by calculating the remaining travel of the real-time position and the forward and reverse limit positions, and employing a graded protection command generation strategy, the system can stop movement in only one direction when exceeding the limit, retaining the possibility of reverse retraction to prevent the equipment from getting stuck at the limit position; when both directions exceed the limit simultaneously or the position data is abnormal, an emergency stop is triggered, achieving the highest level of safety protection. This refined protection and graded response mechanism based on position data significantly enhances the system's safety redundancy and control flexibility under abnormal operating conditions. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating a limit protection and fault tolerance method according to an embodiment of the present invention.

[0057] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0058] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0059] This application provides a method for extreme protection and fault tolerance. The executing entity of this extreme protection and fault tolerance method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the extreme protection and fault tolerance method can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0060] Reference Figure 1 The diagram shown is a flowchart illustrating a limit protection and fault tolerance method according to an embodiment of the present invention. In this embodiment, the limit protection and fault tolerance method includes:

[0061] In this embodiment of the invention, when the forward and reverse position data of the moving load triggering the bidirectional limit signal during the target process are respectively compared with the position value of the moving load at the diagnostic time to obtain the position difference data of the target process, it is specifically used for:

[0062] The difference between the diagnostic time position value and the positive position data is used as the first deviation of the target process;

[0063] The difference between the diagnostic time position value and the reverse position data is used as the second deviation of the target process;

[0064] The first deviation is used as the high-order data, and the second deviation is used as the low-order data, which are then concatenated to form the positional difference data of the target process.

[0065] Specifically, the diagnostic position value is a value collected and converted by the position sensor at a preset diagnostic time and then stored. The positive position data is the position value recorded when the moving load triggers the positive limit switch, and this value is stored in non-volatile memory in advance.

[0066] Specifically, the reverse position data is the position value recorded when the moving load triggers the reverse limit switch, and this value is also pre-stored in non-volatile memory.

[0067] Specifically, the first deviation is treated as a binary number and shifted left to occupy the high-order part of the data word. The number of shifts is determined by the bit width of the second deviation. That is, if the second deviation occupies the lower 16 bits, the first deviation is shifted left by 16 bits. At the same time, the second deviation is placed in the lower-order part of the data word without shifting.

[0068] Furthermore, when the processor performs the subtraction operation, it sends the position value of the minuend at the diagnostic time to the input of the arithmetic logic unit, and at the same time sends the positive position data of the subtrahend to the other input of the arithmetic logic unit. The arithmetic logic unit performs binary subtraction to obtain the difference between the two, and this difference is the first deviation of the target process.

[0069] Furthermore, when the processor performs the subtraction operation, it uses the diagnostic time position value as the minuend and the reverse position data as the subtrahend. The binary subtraction calculation is completed by the arithmetic logic unit, and the calculated difference is the second deviation of the target process.

[0070] Furthermore, the first deviation after shifting is combined with the second deviation to form a complete binary number. This combined value is the position difference data of the target process.

[0071] In summary, by subtracting the real-time position at the diagnostic moment from the pre-stored positive limit position, an absolute numerical relationship between the current motion position and the positive boundary is established. This allows for a quantitative assessment of whether the motion load is approaching or exceeding the positive limit. This direct difference calculation eliminates the reliance on complex mathematical models or empirical formulas, obtaining accurate deviation values ​​based solely on physical position data. This provides a unique and definitive numerical basis for subsequent judgments, thereby improving the reliability and real-time performance of the limit protection logic.

[0072] In summary, by subtracting the real-time position at the diagnostic moment from the pre-stored reverse limit position, an absolute numerical relationship between the current motion position and the reverse boundary is established, thus forming a quantitative index symmetrical to the positive deviation. This symmetrical design ensures equal monitoring capability for bidirectional motion limits, avoiding the risk of missed reverse boundary detection due to unidirectional monitoring deficiencies. Simultaneously, this deviation is calculated independently of the positive deviation, ensuring they do not interfere with each other and providing a clean data foundation for subsequent independent fault determination and direction identification.

[0073] In summary, by integrating two independent deviations into a unified data word, parallel storage and transmission of forward and reverse position information are achieved, reducing the number of data registers required and simplifying the data interface. This concatenation method maintains the physical correspondence between the high and low bits, allowing subsequent sign recognition and boundary checks to be performed directly through bit operations without needing to read two separate data entries, thereby improving the processor's computational efficiency and data throughput. Furthermore, the unified data format facilitates atomic read and write operations during fault diagnosis and mode switching, avoiding data inconsistency issues caused by time-sharing reads.

[0074] In this embodiment of the invention, when performing sign recognition on the upper and lower limit differences in the position difference data to obtain the safety flag and boundary crossing flag of the target process, it is specifically used for:

[0075] When the upper limit difference in the location difference data is greater than or equal to zero, a positive boundary crossing flag is generated for the target process; when the upper limit difference in the location difference data is less than zero, a positive safety flag is generated for the target process.

[0076] When the lower limit difference in the location difference data is less than or equal to zero, a reverse boundary crossing flag for the target process is generated; when the lower limit difference in the location difference data is greater than zero, a reverse safety flag for the target process is generated.

[0077] The forward boundary crossing sign, the forward safety sign, the reverse boundary crossing sign, and the reverse safety sign are collectively used as the safety sign and boundary crossing sign for the target process.

[0078] Specifically, the upper limit difference corresponding to the high-order part is parsed from the storage location difference data. This upper limit difference is placed in the high-order bit segment when the data is concatenated. The processor extracts these high-order bits through bit mask operation and then restores the extracted binary number to the signed numerical form.

[0079] Specifically, the lower limit difference corresponding to the low-order part is parsed from the storage location difference data. This lower limit difference is placed in the low-order bit segment when the data is concatenated. The processor extracts these low-order bits through bit mask operation and then restores the extracted binary number to the signed numerical form.

[0080] Specifically, the four latched flags—forward out-of-bounds flag, forward safety flag, reverse out-of-bounds flag, and reverse safety flag—each occupy different bit positions in the status register.

[0081] Furthermore, the processor sends the upper limit difference to one input of the comparator, and simultaneously sends the value zero to the other input. The comparator then compares these two input values. When the comparator detects that the upper limit difference is greater than or equal to zero, it outputs a high-level signal, which is latched into a specific bit of the status register, thus generating a positive out-of-bounds flag for the target process. When the comparator detects that the upper limit difference is less than zero, it outputs a low-level signal, which is then inverted by an inverter to become high, or the processor directly inverts the comparison result through logical judgment and latches it into another specific bit of the status register, thus generating a positive safety flag for the target process.

[0082] Further, similar to the above operation, the processor sends the lower limit difference to one input of the comparator, and simultaneously sends the value zero to the other input. The comparator then compares these two input values. When the comparator detects that the lower limit difference is less than or equal to zero, it outputs a high-level signal, which is latched into a specific bit of the status register, thereby generating a reverse out-of-bounds flag for the target process. When the comparator detects that the lower limit difference is greater than zero, it outputs a low-level signal, which is then inverted by an inverter to become high, or the processor directly inverts the comparison result through logical judgment and latches it into another specific bit of the status register, thereby generating a reverse safety flag for the target process.

