A laboratory safety automatic control method and system for fault self-diagnosis

Abstract

This invention provides a laboratory safety self-control method and system for fault self-diagnosis. The method includes: S1 periodically and actively generating health labels through self-checks; S2 dividing the time slice of a single processor into execution time slots and self-test time slots, calculating the CRC signature of key data in the execution time slot, executing test vectors and comparing them with historical signatures in the self-test time slot, and locking the output to a safe state via independent hardwired connection in case of a fault; S3 based on incremental causal graph and online parameter learning, collecting samples using fault labels, updating the conditional probability table through online EM, automatically expanding the causal graph structure through normalized mutual information, and outputting the fault type and confidence level using confidence propagation; S4 actuator closed-loop feedback and hardwired bypass protection; S5 dynamic reconstruction degradation fault tolerance; S6 emergency shutdown and solidification. This invention achieves high-coverage fault detection with a single processor, eliminates blind spots of common faults, and simultaneously achieves small-sample adaptive and accurate fault reasoning, significantly improving system reliability and intelligence.

Description

Technical Field

[0001] This invention relates to the field of laboratory safety monitoring and automation control technology, and in particular to a laboratory safety self-diagnosis method and system. Background Technology

[0002] The reliability and fault diagnosis capabilities of laboratory safety control systems (such as ventilation control systems, toxic and hazardous gas monitoring systems, and differential pressure interlock systems) directly affect the safety of laboratory personnel and the accuracy of experimental results. Current mainstream laboratory safety control systems typically employ centralized or distributed controllers, supplemented by fault alarm functions. However, existing technologies have significant shortcomings in the following two key aspects: I. Limitations of Controller Hardware Fault Detection and Fault Tolerance When faced with hardware failures, existing system controllers (such as PLCs and embedded controllers) primarily rely on the following methods: Watchdog timers can only detect program crashes or infinite loops, and are almost powerless against transient faults within the processor (such as single-event upsets and register bit flips) and soft errors in the data path. When the watchdog is not fed in time, the system is already out of control, posing a high security risk.

[0003] Dual-Core Lockstep (DCLS) technology runs the same instructions on two processor cores, comparing the outputs in real time via a hardware comparator. This technology is widely used in automotive electronics (ISO26262) and high-reliability industrial control. However, it has inherent drawbacks: High hardware costs: It requires two physical processor cores or two independent CPUs, which increases chip area and system costs, making it difficult to popularize for cost-sensitive small and medium-sized laboratory equipment.

[0004] Common fault blind spots: When two cores are simultaneously affected by the same electromagnetic interference, power fluctuations, or clock drift, they may produce the same erroneous outputs. The comparator cannot detect the difference, leading to missed fault reports. This type of common fault is not uncommon in real-world industrial environments.

[0005] Unable to detect systemic defects at the algorithm level: If the control algorithm itself has a design flaw, both cores will output the same erroneous result, which lockstep technology cannot detect.

[0006] Redundant controller hot standby: This involves switching between two controllers, one primary and one backup. This solution is costly, has a long switching delay (usually on the order of seconds), and fault detection still relies on heartbeats or watchdog timers, making it unable to respond to transient faults on the order of microseconds.

[0007] Therefore, there is an urgent need for a low-cost, high-coverage controller self-diagnosis and fault-tolerant method that can detect common faults. Summary of the Invention

[0008] The purpose of this invention is to address the shortcomings of existing technologies by proposing a self-diagnostic laboratory safety control method and system.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: a laboratory safety self-control method for fault self-diagnosis, comprising the following sub-steps: S1: During system idle periods, inject standard test signals into the sensors or complete health checks of the sensors and channels through the internal self-test circuit, generating health labels and fault codes; Furthermore, S1 includes two sub-steps: sensor excitation response testing and signal channel integrity verification. S11: Sensor excitation response test; During system idle periods, a short-duration (e.g., 100ms) constant voltage excitation is applied to resistive sensors (such as catalytic combustion combustible gas sensors), and their response rise time and steady-state amplitude are collected and compared with the factory calibration curve. A reverse pulse is applied to electrochemical sensors to test their polarization resistance. If the response time deviation exceeds 20% or the steady-state amplitude deviation exceeds 15%, a "sensor performance degradation" warning is generated; if the deviation exceeds 50%, a "sensor failure" fault code is generated. The final outputs are the response time deviation rate Δt_r and the steady-state amplitude deviation rate ΔA, along with the corresponding warning or fault code, providing data support for subsequent health label calculations.

[0010] S12: Signal channel integrity check A DC reference voltage of known amplitude (e.g., 2.5V) is injected into the analog-to-digital conversion channel via an analog switch. The conversion result is read, and the gain error and offset error are calculated. If the gain error exceeds ±2% or the offset error exceeds ±1%, the signal conditioning circuit is considered faulty, and a corresponding fault code is generated. The output gain error E_g and offset error E_off, along with the fault code, are used for calculating the health status label.

[0011] Furthermore, the health status label is calculated as follows: The sensor score is determined based on the larger of Δt_r and ΔA output from S11: ≤5% is 100 points, 5%~20% is reduced to 70 points via linear interpolation, 20%~50% is reduced to 30 points via linear interpolation, and >50% is 0 points. The channel score is determined based on the larger of |E_g| and |E_off| output from S12 according to the same rules. The final health status of each channel is the minimum of the sensor score and the channel score. When the overall health status is below 30%, a "channel failure" fault code is output. Finally, a health status label (0~100%) and a fault code list are output and passed to step S3 for fault reasoning.

[0012] S2: Through time-slice segmentation and self-testing mechanism of a single processor, it achieves fault detection capability equivalent to dual-core lockstep; Further, it includes the following sub-steps: S21: Time Slot Division: The processor's working cycle is divided into alternating execution time slots (10ms) and self-test time slots (50μs) by a hardware timer, and the current time slot type flag is output; The processor's working cycle is divided into alternating execution time slots (10ms) and self-test time slots (50μs) using a hardware timer (such as the SysTick timer of the ARM Cortex-M core, configured in periodic interrupt mode). The timer interrupt service routine sets the global flag slot_flag, which is set to "self-test time slot" when the interrupt starts and restored to "execution time slot" when it exits. This flag will be output to the subsequent S22 and S23 steps to distinguish the current time slot type and ensure that the tasks in each time slot are executed in an orderly manner.