[0083] Furthermore, the processor performs a register data read operation, reading the entire register word containing these four flag bits at once, or combines these four scattered bits into a new data word through a bit concatenation operation. This combined data word completely contains the current state of the four flag bits.

[0084] In summary, by comparing the upper limit difference with zero, the continuous numerical range is discretized into two binary state flags with clear physical meaning. When the upper limit difference is greater than or equal to zero, it indicates that the current position of the moving load has reached or exceeded the positive limit position. At this time, a positive over-limit flag is generated, providing the system with a definite signal to trigger the over-limit protection logic. When the upper limit difference is less than zero, it indicates that the current position has not yet reached the positive limit. At this time, a positive safety flag is generated, providing the system with a state confirmation that it is allowed to continue forward operation or perform other operations. This binary judgment based on a single threshold eliminates the dependence on fuzzy thresholds or hysteresis intervals, making the state transition boundary clear and avoiding misjudgments or oscillations caused by improper threshold settings, thereby improving the stability and response speed of the limit protection logic.

[0085] In summary, by comparing the lower limit difference with zero, the reverse position deviation is also discretized into two mutually exclusive state flags, achieving precise monitoring of the reverse limit. When the lower limit difference is less than or equal to zero, it means that the moving load has reached or exceeded the reverse limit position. At this time, a reverse over-limit flag is generated, providing the system with an alarm or protection trigger signal for reverse over-limit. When the lower limit difference is greater than zero, it indicates that the current position is on the safe side of the reverse limit. At this time, a reverse safety flag is generated to confirm the safety of reverse movement. This symmetrical judgment logic ensures consistency in the limit protection mechanism in both directions, enabling the control system to monitor bidirectional movement with equal rigor and preventing equipment damage due to the lack of unidirectional monitoring.

[0086] In summary, integrating four independent binary status flags into a unified data set forms a complete description of the current extreme state of the motion load. This integration method not only simplifies the data interface and improves the processor's access efficiency, but more importantly, it ensures the synchronization and consistency between status information, avoiding potential misjudgments caused by time differences introduced by time-sharing reading of different flags, and providing reliable and complete input data for subsequent fault diagnosis.

[0087] In this embodiment of the invention, when performing logical judgments on the state data and direction data of the moving load based on the safety sign and the boundary crossing sign to obtain the fault determination data of the target process, it is specifically used for:

[0088] A logical AND operation is performed on the positive boundary crossing flag, the positive limit status identifier in the status data, and the direction identifier in the motion direction data to obtain the first combined state value of the target process;

[0089] The logical product of the reverse boundary crossing flag, the reverse limit status identifier in the status data, and the direction identifier in the motion direction data is used as the second combined state value of the target process;

[0090] The positive safety sign and the positive limit status sign are combined to obtain the third combined state value of the target process;

[0091] An AND operation is performed on the reverse safety flag and the reverse limit status flag to obtain the fourth combined state value of the target process;

[0092] The first combined state value, the second combined state value, the third combined state value, and the fourth combined state value are concatenated bit by bit to obtain the fault determination data of the target process.

[0093] Specifically, the processor reads the positive boundary crossing flag from the storage unit containing the safety flag and boundary crossing flag; this positive boundary crossing flag is a binary bit. Simultaneously, the processor reads the positive limit switch status flag from the status data storage area; this flag represents the current state of the positive limit switch recorded in real-time by the motion control system. The processor then reads the direction flag from the motion direction data storage area; this flag is generated in real-time by the direction determination logic based on the changing trends of the motor encoder or position sensor, indicating the current direction of motion load.

[0094] Specifically, the reverse boundary crossing flag is read from the storage unit containing the safety flag and boundary crossing flag, and the reverse limit status flag is read from the status data storage area. Then, the direction flag is read from the motion direction data storage area; this flag is generated in real-time by the direction determination logic based on position changes.

[0095] Specifically, the positive safety flag is read from the storage unit that stores the safety flag and the boundary crossing flag, and the positive limit status flag is read from the status data storage area. This flag is the current status of the positive limit switch recorded in real time by the motion control system.

[0096] Specifically, the reverse safety flag is read from the storage unit containing the storage safety flag and the out-of-bounds flag, and the reverse limit status flag is read from the status data storage area.

[0097] Specifically, the four binary bits of the first, second, third, and fourth combined state values ​​already stored in the temporary register are concatenated bit by bit. Each of these four combined state values ​​occupies a different bit in the temporary register that has been pre-allocated. For example, the first combined state value occupies the least significant bit, the second combined state value occupies the second least significant bit, and so on.

[0098] Furthermore, the processor feeds these three binary bits into the three inputs of a three-input AND gate. The AND gate performs a logical AND operation on these three input values. The output of the AND gate is high only when all three input values ​​are high simultaneously; otherwise, it outputs low. The output of this AND gate is the first combined state value of the target process, and the processor stores this first combined state value in the first bit of a temporary register.

[0099] Furthermore, the processor feeds these three binary bits into the three inputs of a three-input AND gate. This AND gate performs a logical AND operation on the three input values, and the resulting logical product is the second combined state value of the target process. The processor stores this second combined state value in the second bit of a temporary register.

[0100] Furthermore, these two binary bits are fed into the two inputs of a two-input AND gate. The AND gate performs a logical AND operation on these two input values. This AND gate performs a conjunction operation, meaning that the output is high only when both input values ​​are simultaneously high. The output of this AND gate is the third combined state value of the target process. The processor stores this third combined state value in the third bit of a temporary register.

[0101] Further, similar to the previous step, these two binary bits are fed into the two inputs of a two-input AND gate. The output is high only when both input values ​​are high simultaneously. The output result is the fourth combined state value of the target process. The processor stores this fourth combined state value in the fourth bit of a temporary register.

[0102] Furthermore, the entire register word containing these four combined state values ​​is read out at once. This read binary data word completely contains the current state of the four combined state values.

[0103] In summary, by using logical AND operations, three independent binary signals are fused into a composite state value. The output is true only when the positive out-of-bounds flag indicates that the position has exceeded the limit, the positive limit status indicator indicates that the hardware limit switch has been triggered, and the direction indicator indicates that the current movement direction is positive. This multi-condition AND operation design effectively avoids false alarms caused by mis-triggered single signals. For example, if position calculation drift causes the positive out-of-bounds flag to be mis-set, if the limit switch is not actually triggered or the movement direction is reversed, the first combined state value will not be generated, thus significantly improving the accuracy of fault diagnosis and anti-interference capability.

[0104] In summary, by performing a logical AND operation, the reverse out-of-bounds flag, reverse limit status indicator, and direction indicator are also subject to mandatory simultaneous verification. This design ensures that the determination of a reverse out-of-bounds fault must simultaneously satisfy three conditions: position out-of-bounds, hardware triggering, and direction consistency, forming a strictly symmetrical logic with the forward determination. It not only eliminates the risk of misjudgment due to a single sensor failure or signal jitter but also ensures that forward and reverse fault determinations have the same logical reliability, providing an equivalent and reliable input basis for subsequent unified fault handling.

[0105] In summary, the conjunction operation, or logical AND operation, combines the positive safety flag and the positive limit status flag. A true positive safety flag indicates that the current position is within the safe zone and not outside the bounds, while a true positive limit status flag indicates that the hardware limit switch has been triggered. These two states are mutually exclusive under normal circumstances. When both are true, the third combined state value is output as true, directly revealing a typical fault mode—the positive limit switch was mistakenly triggered when it was not outside the bounds. This design enables the system to proactively identify hardware signal anomalies, providing precise fault source location for subsequent fault code generation and masking.

[0106] In summary, the AND gate operation logically combines the reverse safety flag and the reverse limit status indicator. A true reverse safety flag indicates that the position has not reached the reverse limit, while a true reverse limit status indicator indicates that the reverse limit switch is activated. This contradictory combination directly points to a false alarm fault in the reverse limit switch. Through this AND gate operation, the system can symmetrically capture hardware anomalies in the reverse direction. Together with the third combined state value in the forward direction, this constitutes a complete monitoring mechanism for bidirectional limit sensor faults, ensuring that false alarms in either direction can be identified promptly and accurately.

[0107] In summary, by concatenating bits, four combined state values ​​with different physical meanings are integrated into a unified data word, forming a snapshot of all potential fault modes. This concatenation method not only greatly compresses data storage space, but more importantly, it maintains the independence and parallelism of each fault flag, allowing the processor to simultaneously acquire four fault states—positive out-of-bounds, reverse out-of-bounds, positive false alarm, and reverse false alarm—within a single clock cycle. This compact data structure provides a complete and consistent information foundation for subsequent efficient fault code encoding, type identification, and mode switching decisions, avoiding timing inconsistencies introduced by multiple reads.

[0108] In this embodiment of the invention, when performing type identification on the fault codes in the fault determination data, generating mode switching data for the target process, and masking the positive and negative limit indicators of the status data according to the failure indicator of the mode switching data to obtain the valid status indicator of the target process, the specific steps are as follows:

[0109] The fault code is reverse-parsed to obtain the fault type identification result of the target process;

[0110] The positive failure identifier and the negative failure identifier in the fault type identification result are inverted respectively to obtain the positive enable signal and the negative enable signal of the target process.

[0111] The bits of the positive enable signal are used as a mask, and a bitwise AND operation is performed with the positive limit status identifier to obtain the masked positive identifier of the target process.

[0112] Using the reverse enable signal as a gating signal, the reverse limit state identifier is selected to obtain the shielded reverse identifier of the target process;

[0113] The positive shielding identifier and the negative shielding identifier are aggregated into a valid status identifier for the target process.

[0114] Specifically, a fault code is a data word composed of multiple binary bits, where different bits encode different fault type information. During reverse parsing, the processor performs a bitwise AND operation on each bit of the fault code with a preset bitmask to extract the independent state of each bit. For example, the processor might perform a bitwise AND operation with the fault code using a mask where only the least significant bit is 1 and the rest are 0. If the result is non-zero, the fault identifier corresponding to the least significant bit is valid; otherwise, it is invalid.

[0115] Specifically, the forward failure flag and the reverse failure flag are read from the fault type identification result. Both flags are binary bits, indicating the fault state in the forward and reverse directions. When the processor performs an inversion operation on the forward failure flag, the binary bit is fed into the input of an NOT gate. The NOT gate outputs a level opposite to the input; that is, a high input outputs a low level, and a low input outputs a high level. The output of this NOT gate is the forward enable signal for the target process.

[0116] Specifically, the processor uses the bits of the positive enable signal as a mask. This mask is a binary bit whose value is either high or low after being inverted. Simultaneously, the processor reads the positive limit switch status flag from the status data storage area. This flag is a binary bit that reflects the real-time status of the positive limit switch.

[0117] Specifically, the inverting enable signal and the inverting limit status flag read from the status data storage area are respectively fed into the two input terminals of a two-input AND gate. The AND gate circuit performs a logical AND operation on these two input values, and the output of the AND gate is only high when both the inverting enable signal and the inverting limit status flag are high.

[0118] Specifically, the two flag bits are combined into a new data word, with the masking positive flag and the masking negative flag each occupying one bit. The processor places the masking positive flag in a predetermined high position of the data word and the masking negative flag in a predetermined low position of the data word by bit concatenation.

[0119] Furthermore, by using different bitmasks in sequence, the processor parses all fault identifiers from the fault code. These fault identifiers are combined to form the fault type identification result of the target process. This identification result includes multiple independent flag bits such as forward failure identifier and reverse failure identifier.

[0120] Furthermore, the processor also inverts the reverse failure flag, feeding it into the input of another NOT gate. The output level of the NOT gate is the reverse enable signal for the target process. These two enable signals are used for subsequent masking control of the limit status flag.

[0121] Furthermore, the processor expands the positive enable signal bits to the same bit width as the positive limit status flag. For example, if the positive enable signal is 1 bit, it is copied to the high bits to match the word length, and then a bitwise AND operation is performed with the positive limit status flag. The rule for the bitwise AND operation is that the result bit is 1 only if both corresponding bits are 1 simultaneously; otherwise, it is 0. The result of this operation is the target process's masked positive flag, which indicates the positive limit status after being masked by the enable signal. The positive limit status flag can only pass when the positive enable signal is high; otherwise, it is masked to 0. The processor stores this masked positive flag in a temporary register.

[0122] Furthermore, in other cases, the output of the AND gate is always low. The output of this AND gate is the masking inversion flag for the target process; it indicates that the inversion limit status flag can only be transmitted when the inversion enable signal is valid, otherwise it is set to 0. The processor stores this masking inversion flag in another bit of a temporary register.

[0123] Furthermore, a bitwise OR operation is then performed to combine the two into a single complete binary number, which is the valid status identifier of the target process.

[0124] In summary, through reverse parsing, the compressed fault codes are re-expanded into independent fault identifiers, revealing specific fault types such as forward out-of-bounds no signal, reverse out-of-bounds no signal, forward false alarm, and reverse false alarm. This parsing process converts fault information from transmission format to diagnostic format, transforming the originally difficult-to-interpret fault codes into clearly identifiable fault flags. The fault type identification results after reverse parsing provide clear input for subsequent enable signal generation. Each fault identifier corresponds to a specific hardware signal anomaly, allowing the system to accurately determine the direction and type of fault that occurred, thus laying the foundation for differentiated masking processing.

[0125] In summary, a true positive failure flag indicates that the positive limit signal has failed due to a fault. After inversion, it becomes a low-level positive enable signal, meaning the positive limit function is disabled. Conversely, when the positive failure flag is false, inversion yields a high-level positive enable signal, indicating that the positive limit function can be used normally. This conversion achieves a logical transition from fault detection to fault handling. The enable signal is directly used for subsequent limit signal shielding control, forming a complete fault response chain and ensuring that only limit signals in the direction where no fault has occurred can continue to participate in protection determination.

[0126] In summary, selective passage of the positive limit switch status indicator is achieved through bitwise AND operations. The positive enable signal acts as a mask; when its bit is high, the result of the bitwise AND operation completely replicates the original value of the positive limit switch status indicator; when its bit is low, the result is forced to zero regardless of the value of the positive limit switch status indicator. This masking mechanism effectively blocks limit signals from the fault direction, preventing erroneous protection actions caused by sensor failure or false alarms, while preserving the original state of the limit switch signal in the normal direction, thus achieving fault isolation and protection of normal functions.