[0013] S22: Execution Slot Verification: When slot_flag indicates "execution slot", the processor runs the laboratory safety control logic normally (such as PID adjustment, sensor reading, alarm judgment), and pushes the key intermediate data such as each ALU operation result, register write-back value, and memory write address into the ring buffer check_buf[] (depth 256) protected by the MPU in sequence; the processor's built-in CRC unit (polynomial 0x4C11DB7, initial value 0xFFFFFFFF) accumulates the checksum of all data in the buffer in real time, and updates incrementally for each entry written. At the end of each execution slot, the current CRC signature value crc_curr is saved to the backup register crc_backup, the buffer is cleared, and finally crc_curr is output to step S24.

[0014] S23: Self-test slot test: When slot_flag indicates "self-test slot", the processor first saves the context of the current control task (registers are pushed onto the stack), then jumps to the test code segment stored in ROM, and executes a series of test vectors sequentially: The ALU test performs operations using 0xFFFFFFFF+1 and 0x7FFFFFFF-0x80000000 to check whether the results and flag bits meet expectations. The multiplier test uses the operation 0x12345678×0x87654321, comparing the high 32 bits and low 32 bits of the product with a pre-stored golden value. The shifter test uses the operations 0x80000000>>1 and 0x00000001<<31, comparing the result with a preset value. The memory access test writes 0x55AA and 0xAA55 to a dedicated test RAM address and reads them back for comparison. All test results are logically ANDed to generate a Boolean value test_pass (true for all passes, false for any failure), which is then output to step S25.

[0015] S24: Before the end of the self-test time slot, read the current cycle CRC signature crc_curr output by S22 and the crc_prev saved in the previous cycle (obtained from the backup register), perform a 32-bit equality comparison between the two, generate a boolean value crc_match (true indicates consistency, false indicates inconsistency), and output the result to step S25 for fault determination.

[0016] S25: Receives two parameters, test_pass from S23 and crc_match from S24. If test_pass == false or crc_match == false, the fault flag fault_flag = 1 is immediately triggered. At the hardware level, a hardwired connection independent of the CPU core forces all PWM outputs and GPIO output ports to a preset safe state (solenoid valve control port output 0V off, variable frequency fan analog output locked to 10V maximum frequency), with a response time <1μs. At the software level, after detecting the fault flag, the processor jumps to the safe mode entry function, stops the normal control logic, and sends a fault event packet to the host computer via an independent low-power communication interface, containing a fault type code (0x01 test vector failure, 0x02 signature mismatch, 0x03 both failures) and a timestamp. If test_pass == true and crc_match == true, the temporary flag (fault_flag = 0) is cleared, the control task context is restored, and the next working cycle begins. Finally, the fault_flag, fault type code, and safety mode status identifier are output and passed to S3 as one of the fault labels, and also passed to S5 to trigger dynamic refactoring.

[0017] S3: Adaptive fault reasoning based on incremental cause-effect graphs and online parameter learning; Accurate fault diagnosis is achieved through multi-source data fusion using a dynamically evolving causal graph model, without the need for pre-defined complete probability parameters; specifically, it includes initial causal graph construction, fault label-driven sample collection, online expectation-maximization parameter learning, causal graph structure learning, and real-time fault reasoning. Furthermore, S3 includes the following sub-steps executed in sequence: S31: Causal Graph Initialization: Based on the physical mechanism of the laboratory ventilation system and expert knowledge, a predefined set of nodes V and directed edges E are established. Nodes are divided into four categories: sensor variables (X1=VOC concentration, X2=temperature and humidity, X3=room pressure difference), actuator state variables (X4=valve opening feedback, X5=fan speed feedback), environmental variables (X6=outdoor temperature, X7=atmospheric pressure), and fault type variables (F1=sensor aging, F2=fan belt breakage, F3=valve jamming). Initial directed edges are set according to causal relationships, for example, temperature X2→VOC sensor value X1, fan control command U_fan→speed feedback X5, F2→X5. The conditional probability table θ_i=P(v_i|Pa(v_i)) for each node v_i is initially empty (or uniformly distributed). The initial causal graph structure G0=(V,E,Θ0) is output, providing a foundation for subsequent online learning.

[0018] S32: Fault Sample Collection During system operation, sample acquisition is triggered whenever a fault label y (specific fault type) is obtained through independent means. Independent means include: a "sensor failure" label is generated when the health label output by S1 is below 30%; a "CPU failure" label is generated when the fault flag output by S2 is 1; and the label is manually entered by the operator after confirming the maintenance record via the HMI. Centered on the fault occurrence time t0, observations of all variables V within the range [t0-5s, t0+5s] are extracted (sampling frequency 10Hz, approximately 100 time steps). The observations at each time step are concatenated into a feature vector x_t, which, along with the fault label y, forms a sample (x, y). The samples are stored in a rolling window W with a maximum capacity of 200, using a first-in, first-out (FIFO) strategy. The labeled sample set W is output for parameter updates and structure learning.

[0019] S33: Online parameter updates Whenever K=10 new samples are added, the Online Expectation-Maximization (OnlineEM) algorithm is executed once to update all conditional probability table parameters in the causal graph. For each node v_i, the new parameters are calculated based on the current sample set W and the parameters θ_i(t) from the previous round, according to the following formula: θ_i(t+1)=(1-η)·θ_i(t)+η·[Σ_{s∈W}I(v_i=x_i^(s),Pa(v_i)=π^(s))] / [Σ_{s∈W}I(Pa(v_i)=π^(s))+ε], Where η = 0.1 is the learning rate, and ε = 10⁻ 6To prevent smoothing terms from being divided by zero, I(·) is an indicator function. A forgetting factor λ = 0.95 is introduced to weight and decay old samples when calculating the denominator: the weight of the j-th sample is λ^{N_total-j}. For CPT entries where not enough samples have been found, the uniform distribution assumption is maintained. The updated CPT parameters Θ_new are output.

[0020] S34: Dynamic Expansion of Structure Structural learning is performed once after processing N_struct = 50 samples. The normalized mutual information (MMI) for each pair of nodes (v_i, v_j) is calculated: NMI(v_i, v_j) = I(v_i; v_j) / √[H(v_i)H(v_j)], where I(v_i; v_j) = Σ_{a,b}P(a,b)log[P(a,b) / (P(a)P(b))], H(·) is the information entropy, and the joint probability and marginal probability are estimated from the frequencies in the current sample window W. If NMI > τ (threshold τ = 0.3), and adding the directed edge v_i→v_j does not generate a directed cycle (checked by topological sorting), then the edge is automatically added. The direction of the edge is determined based on causal delay: the peak time of the cross-correlation between v_i and v_j is calculated; if the peak occurs in the positive delay, the direction is v_i→v_j. The CPT of the new edge is initialized to a uniform distribution. Output the expanded causal graph structure G_new.