[0127] In summary, a gating mechanism enables controlled transmission of the reverse limit status indicator. The reverse enable signal acts as the gating signal; when it is high, the gating gate opens, allowing the reverse limit status indicator to pass through and become the output that masks the reverse indicator; when it is low, the gating gate closes, forcing the output low and blocking the reverse limit status indicator. This gating design is symmetrical to the forward masking mechanism, ensuring strict fault isolation for the reverse limit signal. The gating process is essentially an AND gate operation, simple and reliable, ensuring logical consistency between the reverse and forward fault handling, together forming a complete bidirectional limit signal shielding system.

[0128] In summary, through aggregation, two limit switch flags that have undergone fault masking are merged into a single unified data word, forming a comprehensive flag reflecting the true usable limit switch status. This valid status flag fully encompasses the fault-filtered limit switch signal information in both the forward and reverse directions, eliminating interference from the faulty direction while retaining the true status in the normal direction. The aggregated data format facilitates subsequent use as auxiliary monitoring data, enabling the control system to directly perform auxiliary judgments based on this valid status flag in fault-tolerant mode, eliminating the need to process two separate masking flags. This simplifies the data access interface, improves operational efficiency, and ensures consistency of status information in both forward and reverse directions.

[0129] In this embodiment of the invention, the formula for calculating the fault code is specifically used for:

[0130]

[0131] in, The fault code, The positive out-of-bounds signal is indicated in the fault determination data. The reverse out-of-bounds signal is not identified in the fault determination data. This is a positive false alarm identifier in the fault determination data. This is the reverse false alarm identifier in the fault determination data. For prime numbers, For modulo operation, It is the modulus.

[0132] Specifically, the positive out-of-bounds signal no-signal indicator originates from a specific bit parsed from the fault determination data after logical judgment. This indicator is obtained by the processor in previous steps through a logical AND operation on the positive out-of-bounds flag, positive limit status flag, and direction flag, followed by reverse parsing of the fault code. It directly indicates a fault state where the corresponding limit signal was not detected when a positive out-of-bounds event occurred. The reverse out-of-bounds signal no-signal indicator also originates from the fault determination data. It is a specific bit obtained by a logical AND operation on the reverse out-of-bounds flag, reverse limit status flag, and direction flag, followed by reverse parsing. It is used to indicate a fault where a limit signal is missing when a reverse out-of-bounds event occurs. The positive false alarm indicator originates from a bit parsed from the fault determination data after combining the positive safety flag and positive limit status flag. It indicates a fault where the positive limit switch was erroneously triggered when no out-of-bounds event occurred. The reverse false alarm indicator originates from a bit parsed from the fault determination data after performing an AND operation on the reverse safety flag and reverse limit status flag. It indicates a fault where the reverse limit switch was erroneously triggered when no out-of-bounds event occurred. The prime base is a fixed prime number value preset by the system and stored in non-volatile memory, used as the base for weighted calculations. The modulus is another fixed integer value preset by the system, also stored in non-volatile memory, used to limit the range of fault code values.

[0133] Furthermore, the significance of the formula lies in compressing and encoding four binary fault identifiers with different physical meanings into a single fault code through a weighted summation and modulo operation. In the specific calculation process, the processor first multiplies the positive out-of-bounds no-signal identifier by the cube of the prime base, the negative out-of-bounds no-signal identifier by the square of the prime base, the positive false alarm identifier by the first power of the prime base, and the negative false alarm identifier by the zero power of the prime base. Since the zero power of the prime base equals one, the negative false alarm identifier directly participates in the summation. The processor then sums these four products to obtain an intermediate cumulative sum. This cumulative sum is a single value, its magnitude determined by the values ​​of the four fault identifiers and the powers of the prime base. Only when a fault identifier has a value of one does the corresponding term contribute its weighted value; otherwise, the term is zero. The processor then performs a modulo operation on this accumulated sum and the modulus. The modulo operation involves continuously subtracting integer multiples of the modulus from the accumulated sum until the remaining value is less than the modulus. This final remaining value is the fault code. This encoding method allows different fault combinations to be mapped to different fault codes in most cases, thus condensing information from multiple fault states into a single value.

[0134] In summary, the formula reflects the distribution pattern of fault codes as the fault indicator status changes. When a positive out-of-bounds no-signal indicator changes from zero to one, the fault code is increased by a fixed value equal to the cube of the prime base, and then moduloed. Therefore, the magnitude of the fault code change depends on the relative size of this fixed value and the modulus. When a negative out-of-bounds no-signal indicator changes from zero to one, the fault code is increased by the square of the prime base before modulo. When a positive false alarm indicator changes from zero to one, the fault code is increased by the first power of the prime base before modulo. When a negative false alarm indicator changes from zero to one, the fault code is increased by one before modulo. Because a modulo operation is performed after each increase, the value of the fault code is always limited to a cycle from zero to the modulus minus one. When multiple fault indicators are simultaneously one, the fault code is determined by the modulo of the sum of all weighted terms. Different combinations of fault indicators exhibit a dispersed distribution within the modulus range. This distribution characteristic reduces the probability of different fault combinations mapping to the same fault code. The introduction of modulo operation limits the range of fault codes, which facilitates subsequent storage and reverse parsing.

[0135] In this embodiment of the invention, when the effective status identifier is used as auxiliary monitoring data, and the original status data channel of the limit protection in the target process is cut off according to the takeover signal identifier in the mode switching data, and the control basis of the limit protection is switched from the status data to the real-time position data of the moving load to obtain the fault-tolerant control mode of the target process, it is specifically used for:

[0136] The control basis switching process for triggering the target process is based on the valid status of the takeover signal identifier.

[0137] In the control basis switching process, the main input source of the limit protection determination is switched from the bidirectional limit status identifier in the status data to the real-time position data to obtain the fault-tolerant control mode identifier of the target process.

[0138] The fault-tolerant control mode identifier is stored together with the auxiliary monitoring data to obtain the fault-tolerant control mode.

[0139] Specifically, the processor reads the current value of the flag in each control cycle and compares the current value with the historical value saved in the previous cycle. It detects the change of value by XOR operation. When the current value is detected to be high and the value of the previous cycle is low, it is determined to be a rising edge triggered event.

[0140] Specifically, the processor internally incorporates a data selector. The two inputs of this selector are connected to the bidirectional limit status indicator register and the real-time position data register in the status data storage area, respectively. The output of the selector is connected to the input of the limit protection judgment logic. During the switching process, the processor sends a switching signal to the control terminal of the data selector. This signal changes the channel selection state of the selector, causing the output to no longer select the bidirectional limit status indicator, but instead select the real-time position data.

[0141] Specifically, the fault-tolerant control mode identifier and auxiliary monitoring data are written into the same data storage area. That is, the fault-tolerant control mode identifier is placed in the highest bit of the storage word, and the bits of the auxiliary monitoring data are placed in the remaining low bits of the storage word to form a complete data word.

[0142] Furthermore, the detected rising edge event is used as a trigger source to generate a pulse signal with a width of one control cycle. This pulse signal is sent to the process control state machine. After receiving the pulse, the state machine jumps from the idle state to the switching start state, thereby formally starting the control basis switching process of the target process.