[0021] S35: Post-fault reasoning When real-time fault diagnosis is required (e.g., triggered every 100ms), the multi-source data X_obs collected at the current moment (from sensor and actuator feedback) is used as evidence and input into the current causal graph G. The belief propagation algorithm is used to calculate the posterior probability of each fault node F_k: P(F_k|X_obs)=P(X_obs|F_k)P(F_k) / Σ_jP(X_obs|F_j)P(F_j). Since the causal graph is a directed acyclic graph, the belief propagation converges precisely in O(|V|·|E|) time through two traversals (top-down and bottom-up). A list of fault types is output, sorted in descending order of posterior probability and accompanied by a confidence level (e.g., "Wind turbine belt broken, 92%"). If the highest probability is below 0.6, "Suspected Fault" and its probability ranking are output. Finally, the fault type list and confidence levels are passed to S5 for dynamic reconfiguration strategy selection.

[0022] S4: After issuing a control command, receive the status feedback signal from the actuator's built-in sensor, compare the command value with the feedback value to determine the actuator fault, and trigger the local hard-wired bypass protection. Furthermore, S4 includes the following sub-steps: S41: Command-Feedback Comparison: Receives the command value u_cmd (0~100% opening) from the controller and the actual opening u_fb fed back by the actuator's built-in sensor (potentiometer or Hall sensor). Calculates the absolute deviation |u_cmd-u_fb|. If the deviation exceeds 5% and the duration exceeds 50ms (to prevent momentary jitter), it is determined to be an actuator fault, and a fault flag actuator_fault=1 is generated.

[0023] S42: Hard-wired bypass protection: Once actuator_fault=1, a processor-independent hardware comparator circuit (such as an LM393 comparator) is immediately triggered, directly cutting off the actuator's drive power. For air source solenoid valves, the valve automatically returns to its normally closed state after power failure; for exhaust fans, the inverter control terminals are forcibly pulled to 10V (maximum frequency) via hardware bypass. This hardware bypass does not rely on any software logic, ensuring reliable operation even if the processor crashes or the program malfunctions. The final output actuator fault flag actuator_fault and the actual feedback value u_fb are passed to S3 as one of the sources of fault labels, and also to S5 for degradation strategies.

[0024] S5: Based on the fault type and location reported in steps S2, S3, and S4, execute the preset degradation strategy to ensure that the system can maintain basic safety even in a non-fully functional state. Furthermore, the dynamic reconstruction and degradation fault tolerance include: S51: Sensor Failure Reconstruction: Receives the sensor failure diagnosis result (confidence > 0.8) output from S3. Automatically searches for similar sensors in neighboring areas (same exhaust duct or adjacent room), obtaining their concentration readings C_k and distances to the failure area d_k. Estimates the concentration in the failure area using distance-weighted interpolation: Ĉ_fail = Σ(C_k / d_k) / Σ(1 / d_k). Simultaneously, forcibly increases the opening of the exhaust branch valve in this area by 20% to increase dilution ventilation. Generates a "Sensor Degradation Mode" alarm.

[0025] S52: Controller Failover: Receives the core unit fault flag `fault_flag=1` from the S2 output. The collaborative control layer (central control host) immediately queries the preset control transfer table and transfers control of all actuators (valves, fans, etc.) under the jurisdiction of the faulty controller to adjacent edge controllers or directly to the central control host. The transfer process uses a heartbeat handshake protocol: the central control host sends a "takeover command," and the standby controller confirms and takes over the output; the total time is <10ms. During the transfer, the output port remains in the locked safety state of S25 to ensure no window of failure. Outputs the reconstructed control allocation table.

[0026] S53: Actuator Fault Compensation: Receives the actuator fault flag `actuator_fault=1` output from S4. If the fault is an exhaust fan, automatically start the backup exhaust fan (if configured); if there is no backup fan, reduce the airflow in that area by 30% to maintain relative negative pressure, and simultaneously issue an audible and visual alarm indicating "Experimental activity level restricted". If the fault is valve jamming, attempt to apply the maximum PWM pulse three times; if it still cannot be restored, shut down that branch and enable compensation in the adjacent branch. Finally, output a degradation mode indicator (such as "sensor degradation" or "controller standalone operation") and transmit it to S6.

[0027] S6: When a critical fault is detected (such as main control CPU failure, communication interruption, or power supply abnormality), the backup power supply (supercapacitor module) maintains the edge diagnostic layer operation and executes the preset emergency shutdown procedure.

[0028] Furthermore, S6 includes the following sub-steps: S61: Backup Power Management: Real-time monitoring of main power supply voltage (24V system). The supercapacitor module (5.4V / 10F, equivalent series resistance <50mΩ) is charged to 5V by the system power supply via DC-DC step-down during normal operation. When the main power supply voltage drops below 20V, the power monitoring chip (e.g., MAX809) outputs a low level, triggering the power switching circuit (P-MOSFET ideal diode), seamlessly switching to supercapacitor power supply within <100μs. A fully charged supercapacitor stores E=½CV²=0.5×10×25=125J of energy. With a system load of approximately 15W, this can sustain power for about 8 seconds, meeting the 3-second emergency shutdown requirement. A backup power ready flag is output.

[0029] S62: Emergency Shutdown Procedure: Receives unrecoverable critical fault determinations from S2, S3, and S5 (such as permanent CPU failure, communication interruption exceeding 1 second, main power failure, etc.). Executes the following actions in priority order: ① Directly cuts off the power to all flammable / toxic gas pipeline solenoid valves via a hard-wired bypass (independent of the CPU), immediately closing the valves; ② If the exhaust fan inverter is still controlled (e.g., directly connected via an independent PLC), sends an analog 10V signal to raise the fan frequency to its maximum (50Hz). If communication is interrupted, a hardware bypass shorts the inverter terminals to 10V; ③ For positive pressure laboratories, opens the pressure relief valve (normally closed, opens upon power-on) to prevent pressure buildup; ④ Sends a "System Emergency Shutdown" message to the management platform via a backup communication link (e.g., an RS-485 independent slave device), including a fault snapshot (critical variables and fault type for the last 5 seconds). After all actions are completed, the system enters a low-power sleep state (only fault indicator lights and power monitoring circuits are retained), requiring manual reset to restart. Finally, an emergency stop completion flag and a fault snapshot are output and transmitted to the collaborative control layer for recording and tracing.

[0030] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention adopts a single-processor time-interleaved self-test mechanism. During execution, CRC signatures are calculated for key intermediate data; during self-test, deterministic test vectors are executed and compared with historical signatures; and in case of a fault, the output is locked to a safe state within microseconds via an independent hardwired connection. Thus, a transient fault detection rate of >99.9% is achieved with single-processor hardware cost, eliminating the blind spot of common faults that cannot be detected by dual-core lockstep, and the hardware response speed meets the SIL 3 safety level. Simultaneously, based on incremental causal graphs and online parameter learning, the initial conditional probability table is uniformly distributed. Fault labels drive sample collection, and parameters are updated in real time using an online EM algorithm (learning rate 0.1, forgetting factor 0.95). The causal graph structure is automatically expanded through normalized mutual information. Therefore, no prior probability statistics are required, allowing operation from a cold start; the model dynamically evolves with equipment aging and environmental changes, maintaining a long-term diagnostic accuracy of over 92%; it can automatically discover new causal relationships, output fault types with confidence, and significantly shorten the average repair time. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating the implementation of Embodiment 1 of the present invention. Detailed Implementation

[0032] To provide a further understanding of the purpose, structure, features, and functions of the present invention, detailed descriptions are provided below with reference to specific embodiments.

[0033] A self-diagnostic laboratory safety control method includes the following sub-steps: S1: During system idle periods, inject standard test signals into the sensors or complete health checks of the sensors and channels through the internal self-test circuit, generating health labels and fault codes; Furthermore, S1 includes two sub-steps: sensor excitation response testing and signal channel integrity verification. S11: Sensor excitation response test; During system idle periods, a short-duration (e.g., 100ms) constant voltage excitation is applied to resistive sensors (such as catalytic combustion combustible gas sensors), and their response rise time and steady-state amplitude are collected and compared with the factory calibration curve. A reverse pulse is applied to electrochemical sensors to test their polarization resistance. If the response time deviation exceeds 20% or the steady-state amplitude deviation exceeds 15%, a "sensor performance degradation" warning is generated; if the deviation exceeds 50%, a "sensor failure" fault code is generated. The final outputs are the response time deviation rate Δt_r and the steady-state amplitude deviation rate ΔA, along with the corresponding warning or fault code, providing data support for subsequent health label calculations.

[0034] S12: Signal channel integrity check A DC reference voltage of known amplitude (e.g., 2.5V) is injected into the analog-to-digital conversion channel via an analog switch. The conversion result is read, and the gain error and offset error are calculated. If the gain error exceeds ±2% or the offset error exceeds ±1%, the signal conditioning circuit is considered faulty, and a corresponding fault code is generated. The output gain error E_g and offset error E_off, along with the fault code, are used for calculating the health status label.

[0035] Furthermore, the health status label is calculated as follows: The sensor score is determined based on the larger of Δt_r and ΔA output from S11: ≤5% is 100 points, 5%~20% is reduced to 70 points via linear interpolation, 20%~50% is reduced to 30 points via linear interpolation, and >50% is 0 points. The channel score is determined based on the larger of |E_g| and |E_off| output from S12 according to the same rules. The final health status of each channel is the minimum of the sensor score and the channel score. When the overall health status is below 30%, a "channel failure" fault code is output. Finally, a health status label (0~100%) and a fault code list are output and passed to step S3 for fault reasoning.

[0036] This step, by injecting standard test signals into the sensors during system idle periods (applying constant voltage excitation to resistive sensors to acquire response rise time and steady-state amplitude, and applying reverse pulses to test polarization resistance for electrochemical sensors) and performing signal channel integrity verification (injecting DC reference voltage to calculate gain error and offset error), solves the problem that existing technologies can only output a binary "normal / fault" judgment and cannot distinguish between sensor body faults and signal channel faults. This achieves the following beneficial effects: outputting a continuous health status of 0-100% and decomposing it into sensor scores and channel scores, enabling maintenance personnel to accurately locate the source of the fault (such as "sensor aging" or "ADC channel drift"), improving maintenance efficiency by more than 50%; providing early warning through three levels of deviation thresholds of 5%, 20%, and 50%, allowing calibration to be arranged 2-4 weeks in advance of the initial stage of sensor performance degradation, avoiding sudden failures; taking the minimum of the two values ​​as the final health status and only outputting fault codes when it is below 30%, reducing the false alarm rate by approximately 80% compared to traditional threshold alarms; and simultaneously, the output health status label serves as the source of fault labels for S3, providing a supervisory signal for the cause-effect graph.

[0037] S2: Through time-slice segmentation and self-testing mechanism of a single processor, it achieves fault detection capability equivalent to dual-core lockstep; Further, it includes the following sub-steps: S21: Time Slot Division: The processor's working cycle is divided into alternating execution time slots (10ms) and self-test time slots (50μs) by a hardware timer, and the current time slot type flag is output; The processor's working cycle is divided into alternating execution time slots (10ms) and self-test time slots (50μs) using a hardware timer (such as the SysTick timer of the ARM Cortex-M core, configured in periodic interrupt mode). The timer interrupt service routine sets the global flag slot_flag, which is set to "self-test time slot" when the interrupt starts and restored to "execution time slot" when it exits. This flag will be output to the subsequent S22 and S23 steps to distinguish the current time slot type and ensure that the tasks in each time slot are executed in an orderly manner.

[0038] S22: Execution Slot Verification: When slot_flag indicates "execution slot", the processor runs the laboratory safety control logic normally (such as PID adjustment, sensor reading, alarm judgment), and pushes the key intermediate data such as each ALU operation result, register write-back value, and memory write address into the ring buffer check_buf[] (depth 256) protected by the MPU in sequence; the processor's built-in CRC unit (polynomial 0x4C11DB7, initial value 0xFFFFFFFF) accumulates the checksum of all data in the buffer in real time, and updates incrementally for each entry written. At the end of each execution slot, the current CRC signature value crc_curr is saved to the backup register crc_backup, the buffer is cleared, and finally crc_curr is output to step S24.