[0143] Furthermore, after the switch is completed, the input data source of the limit protection judgment logic becomes real-time location data. At this time, the processor generates a fault-tolerant control mode identifier, which is a binary bit and is set to a high level to indicate that it is currently in fault-tolerant control mode.

[0144] Furthermore, the processor writes this combined data word into non-volatile memory or a dedicated shared memory area, where the contents are the fault-tolerant control mode of the target process.

[0145] In summary, by using the valid status of the takeover signal identifier as the trigger source, the precise initiation of the control basis switching process is achieved, ensuring that the switching action only occurs at the specific moment when the system detects the need for fault-tolerant intervention. The valid status of the takeover signal identifier is generated from previous fault judgment and mode switching data. It integrates multiple information such as position differences, out-of-bounds indicators, and fault code identification, representing the system's final judgment on the severity of the current fault. When this identifier is valid, it indicates that the original limit signal is unreliable, and the control basis must be switched immediately; otherwise, it may lead to equipment malfunction or damage. This triggering mechanism based on a single identifier avoids false triggering or missed triggering, making the start condition of the switching process clear and unique, and improving the system's response speed and accuracy under fault conditions.

[0146] In summary, by switching the main input source from the status indicator of the physical limit switch to real-time position data acquired by the sensor, the core of the limit protection logic was restructured. After the switch, the limit protection determination no longer relies on the limit switch signal, which may fail or falsely alarm due to a fault. Instead, it directly uses the position data reflecting the actual physical position, thus completely avoiding the impact of faults in the original signal channel. The fault-tolerant control mode indicator obtained by this switch is the formal sign that the system has entered the fault-tolerant state. It indicates that subsequent limit protection will be based on position calculation rather than hardware signals, providing the system with a backup mechanism that can still maintain basic protection functions in the event of sensor failure, significantly improving the system's robustness and survivability.

[0147] In summary, by using coupled storage, the fault-tolerant control mode identifier representing the current system operating mode and the auxiliary monitoring data, which serves as supplementary monitoring information, are integrated into a unified data entity, forming a complete description of the system state under fault-tolerant conditions. The auxiliary monitoring data consists of valid state identifiers after fault masking processing. Although it is no longer the primary input source, it still contains residual information from hardware limit signals, which can be used for cross-validation or decision support. This coupled storage not only facilitates the subsequent boundary detection steps in obtaining all necessary information at once, avoiding the timing overhead and data inconsistency risks associated with multiple reads, but also provides a complete context for system state recording and fault tracing, enabling any subsequent events occurring in fault-tolerant mode to be comprehensively analyzed by combining primary and auxiliary data.

[0148] In this embodiment of the invention, when the control basis switching process of the target process is triggered based on the valid state of the takeover signal identifier, it is specifically used for:

[0149] The takeover signal identifier is periodically sampled to obtain the historical binary value and the instantaneous binary value of the takeover signal identifier; a difference operation is performed on the instantaneous binary value and the historical binary value to obtain the difference result of the takeover signal identifier;

[0150] The rising edge component of the difference result is used as a pulse source and assigned to the edge triggering variable of the target process to obtain the rising edge triggering pulse of the target process.

[0151] The control basis for initiating the target process is the switching procedure, which uses the rising edge trigger pulse as a switching command.

[0152] Specifically, at the beginning of each sampling cycle, the processor performs a read operation to retrieve the current binary value of the takeover signal identifier from the register; this value is the instantaneous binary value. Simultaneously, the processor reads the takeover signal identifier value saved in the previous sampling cycle from a dedicated historical value storage unit; this value is the historical binary value.

[0153] Specifically, the processor sends the instantaneous binary value and the historical binary value to the two input terminals of the XOR gate, respectively. The XOR gate circuit performs a logical XOR operation on the two inputs. When the two input values ​​are different, the XOR gate outputs a high level, indicating that the signal state has changed.

[0154] Specifically, the processor sends the instantaneous binary value and the differential result to the two input terminals of a two-input AND gate, respectively. The AND gate circuit performs a logical AND operation on these two inputs. The output of the AND gate is high only when the instantaneous binary value is high and the differential result is high.

[0155] Specifically, the processor uses the rising edge trigger pulse stored in the edge-triggered variable as a switching instruction. This pulse signal is directly connected to the state machine start input of the control basis switching process. When the pulse signal is high, the state machine receives the start signal and immediately jumps from the idle state to the switching start state, thus formally starting the control basis switching process of the target process.

[0156] Furthermore, after the read is complete, the processor writes the instantaneous binary value read in this operation into the historical value storage unit, overwriting the original historical value, and preparing for sampling in the next cycle. In this way, each sampling cycle obtains a pair of instantaneous binary values ​​and historical binary values, representing the current moment and the previous moment's takeover signal status, respectively.

[0157] Furthermore, when the two input values ​​are the same, the XOR gate outputs a low level, indicating that the signal state has not changed. The output of this XOR gate is the differential result of the takeover signal identifier, which reflects whether a transition has occurred in the signal between the previous sampling period and the current sampling period.

[0158] Furthermore, the output of this AND gate is the rising edge component of the differential result, because it only outputs a high level when the signal changes from low to high, and a low level when the signal changes from high to low. The processor assigns this rising edge component to the edge-triggered variable of the target process. Specifically, it writes the output level of the AND gate into a register bit specifically used to store the edge-triggered variable, thereby obtaining the rising edge trigger pulse of the target process. The pulse width is one sampling period.

[0159] Furthermore, during the switching process, the processor will perform the input source switching operation according to predetermined steps. The trigger source for this switching action is a single start instruction provided by the rising edge trigger pulse, ensuring that the switching process is executed only once at the moment when the takeover signal flag changes from invalid to valid.

[0160] In summary, by continuously reading the takeover signal identifier at a fixed sampling period, a discrete observation sequence of the signal on the time axis is established. Each sampling simultaneously obtains the instantaneous binary value at the current moment and the historical binary value at the previous moment, forming paired data for the states of two consecutive periods. This periodic sampling design allows the system to monitor changes in the takeover signal at definite time intervals, avoiding missed or false detections caused by uncertain signal level holding times. The coexistence of historical and instantaneous values ​​provides the necessary input data for subsequent differential operations, giving the detection of signal changes a time-dimensional reference, thus ensuring that any state transition can be accurately captured.

[0161] In summary, by performing a logical XOR operation between the instantaneous value and the historical value, the system accurately detects whether a state change has occurred in the takeover signal identifier between two consecutive sampling periods. The differential result outputs a high level only when the signal value changes, and a low level when the signal remains unchanged. This design effectively filters out the static components of the signal, retaining only the changing information. The result of the differential operation directly reflects the essential characteristics of the signal change, providing pure raw data for subsequent differentiation between rising and falling edges. It also eliminates the influence of the duration of the signal level on the detection result, ensuring accurate identification regardless of how brief the signal change is.

[0162] In summary, by performing a logical AND operation between the differential result and the instantaneous binary value, the rising edge event transitioning from a low to a high level is specifically extracted from the signal changes. This processing method eliminates interference from falling edges, ensuring that output is only generated the instant the takeover signal indicator changes from invalid to valid. The resulting rising edge trigger pulse width is strictly equal to one sampling period, constituting a standard single-pulse signal. Assigned as a pulse source to the edge trigger variable, this forms a precise trigger signal for subsequent processes. This design avoids the problem of repeated triggering caused by a continuously valid signal, ensuring the uniqueness and accuracy of the trigger event.

[0163] In summary, using a rising-edge trigger pulse as the switching command enables a single, precise initiation of the control basis switching process. The switching command is a pulse signal of a defined width that appears only momentarily when the takeover signal indicator changes from invalid to valid, and then disappears automatically. This pulse-based initiation mechanism ensures that the switching process is executed only once, avoiding repeated switching or process repetition caused by the takeover signal indicator remaining valid. The switching command is directly connected to the start input of the process control state machine, enabling the state machine to respond instantaneously and enter the switching state. This ensures that the system can complete the switching of the control basis with minimal delay after detecting a takeover request, maximizing the real-time performance of fault-tolerant response.

[0164] In this embodiment of the invention, when performing boundary detection on the real-time location data to obtain the limit state of the target process in the fault-tolerant control mode, and using the corresponding drive command generated based on the limit state as the protection command for the target process, it is specifically used for:

[0165] The difference between the real-time location data and the forward location data is used as the forward remaining travel data of the target process;

[0166] The difference between the real-time location data and the reverse location data is used as the reverse remaining travel data of the target process;

[0167] If the remaining forward travel data is less than or equal to zero, a positive limit trigger flag for the target process is generated; if the remaining forward travel data is greater than zero, a positive safety flag for the target process is generated.

[0168] If the reverse remaining travel data is greater than or equal to zero, a reverse limit trigger flag for the target process is generated; if the forward remaining travel data is less than zero, a reverse safety flag for the target process is generated.

[0169] The protection command for the target process is determined based on the logical combination of the positive limit trigger flag and the reverse limit trigger flag.

[0170] Specifically, the processor reads the current real-time position data of the moving load from the real-time position data register. This data is acquired in real time by the position sensor and obtained after analog-to-digital conversion. The processor also reads the forward position data from the non-volatile memory. This data is the position value recorded and stored when the moving load triggers the forward limit switch during the debugging phase or normal operation.

[0171] Specifically, the processor reads the current real-time position data of the moving load from the real-time position data register. Simultaneously, the processor reads the reverse position data from non-volatile memory, which is the position value recorded and stored when the moving load triggers the reverse limit switch during the debugging phase or normal operation.

[0172] Specifically, the processor reads the value from the data register storing the forward remaining travel data and sends this value to one input of the comparator, while simultaneously sending the value zero to the other input of the comparator. The comparator compares the magnitude of these two input values, and when it detects that the forward remaining travel data is less than or equal to zero, the comparator outputs a high-level signal. This high-level signal is latched into a specific bit in the status register, thereby generating a forward limit trigger flag for the target process.

[0173] Specifically, the processor reads the value from the data register storing the reverse remaining travel data and sends this value to one input of the comparator, while simultaneously sending the value zero to the other input of the comparator. The comparator compares the magnitude of these two input values, and when it detects that the reverse remaining travel data is greater than or equal to zero, the comparator outputs a high-level signal. This high-level signal is latched into a specific bit in the status register, thereby generating the reverse limit trigger flag for the target process.

[0174] Specifically, the processor reads the forward limit trigger flag and the reverse limit trigger flag from the status register. Both flags are binary bits, indicating the trigger status of the forward and reverse limits, respectively. The processor sends these two binary bits to a logic combinational circuit, which contains two AND gates and one OR gate. Specifically, the forward limit trigger flag is directly connected to the first output enable terminal, and together with the reverse limit trigger flag, it is sent to a two-input AND gate. The output of this AND gate serves as the emergency stop enable signal.

[0175] Furthermore, the processor inputs the real-time position data as the minuend into one input of the arithmetic logic unit (ALU), and the forward position data as the subtrahend into the other input. The ALU performs binary subtraction, and the difference is the remaining forward travel data for the target process. This data represents the remaining distance of the moving load from the forward limit position at the current moment. A positive value indicates that the limit position has not yet been reached, while a negative or zero value indicates that the limit position has been reached or exceeded.

[0176] Furthermore, the processor inputs the real-time position data as the minuend into one input of the arithmetic logic unit (ALU), and the reverse position data as the subtrahend into the other input. The ALU performs binary subtraction, and the difference is the reverse remaining travel data for the target process. The processor stores this reverse remaining travel data in a designated data register. This data represents the remaining distance of the moving load from the reverse limit position at the current moment. A negative value indicates that the limit position has not yet been reached, while a positive value or zero indicates that the limit position has been reached or exceeded.

[0177] Furthermore, when the comparator detects that the positive remaining travel data is greater than zero, the comparator outputs a low-level signal. This low-level signal is then converted to a high-level signal by an inverter, or the processor can directly invert the comparison result through logical judgment and then latch it into another specific position in the status register, thereby generating a positive safety flag for the target process.

[0178] Furthermore, when the comparator detects that the reverse remaining travel data is less than zero, the comparator outputs a low-level signal. This low-level signal becomes a high-level signal after passing through an inverter, or the processor directly inverts the comparison result through logical judgment and then latches it into another specific position of the status register, thereby generating the reverse security flag of the target process.

[0179] Furthermore, the logic combinational circuit outputs corresponding control signals based on different combinations of the two input values. When the forward limit trigger flag is high and the reverse limit trigger flag is low, the circuit outputs a forward stop command; when the reverse limit trigger flag is high and the forward limit trigger flag is low, the circuit outputs a reverse stop command; when both the forward and reverse limit trigger flags are high, the circuit outputs an emergency stop command. The processor uses the commands output by the logic combinational circuit as protection commands for the target process and sends them to the drive actuator to perform the corresponding stop operation.

[0180] In summary, under fault-tolerant control mode, the remaining distance of the moving load from the positive limit is directly calculated by subtracting the real-time position data from the pre-stored positive limit position. This calculation process is completely independent of the state of the hardware limit switches, relying solely on reliable position sensor data. Therefore, even if the physical limit signal is blocked due to a fault, it can still provide the system with quantified positive position margin information. The remaining positive travel data is a signed numerical value; its magnitude and sign intuitively reflect the spatial relationship between the load and the positive boundary, providing a unique and accurate numerical basis for subsequent limit trigger judgment, ensuring the continuity and quantifiability of positive protection in fault-tolerant mode.

[0181] In summary, by subtracting the real-time position data from the reverse limit position, the remaining travel distance of the moving load from the reverse limit is symmetrically calculated. Similar to the forward remaining travel data, this data replaces the failed reverse limit switch signal in fault-tolerant mode, becoming the core basis for determining reverse overrun. The remaining travel data in both directions together constitute a comprehensive quantitative monitoring of the movement range. This allows the system to accurately determine the specific position of the load within the travel range even after the loss of hardware limit signal support, providing an equivalent numerical basis for subsequent bidirectional limit judgments and avoiding protection blind spots caused by the lack of unidirectional monitoring.