[0039] S23: Self-test slot test: When slot_flag indicates "self-test slot", the processor first saves the context of the current control task (registers are pushed onto the stack), then jumps to the test code segment stored in ROM, and executes a series of test vectors sequentially: The ALU test performs operations using 0xFFFFFFFF+1 and 0x7FFFFFFF-0x80000000 to check whether the results and flag bits meet expectations. The multiplier test uses the operation 0x12345678×0x87654321, comparing the high 32 bits and low 32 bits of the product with a pre-stored golden value. The shifter test uses the operations 0x80000000>>1 and 0x00000001<<31, comparing the result with a preset value. The memory access test writes 0x55AA and 0xAA55 to a dedicated test RAM address and reads them back for comparison. All test results are logically ANDed to generate a Boolean value test_pass (true for all passes, false for any failure), which is then output to step S25.

[0040] S24: Before the end of the self-test time slot, read the current cycle CRC signature crc_curr output by S22 and the crc_prev saved in the previous cycle (obtained from the backup register), perform a 32-bit equality comparison between the two, generate a boolean value crc_match (true indicates consistency, false indicates inconsistency), and output the result to step S25 for fault determination.

[0041] S25: Receives two parameters, test_pass from S23 and crc_match from S24. If test_pass == false or crc_match == false, the fault flag fault_flag = 1 is immediately triggered. At the hardware level, a hardwired connection independent of the CPU core forces all PWM outputs and GPIO output ports to a preset safe state (solenoid valve control port output 0V off, variable frequency fan analog output locked to 10V maximum frequency), with a response time <1μs. At the software level, after detecting the fault flag, the processor jumps to the safe mode entry function, stops the normal control logic, and sends a fault event packet to the host computer via an independent low-power communication interface, containing a fault type code (0x01 test vector failure, 0x02 signature mismatch, 0x03 both failures) and a timestamp. If test_pass == true and crc_match == true, the temporary flag (fault_flag = 0) is cleared, the control task context is restored, and the next working cycle begins. Finally, the fault_flag, fault type code, and safety mode status identifier are output and passed to S3 as one of the fault labels, and also passed to S5 to trigger dynamic refactoring.

[0042] This step divides the processor's work cycle into alternating execution slots (10ms) and self-test slots (50μs) using a hardware timer. During the execution slot, key intermediate operation results are stored in a buffer and a CRC signature is calculated. During the self-test slot, a deterministic test vector covering the ALU, multiplier, shifter, and memory paths is executed, and the current CRC signature is compared with the signature from the previous cycle. If either comparison fails, the output port is locked to a safe state within <1μs via an independent hardwired connection. This solves the problems of traditional watchdog timers failing to detect transient faults, the high cost of dual-core locksteps, and the existence of blind spots for common faults. This addresses the problem and achieves the following beneficial effects: a transient fault detection rate of >99.9% is achieved using only a single processor, reducing hardware costs by approximately 50%; due to the spatiotemporal isolation between the self-test time slot and the execution time slot, and the independence of the test vectors, the common fault detection rate is increased from 0% to 100%; the hardware response speed is much faster than the software (<1μs), meeting the SIL3 safety level; CRC historical signature comparison can capture data integrity corruption at any moment during execution; the output fault flag serves as the "CPU fault" label for S3, simultaneously triggering the controller fault transfer of S5, achieving millisecond-level fault-tolerant switching.

[0043] S3: Adaptive fault reasoning based on incremental cause-effect graphs and online parameter learning; Accurate fault diagnosis is achieved through multi-source data fusion using a dynamically evolving causal graph model, without the need for pre-defined complete probability parameters; specifically, it includes initial causal graph construction, fault label-driven sample collection, online expectation-maximization parameter learning, causal graph structure learning, and real-time fault reasoning. Furthermore, S3 includes the following sub-steps executed in sequence: S31: Causal Graph Initialization: Based on the physical mechanism of the laboratory ventilation system and expert knowledge, a predefined set of nodes V and directed edges E are established. Nodes are divided into four categories: sensor variables (X1=VOC concentration, X2=temperature and humidity, X3=room pressure difference), actuator state variables (X4=valve opening feedback, X5=fan speed feedback), environmental variables (X6=outdoor temperature, X7=atmospheric pressure), and fault type variables (F1=sensor aging, F2=fan belt breakage, F3=valve jamming). Initial directed edges are set according to causal relationships, for example, temperature X2→VOC sensor value X1, fan control command U_fan→speed feedback X5, F2→X5. The conditional probability table θ_i=P(v_i|Pa(v_i)) for each node v_i is initially empty (or uniformly distributed). The initial causal graph structure G0=(V,E,Θ0) is output, providing a foundation for subsequent online learning.

[0044] S32: Fault Sample Collection During system operation, sample acquisition is triggered whenever a fault label y (specific fault type) is obtained through independent means. Independent means include: a "sensor failure" label is generated when the health label output by S1 is below 30%; a "CPU failure" label is generated when the fault flag output by S2 is 1; and the label is manually entered by the operator after confirming the maintenance record via the HMI. Centered on the fault occurrence time t0, observations of all variables V within the range [t0-5s, t0+5s] are extracted (sampling frequency 10Hz, approximately 100 time steps). The observations at each time step are concatenated into a feature vector x_t, which, along with the fault label y, forms a sample (x, y). The samples are stored in a rolling window W with a maximum capacity of 200, using a first-in, first-out (FIFO) strategy. The labeled sample set W is output for parameter updates and structure learning.

[0045] S33: Online parameter updates Whenever K=10 new samples are added, the Online Expectation-Maximization (OnlineEM) algorithm is executed once to update all conditional probability table parameters in the causal graph. For each node v_i, the new parameters are calculated based on the current sample set W and the parameters θ_i(t) from the previous round, according to the following formula: θ_i(t+1)=(1-η)·θ_i(t)+η·[Σ_{s∈W}I(v_i=x_i^(s),Pa(v_i)=π^(s))] / [Σ_{s∈W}I(Pa(v_i)=π^(s))+ε], Where η = 0.1 is the learning rate, and ε = 10⁻ 6 To prevent smoothing terms from being divided by zero, I(·) is an indicator function. A forgetting factor λ = 0.95 is introduced to weight and decay old samples when calculating the denominator: the weight of the j-th sample is λ^{N_total-j}. For CPT entries where not enough samples have been found, the uniform distribution assumption is maintained. The updated CPT parameters Θ_new are output.