[0182] In summary, by comparing the remaining forward travel data with zero, continuous numerical information is converted into binary status identifiers with clear control implications. When the remaining forward travel data is less than or equal to zero, it means that the real-time position has reached or exceeded the forward limit point. The generated forward limit trigger identifier at this time directly serves as the command signal to trigger the forward protection action. When the remaining forward travel data is greater than zero, the generated forward safety identifier indicates that the current position is within the safe zone, allowing continued forward operation. This binary judgment logic based on a single threshold is clear and responds quickly, completely eliminating the dependence on unreliable hardware signals in fault-tolerant mode, and achieving accurate status determination based solely on position data.

[0183] In summary, by comparing the remaining reverse travel data with zero, a binary state identifier for the reverse direction is symmetrically generated. A remaining reverse travel data greater than or equal to zero indicates that the position has reached or exceeded the reverse limit, triggering the reverse limit trigger identifier; a remaining reverse travel data less than zero indicates that the position is within the reverse safe zone, generating a reverse safe identifier. This symmetrical judgment logic is completely consistent with that of the forward direction, ensuring that the protection mechanisms in both directions have the same reliability and response characteristics in fault-tolerant mode. Together, they constitute a bidirectional, equitable limit protection system, preventing protection failure due to logical asymmetry.

[0184] In summary, differentiated hierarchical protection commands are generated by logically combining the forward and reverse limit trigger flags. When only the forward limit trigger flag is true, the logic combination outputs a forward stop command, prohibiting only forward movement; when only the reverse limit trigger flag is true, a reverse stop command is output, prohibiting only reverse movement; when both flags are true simultaneously, indicating a serious anomaly in the position data or that the load has simultaneously reached both bidirectional limits, the logic combination outputs an emergency stop command, immediately cutting off all drives. This command generation mechanism based on logic combination achieves hierarchical responses to different degrees of boundary violations, ensuring precise control in unidirectional boundary violations while providing the highest level of safety protection in extreme situations.

[0185] In this embodiment of the invention, when determining the protection instruction for the target process based on the logical combination of the positive limit trigger identifier and the reverse limit trigger identifier, it is specifically used for:

[0186] If the logical value of the positive limit trigger flag is true, a positive stop instruction for the target process is generated;

[0187] If the logical value of the reverse limit trigger flag is true, a reverse stop instruction for the target process is generated;

[0188] If both the forward limit trigger flag and the reverse limit trigger flag have true logical values, an emergency stop command for the target process is generated.

[0189] Specifically, the processor reads the current binary value of the positive limit trigger flag from the status register and sends the binary value to a logic judgment unit. This unit is composed of a level detection circuit. When a high level is detected in the input signal, it is judged as a true logic value.

[0190] Specifically, the processor reads the current binary value of the reverse limit trigger flag from the status register and sends the binary value to a logic judgment unit. This unit is composed of a level detection circuit. When the input signal is detected to be high, it is judged to be true.

[0191] Specifically, the processor reads the current binary values ​​of the forward limit trigger flag and the reverse limit trigger flag simultaneously from the status register, and sends these two binary values ​​to the two inputs of a two-input AND gate. The AND gate performs a logical AND operation on these two inputs. When both inputs are high, the AND gate outputs a high level, indicating that the logical values ​​of both flags are true.

[0192] Furthermore, upon detecting a high level in the forward limit trigger flag, the processor immediately executes an instruction generation operation. It reads the binary code corresponding to the forward stop instruction from the instruction code table pre-stored in non-volatile memory. This instruction code contains the specific bit definitions of the enable signal and the direction control signal. The processor writes this instruction code into the instruction register of the drive controller and simultaneously sends it to the motor driver through the output port. Upon receiving the instruction, the driver immediately disconnects the forward drive channel and activates the braking mechanism. This writing and sending process constitutes the generation of the forward stop instruction for the target process.

[0193] Furthermore, upon detecting a high level in the reverse limit trigger flag, the processor immediately executes an instruction generation operation. It reads the binary code corresponding to the reverse stop instruction from the instruction code table pre-stored in non-volatile memory. This instruction code contains the specific bit definitions of the enable signal and direction control signal. The difference from the forward stop instruction is that the direction control bit is set to the reverse cut-off state. The processor writes this instruction code into the instruction register of the drive controller and simultaneously sends it to the motor driver through the output port. Upon receiving the instruction, the driver immediately disconnects the reverse drive channel and activates the braking mechanism. This writing and sending process constitutes the generation of the reverse stop instruction for the target process.

[0194] Furthermore, upon detecting a high-level output from the AND gate, the processor immediately executes an instruction generation operation. It reads the binary code corresponding to the emergency stop instruction from the instruction code table pre-stored in non-volatile memory. This instruction code has the highest priority and contains control bits for immediately cutting off all drive channels, initiating emergency braking, and locking the system. The processor writes this instruction code into the drive controller's instruction register and simultaneously sends it directly to the driver hardware via a dedicated emergency stop channel. Upon receiving the instruction, the driver immediately executes the fastest possible stop operation, disconnecting the motor power supply and activating the mechanical brake. This write and send process constitutes the generation of the emergency stop instruction for the target process.

[0195] In summary, when the forward limit trigger flag is true, the system clearly determines that the moving load has reached or exceeded the forward limit position. At this point, a forward stop command is generated, prohibiting the load from continuing to move in the forward direction. This unidirectional stop design achieves precise braking in the direction of the overrun while retaining the possibility of the load moving in the reverse direction, allowing the system to return to a safe area through reverse movement when encountering a forward overrun. The generation of the forward stop command is directly based on the limit trigger flag calculated from the position data in fault-tolerant mode, and is completely unaffected by the original limit switch signal failure. This ensures that the forward overrun protection can still be reliably executed in the event of sensor failure or false signal alarm, effectively preventing equipment damage due to unidirectional overrun.

[0196] In summary, when the reverse limit trigger flag is true, the system determines that the moving load has reached or exceeded the reverse limit position. At this point, a reverse stop command is generated, cutting off only the reverse drive channel and allowing the load to continue moving in the forward direction. This symmetrical unidirectional braking strategy complements the forward stop command, ensuring that the system can perform precise directional protection regardless of which direction the over-limit occurs, preventing the load from being trapped at the limit position due to simultaneous bidirectional braking. The generation of the reverse stop command also relies on the independently calculated reverse limit trigger flag in fault-tolerant mode, ensuring that the reverse over-limit protection still has the same reliability and response speed when the reverse limit signal fails, thus maintaining the symmetry and integrity of the bidirectional limit protection capability.

[0197] In summary, when both the forward and reverse limit trigger flags are true, it indicates that the position data of the moving load simultaneously meets the conditions for both forward and reverse over-limit. This contradictory state usually signifies a serious malfunction of the position sensor, an error in position data calculation, or an extreme abnormal operating condition of the load. At this point, an emergency stop command is generated, immediately cutting off drive power in all directions and initiating the highest level of safety braking mechanism. This avoids unpredictable consequences that might result from continuing operation under logically contradictory conditions. The emergency stop command has higher priority than the unidirectional stop command, ensuring that the system can enter a safe state as quickly as possible when a serious anomaly occurs, maximizing the protection of equipment and operators, and providing a clear initial state for subsequent fault diagnosis and system recovery.

[0198] In the several embodiments provided by this invention, it should be understood that the disclosed method can be implemented in other ways.