[0046] S34: Dynamic Expansion of Structure Structural learning is performed once after processing N_struct = 50 samples. The normalized mutual information (MMI) for each pair of nodes (v_i, v_j) is calculated: NMI(v_i, v_j) = I(v_i; v_j) / √[H(v_i)H(v_j)], where I(v_i; v_j) = Σ_{a,b}P(a,b)log[P(a,b) / (P(a)P(b))], H(·) is the information entropy, and the joint probability and marginal probability are estimated from the frequencies in the current sample window W. If NMI > τ (threshold τ = 0.3), and adding the directed edge v_i→v_j does not generate a directed cycle (checked by topological sorting), then the edge is automatically added. The direction of the edge is determined based on causal delay: the peak time of the cross-correlation between v_i and v_j is calculated; if the peak occurs in the positive delay, the direction is v_i→v_j. The CPT of the new edge is initialized to a uniform distribution. Output the expanded causal graph structure G_new.

[0047] S35: Post-fault reasoning When real-time fault diagnosis is required (e.g., triggered every 100ms), the multi-source data X_obs collected at the current moment (from sensor and actuator feedback) is used as evidence and input into the current causal graph G. The belief propagation algorithm is used to calculate the posterior probability of each fault node F_k: P(F_k|X_obs)=P(X_obs|F_k)P(F_k) / Σ_jP(X_obs|F_j)P(F_j). Since the causal graph is a directed acyclic graph, the belief propagation converges precisely in O(|V|·|E|) time through two traversals (top-down and bottom-up). A list of fault types is output, sorted in descending order of posterior probability and accompanied by a confidence level (e.g., "Wind turbine belt broken, 92%"). If the highest probability is below 0.6, "Suspected Fault" and its probability ranking are output. Finally, the fault type list and confidence levels are passed to S5 for dynamic reconfiguration strategy selection.

[0048] This step initially constructs a causal directed graph (nodes include sensors, actuators, environment, and fault variables), with the conditional probability table initially uniformly distributed. During operation, whenever a fault label is obtained (from S1 self-check, S2 hardware fault, and manual maintenance records), data within a 10-second window before and after the fault is extracted and stored as samples in a rolling window. Every 10 new samples, the online expectation-maximization algorithm is executed to update the CPT parameters (learning rate 0.1, forgetting factor 0.95). Every 50 samples, the normalized mutual information between nodes is calculated, and new causal edges are automatically added when the threshold of 0.3 is exceeded (direction determined by the delay of the cross-correlation peak). During real-time diagnosis, the current multi-source data is input into the causal graph, and confidence propagation is used to output the fault type and confidence level, solving the problems of traditional Bayesian networks. Addressing the challenges of requiring a large number of prior samples and the inability of static structures to adapt to equipment aging, as well as the need for massive amounts of annotation and poor interpretability in deep learning methods, the following results were achieved: a cold start accuracy of 65%, which improved to 95% after 200 samples, far superior to static Bayesian networks (60%); a forgetting factor that allows the model to "forget" outdated data, reconverging within one week after equipment replacement, and maintaining a long-term accuracy of over 92%; automatic discovery of new causal edges (e.g., humidity → valve jamming), adapting to environmental changes; the ability to gradually build a diagnostic model even under extreme conditions with fewer than 10 real fault samples; outputting fault types with confidence (e.g., "fan belt broken, 92%)", supporting the generation of accurate repair work orders, and reducing the average repair time by more than 50%.

[0049] S4: After issuing a control command, receive the status feedback signal from the actuator's built-in sensor, compare the command value with the feedback value to determine the actuator fault, and trigger the local hard-wired bypass protection. Furthermore, S4 includes the following sub-steps: S41: Command-Feedback Comparison: Receives the command value u_cmd (0~100% opening) from the controller and the actual opening u_fb fed back by the actuator's built-in sensor (potentiometer or Hall sensor). Calculates the absolute deviation |u_cmd-u_fb|. If the deviation exceeds 5% and the duration exceeds 50ms (to prevent momentary jitter), it is determined to be an actuator fault, and a fault flag actuator_fault=1 is generated.

[0050] S42: Hard-wired bypass protection: Once actuator_fault=1, a processor-independent hardware comparator circuit (such as an LM393 comparator) is immediately triggered, directly cutting off the actuator's drive power. For air source solenoid valves, the valve automatically returns to its normally closed state after power failure; for exhaust fans, the inverter control terminals are forcibly pulled to 10V (maximum frequency) via hardware bypass. This hardware bypass does not rely on any software logic, ensuring reliable operation even if the processor crashes or the program malfunctions. The final output actuator fault flag actuator_fault and the actual feedback value u_fb are passed to S3 as one of the sources of fault labels, and also to S5 for degradation strategies.

[0051] This step receives feedback values ​​from the actuator's built-in sensors (potentiometers, Hall sensors) after issuing control commands, calculates the absolute deviation, and if the deviation exceeds 5% and lasts for more than 50ms, a fault is determined and a fault flag is generated. At the same time, a hardware comparison circuit independent of the processor (such as LM393) is triggered to directly cut off the actuator drive power (the air source solenoid valve is de-energized and normally closed, and the fan inverter terminal is forcibly pulled to 10V). This solves the problems of existing technologies that rely solely on software logic judgment, cannot respond when the processor crashes, and cause false alarms due to instantaneous jitter. As a result, the following beneficial effects are achieved: the 50ms duration requirement effectively filters out instantaneous signal fluctuations, reducing the false alarm rate by 80%; the independent hardware bypass can reliably operate even if the software is completely crashed, and the safety is far superior to software alarms; it is applicable to different types of actuators such as valves (0-100% opening) and fans (analog), and has strong versatility; the output actuator fault flag serves as the source of fault labels for S3, enabling the cause-effect graph to learn actuator fault modes such as "valve jamming".

[0052] S5: Based on the fault type and location reported in steps S2, S3, and S4, execute the preset degradation strategy to ensure that the system can maintain basic safety even in a non-fully functional state. Furthermore, the dynamic reconstruction and degradation fault tolerance include: S51: Sensor Failure Reconstruction: Receives the sensor failure diagnosis result (confidence > 0.8) output from S3. Automatically searches for similar sensors in neighboring areas (same exhaust duct or adjacent room), obtaining their concentration readings C_k and distances to the failure area d_k. Estimates the concentration in the failure area using distance-weighted interpolation: Ĉ_fail = Σ(C_k / d_k) / Σ(1 / d_k). Simultaneously, forcibly increases the opening of the exhaust branch valve in this area by 20% to increase dilution ventilation. Generates a "Sensor Degradation Mode" alarm.

[0053] S52: Controller Failover: Receives the core unit fault flag `fault_flag=1` from the S2 output. The collaborative control layer (central control host) immediately queries the preset control transfer table and transfers control of all actuators (valves, fans, etc.) under the jurisdiction of the faulty controller to adjacent edge controllers or directly to the central control host. The transfer process uses a heartbeat handshake protocol: the central control host sends a "takeover command," and the standby controller confirms and takes over the output; the total time is <10ms. During the transfer, the output port remains in the locked safety state of S25 to ensure no window of failure. Outputs the reconstructed control allocation table.

[0054] S53: Actuator Fault Compensation: Receives the actuator fault flag `actuator_fault=1` output from S4. If the fault is an exhaust fan, automatically start the backup exhaust fan (if configured); if there is no backup fan, reduce the airflow in that area by 30% to maintain relative negative pressure, and simultaneously issue an audible and visual alarm indicating "Experimental activity level restricted". If the fault is valve jamming, attempt to apply the maximum PWM pulse three times; if it still cannot be restored, shut down that branch and enable compensation in the adjacent branch. Finally, output a degradation mode indicator (such as "sensor degradation" or "controller standalone operation") and transmit it to S6.

[0055] This step implements a three-level degradation strategy based on the fault type and location reported by S2, S3, and S4: When a sensor fails, data from similar sensors in a nearby area is retrieved, and distance-weighted interpolation is used to estimate the concentration in the failed area, forcibly increasing the opening of the exhaust branch valve in that area by 20%; when a controller fails, the collaborative control layer transfers control to the adjacent edge controller or the main control unit within 10ms; when an actuator fails, a backup exhaust fan is started, and if no backup is available, the air supply volume is reduced by 30% and an alarm is triggered; if a valve is stuck, it is impacted with the maximum PWM pulse three times, and if ineffective, the branch is shut down and compensation from adjacent branches is enabled, thus solving the problems of traditional systems. The problems of direct shutdown after a fault or lack of graded fault tolerance leading to experimental interruption and insufficient safety margin have been addressed. This has resulted in: differentiated strategies for different faults to maximize the maintenance of negative pressure and ventilation safety in the laboratory; controller fault transfer time of <10ms, during which the output port remains in a safe S2 locked state with no uncontrollable window, improving by two orders of magnitude compared to traditional hot standby switching (seconds); high accuracy of distance-inverse weighted interpolation, with 20% improved ventilation and effective dilution of contaminants; a valve jamming impact attempt success rate of approximately 70%, reducing unnecessary maintenance; and triggering an S6 emergency shutdown if the degradation strategy fails to recover, forming a safety closed loop.

[0056] S6: When a critical fault is detected (such as main control CPU failure, communication interruption, or power supply abnormality), the backup power supply (supercapacitor module) maintains the edge diagnostic layer operation and executes the preset emergency shutdown procedure.

[0057] Furthermore, S6 includes the following sub-steps: S61: Backup Power Management: Real-time monitoring of main power supply voltage (24V system). The supercapacitor module (5.4V / 10F, equivalent series resistance <50mΩ) is charged to 5V by the system power supply via DC-DC step-down during normal operation. When the main power supply voltage drops below 20V, the power monitoring chip (e.g., MAX809) outputs a low level, triggering the power switching circuit (P-MOSFET ideal diode), seamlessly switching to supercapacitor power supply within <100μs. A fully charged supercapacitor stores E=½CV²=0.5×10×25=125J of energy. With a system load of approximately 15W, this can sustain power for about 8 seconds, meeting the 3-second emergency shutdown requirement. A backup power ready flag is output.

[0058] S62: Emergency Shutdown Procedure: Receives unrecoverable critical fault determinations from S2, S3, and S5 (such as permanent CPU failure, communication interruption exceeding 1 second, main power failure, etc.). Executes the following actions in priority order: ① Directly cuts off the power to all flammable / toxic gas pipeline solenoid valves via a hard-wired bypass (independent of the CPU), immediately closing the valves; ② If the exhaust fan inverter is still controlled (e.g., directly connected via an independent PLC), sends an analog 10V signal to raise the fan frequency to its maximum (50Hz). If communication is interrupted, a hardware bypass shorts the inverter terminals to 10V; ③ For positive pressure laboratories, opens the pressure relief valve (normally closed, opens upon power-on) to prevent pressure buildup; ④ Sends a "System Emergency Shutdown" message to the management platform via a backup communication link (e.g., an RS-485 independent slave device), including a fault snapshot (critical variables and fault type for the last 5 seconds). After all actions are completed, the system enters a low-power sleep state (only fault indicator lights and power monitoring circuits are retained), requiring manual reset to restart. Finally, an emergency stop completion flag and a fault snapshot are output and transmitted to the collaborative control layer for recording and tracing.

[0059] This step involves real-time monitoring of the main power supply voltage (24V system). The supercapacitor module (5.4V / 10F) is charging normally. When the main power supply drops below 20V, the power monitoring chip triggers the P-MOSFET ideal diode to seamlessly switch to supercapacitor power supply within <100μs (fully charged, it stores 125J of energy, which can last for 8 seconds). When an unrecoverable critical fault is detected (permanent CPU failure, communication interruption >1s, main power failure, etc.), an emergency shutdown is executed according to priority: ① Hard-wired bypass closes all air supply valves, ② Forced ventilation (inverter 10V signal or hardware bypass), ③ Opens the pressure relief valve (positive pressure laboratory), ④ Sends an emergency shutdown message and fault snapshot. After completion, the system enters low-power sleep mode, requiring manual intervention. The reset and restart mechanism solves the problems of traditional systems completely losing their safety protection capabilities when the main power supply fails or the CPU crashes, and the lack of priority in emergency shutdowns preventing critical actions from being completed. This achieves the following results: power switching time <100μs, with no power outage window; 125J of energy storage can sustain operation for 8 seconds, far exceeding the 3-second emergency shutdown requirement, ensuring reliable execution of all critical actions; priority scheduling based on "shutting down the gas source → forced ventilation → opening the pressure relief valve → alarm" ensures that even with insufficient power, the most critical gas source shutdown operation can be completed, reducing the risk of hazardous gas leaks by 90%; independent hardware circuits are used for gas source shutdown and forced ventilation, allowing execution even if the CPU completely crashes, meeting SIL3 level requirements; fault snapshot uploads facilitate post-event traceability and analysis.