[0199] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0200] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, and technology that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0201] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A limit protection and fault-tolerant processing method, characterized in that, The method includes: S1. The forward and reverse position data when the moving load triggers the bidirectional limit signal during the target process are respectively compared with the position value of the moving load at the diagnosis time to obtain the position difference data of the target process. S2. Perform sign recognition on the upper limit difference and lower limit difference in the position difference data respectively to obtain the safety mark and boundary crossing mark of the target process; S3. Based on the safety sign and the boundary crossing sign, perform logical judgment on the state data and motion direction data of the moving load to obtain the fault judgment data of the target process, including: The fault codes in the fault determination data are type-identified to generate mode switching data for the target process. Based on the failure identifier of the mode switching data, the positive and reverse limit identifiers of the status data are masked to obtain the valid status identifier of the target process, including: The fault code is reverse-parsed to obtain the fault type identification result of the target process; The positive failure identifier and the negative failure identifier in the fault type identification result are inverted respectively to obtain the positive enable signal and the negative enable signal of the target process. The bits of the positive enable signal are used as a mask, and a bitwise AND operation is performed with the positive limit status flag to obtain the masked positive flag of the target process. Using the reverse enable signal as a gating signal, the reverse limit state identifier is selected to obtain the shielded reverse identifier of the target process; The shielding positive identifier and the shielding reverse identifier are aggregated into a valid status identifier for the target process; The formula for calculating the fault code includes: in, The fault code, The positive out-of-bounds signal is indicated in the fault determination data. The reverse out-of-bounds signal is not identified in the fault determination data. This is a positive false alarm identifier in the fault determination data. This is the reverse false alarm identifier in the fault determination data. For prime numbers, For modulo operation, Modulus; S4. The fault codes in the fault determination data are identified by type, the mode switching data of the target process is generated, and the positive limit sign and the reverse limit sign of the status data are masked according to the failure sign of the mode switching data to obtain the effective status sign of the target process. S5. Using the effective status identifier as auxiliary monitoring data, and according to the takeover signal identifier in the mode switching data, cut off the original status data channel of the limit protection in the target process, and switch the control basis of the limit protection from the status data to the real-time position data of the moving load to obtain the fault-tolerant control mode of the target process. S6. In the fault-tolerant control mode, boundary detection is performed on the real-time position data to obtain the limit state of the target process, and the corresponding drive command generated according to the limit state is used as the protection command of the target process.

2. The limit protection and fault-tolerant processing method as described in claim 1, characterized in that, The step of verifying the deviation between the forward and reverse position data when the moving load triggers the bidirectional limit signal during the target process and the position value at the diagnostic time of the moving load to obtain the position difference data of the target process includes: The difference between the diagnostic time position value and the positive position data is used as the first deviation of the target process; The difference between the diagnostic time position value and the reverse position data is used as the second deviation of the target process; The first deviation is used as the high-order data, and the second deviation is used as the low-order data, which are then concatenated to form the positional difference data of the target process.

3. The limit protection and fault-tolerant processing method as described in claim 1, characterized in that, The step of performing sign recognition on the upper and lower limit differences in the position difference data to obtain the safety indicator and boundary crossing indicator of the target process includes: When the upper limit difference in the location difference data is greater than or equal to zero, a positive boundary crossing flag is generated for the target process; when the upper limit difference in the location difference data is less than zero, a positive safety flag is generated for the target process. When the lower limit difference in the location difference data is less than or equal to zero, a reverse boundary crossing flag for the target process is generated; when the lower limit difference in the location difference data is greater than zero, a reverse safety flag for the target process is generated. The forward boundary crossing sign, the forward safety sign, the reverse boundary crossing sign, and the reverse safety sign are collectively used as the safety sign and boundary crossing sign for the target process.

4. The limit protection and fault-tolerant processing method as described in claim 3, characterized in that, The step of performing logical judgments on the state data and direction data of the moving load based on the safety sign and the boundary crossing sign to obtain fault determination data for the target process includes: A logical AND operation is performed on the positive boundary crossing flag, the positive limit status identifier in the status data, and the direction identifier in the motion direction data to obtain the first combined state value of the target process; The logical product of the reverse boundary crossing flag, the reverse limit status identifier in the status data, and the direction identifier in the motion direction data is used as the second combined state value of the target process; The positive safety sign and the positive limit status sign are combined to obtain the third combined state value of the target process; An AND operation is performed on the reverse safety flag and the reverse limit status flag to obtain the fourth combined state value of the target process; The first combined state value, the second combined state value, the third combined state value, and the fourth combined state value are concatenated bit by bit to obtain the fault determination data of the target process.

5. The limit protection and fault-tolerant processing method as described in claim 1, characterized in that, The method of using the valid status identifier as auxiliary monitoring data and, based on the takeover signal identifier in the mode switching data, cutting off the original status data channel of the limit protection in the target process, and switching the control basis of the limit protection from the status data to the real-time position data of the moving load, to obtain the fault-tolerant control mode of the target process includes: The control basis switching process for triggering the target process is based on the valid status of the takeover signal identifier. In the control basis switching process, the main input source of the limit protection determination is switched from the bidirectional limit status identifier in the status data to the real-time position data to obtain the fault-tolerant control mode identifier of the target process. The fault-tolerant control mode identifier is stored together with the auxiliary monitoring data to obtain the fault-tolerant control mode.

6. The limit protection and fault-tolerant processing method as described in claim 5, characterized in that, The control basis switching process that triggers the target process based on the valid status of the takeover signal identifier includes: The takeover signal identifier is periodically sampled to obtain the historical binary value and the instantaneous binary value of the takeover signal identifier; a difference operation is performed on the instantaneous binary value and the historical binary value to obtain the difference result of the takeover signal identifier; The rising edge component of the difference result is used as a pulse source and assigned to the edge triggering variable of the target process to obtain the rising edge triggering pulse of the target process. The control basis for initiating the target process is the switching procedure, which uses the rising edge trigger pulse as a switching command.

7. The limit protection and fault-tolerant processing method as described in claim 1, characterized in that, In the fault-tolerant control mode, boundary detection is performed on the real-time location data to obtain the limit state of the target process, and the corresponding drive command generated based on the limit state is used as the protection command for the target process, including: The difference between the real-time location data and the forward location data is used as the forward remaining travel data of the target process; The difference between the real-time location data and the reverse location data is used as the reverse remaining travel data of the target process; If the remaining forward travel data is less than or equal to zero, a positive limit trigger flag for the target process is generated; if the remaining forward travel data is greater than zero, a positive safety flag for the target process is generated. If the reverse remaining travel data is greater than or equal to zero, a reverse limit trigger flag for the target process is generated; if the forward remaining travel data is less than zero, a reverse safety flag for the target process is generated. The protection instruction for the target process is determined based on the logical combination of the positive limit trigger identifier and the reverse limit trigger identifier.

8. The limit protection and fault-tolerant processing method as described in claim 7, characterized in that, The step of determining the protection instruction for the target process based on the logical combination of the positive limit trigger identifier and the reverse limit trigger identifier includes: If the logical value of the positive limit trigger flag is true, a positive stop instruction for the target process is generated; If the logical value of the reverse limit trigger flag is true, a reverse stop instruction for the target process is generated; If both the forward limit trigger flag and the reverse limit trigger flag have true logical values, an emergency stop command for the target process is generated.

Images