[0060] This invention systematically solves two core problems in the background technology through a complete process of six steps, S1 to S6. S2 adopts a single-processor time-slice segmentation and self-testing mechanism to achieve fault detection capability equivalent to dual-core lockstep at low cost and eliminate common fault blind spots; S3 is based on incremental cause-effect graphs and online parameter learning to achieve adaptive fault reasoning without prior probability; together with the active self-testing in S1, the actuator closed-loop verification in S4, the dynamic reconfiguration and degradation in S5, and the emergency shutdown and solidification in S6, a complete closed loop from fault perception, diagnosis, fault tolerance to safety protection is constructed, which significantly improves the reliability and safety of the system.

[0061] The present invention has been described by the above-described embodiments; however, these embodiments are merely examples for implementing the present invention. It must be noted that the disclosed embodiments do not limit the scope of the present invention. Conversely, any modifications and refinements made without departing from the spirit and scope of the present invention are within the scope of patent protection of the present invention.

Claims

1. A laboratory safety self-control method for fault self-diagnosis, characterized in that: S1: During system idle periods, inject standard test signals into the sensors or complete health checks of the sensors and channels through the internal self-test circuit, generating health labels and fault codes; S2: Through time-slice segmentation and self-testing mechanism of a single processor, it achieves fault detection capability equivalent to dual-core lockstep; S3: Adaptive fault reasoning based on incremental cause-effect graphs and online parameter learning; S4: After issuing a control command, receive the status feedback signal from the actuator's built-in sensor, compare the command value with the feedback value to determine the actuator fault, and trigger the local hard-wired bypass protection. S5: Based on the fault type and location reported in steps S2, S3, and S4, execute the preset degradation strategy to ensure that the system can maintain basic safety even in a non-fully functional state. S6: When a critical fault is detected, the backup power supply maintains the edge diagnostic layer and executes a preset emergency shutdown procedure.

2. The laboratory safety self-control method for fault self-diagnosis as described in claim 1, characterized in that: Step S2 further includes: S21: The hardware timer divides the processor's working cycle into alternating execution time slots and self-test time slots, and outputs the current time slot type flag; S22: When in an execution time slot, the processor runs the security control logic, stores the key intermediate calculation results into the verification buffer, and uses the CRC unit to calculate the accumulated signature in real time, and outputs the CRC signature at the end of the current cycle. S23: When in the self-test time slot, the processor suspends the control logic, executes a deterministic test vector covering the ALU, multiplier, shifter, and storage path, compares the actual output with the pre-stored golden result, and outputs the comparison result; S24: At the end of the self-test time slot, compare the current CRC signature obtained in S22 with the signature saved in the previous cycle, and output the signature comparison result; S25: If the output of S23 or S24 is a failure or inconsistent, a fault flag is triggered, the output port is forcibly locked to a preset safe state through an independent hardware line, and a fault event is reported; otherwise, the temporary flag is cleared and the next cycle begins.

3. The laboratory safety self-control method for fault self-diagnosis as described in claim 1, characterized in that: Step S3 further includes: S31: Based on physical mechanisms and expert knowledge, predefine the set of nodes and the set of directed edges, and construct an initial causal directed graph. The conditional probability table of each node is initially empty or uniformly distributed. S32: Whenever a fault label is obtained through independent means, the variable observation values ​​within the time window before and after the fault are extracted as training samples and stored in the rolling window; S33: For every K new samples, update the conditional probability table parameters of each edge using the online expectation-maximization algorithm, and introduce a forgetting factor; S34: After processing N samples, calculate the normalized mutual information between nodes. If it exceeds the threshold and does not violate the directed acyclic graph constraint, then automatically add a new causal edge. S35: Input real-time multi-source data as evidence into the current causal graph, calculate the posterior probability of each fault node through confidence propagation, and output the fault type and confidence level.

4. The laboratory safety self-control method for fault self-diagnosis as described in claim 3, characterized in that: In step S32: the independent means include the "sensor failure" label generated when the health label output by S1 is lower than 30%, the "CPU failure" label generated by the fault flag output by S2, and the label manually entered by the operator after confirming the maintenance record through the human-machine interface; the time window is [t0-5s, t0+5s], and the sampling frequency is 10Hz.

5. The laboratory safety self-control method for fault self-diagnosis as described in claim 3, characterized in that: In step S33: the update formula for the online expectation-maximization algorithm is θ_i(t+1)=(1-η)·θ_i(t)+η·[Σ_{s∈W}I(v_i=x_i^(s),Pa(v_i)=π^(s))] / [Σ_{s∈W}I(Pa(v_i)=π^(s))+ε] to calculate the new parameters, where η=0.1 is the learning rate and ε=10⁻ 6 To prevent the smoothing term from being divided by zero, I(·) is an indicator function. A forgetting factor λ = 0.95 is introduced.

6. The laboratory safety self-control method for fault self-diagnosis as described in claim 3, characterized in that: In step S34: the normalized mutual information calculation formula is NMI(v_i,v_j)=I(v_i;v_j) / √[H(v_i)H(v_j)], where I(v_i;v_j)=Σ_{a,b}P(a,b)log[P(a,b) / (P(a)P(b))], H(·) is the information entropy, and the joint probability and marginal probability are estimated from the frequency in the current sample window W; the direction of the edge is determined by calculating the peak delay of the cross-correlation.

7. The laboratory safety self-control method for fault self-diagnosis as described in claim 1, characterized in that: Step S1 further includes sensor excitation response testing and signal channel integrity verification; the health label takes the lowest value of the sensor score and the channel score, and outputs a fault code when the overall health is below 30%.

8. The laboratory safety self-control method for fault self-diagnosis as described in claim 1, characterized in that: In step S4: when the deviation between the instruction value and the feedback value exceeds 5% and the duration exceeds 50ms, it is determined to be an actuator fault; the hard-wired bypass protection uses a hardware comparison circuit independent of the processor to directly cut off the actuator drive power supply.

9. The laboratory safety self-control method for fault self-diagnosis as described in claim 1, characterized in that: The degradation strategy in step S5 includes: sensor failure reconstruction, controller fault transfer, and actuator fault compensation; the emergency shutdown procedure in step S6 sequentially shuts off the air source, forces ventilation, opens the pressure relief valve, and sends an alarm according to priority.

10. A laboratory safety automatic control system with self-diagnosis of faults, characterized in that, The system is used to perform the method according to any one of claims 1 to 9.

Images