Safety control system and method for explosion-proof automatic guided vehicle based on safety tree logic

Abstract

The application discloses a kind of safety control system and method of explosion-proof automatic guided vehicle based on security tree logic, system is obtained by acquisition module real-time acquisition vehicle body operation and environmental parameter, adopt the two-way reasoning mechanism of safety degree from bottom to top layer by layer calculation, from top to bottom reverse positioning risk source, root node safety degree and the node combination that causes target safety condition to weaken are jointly used as safety judgment basis, and set early warning speed limit, controlled parking and explosion-proof isolation, emergency power-off and energy isolation three-level response.The application can self-adaptively adjust node weight and credibility coefficient, suppress sensor misjudgment, realize multivariate coupling risk accurate identification, automatically guide safety state when fault, significantly improve the running safety, reliability and anti-interference ability of explosion-proof AGV in high-risk environment, adapt to petrochemical, coal mine, military and other explosion-proof scenes.

Description

Technical Field

[0001] This invention belongs to the field of intelligent mobile equipment safety control technology, specifically relating to a safety control system and method for explosion-proof automated guided vehicles (AGVs) based on safety tree logic, which is particularly suitable for the safe operation and control of AGVs in explosion-proof and high-risk industrial environments. Background Technology

[0002] With the widespread application of automated transportation equipment in industrial production, Automated Guided Vehicles (AGVs) are gradually becoming core components of intelligent manufacturing and warehousing logistics. However, the safety risks of AGVs in explosion-proof environments such as petrochemical, coal mine, and military industries have increased significantly. Traditional AGV safety control systems typically rely on passive monitoring or single sensor feedback, with simple logic judgment mechanisms that cannot handle complex safety decisions. When temperature, current, voltage, or gas concentration is abnormal, the system's response is delayed or misjudgments occur, potentially leading to serious accidents such as equipment damage or explosions. In-depth research on the reliability and maintainability of AGV systems can not only effectively improve equipment stability and safety, and enhance system maintenance efficiency and availability, but also has significant practical implications for reducing long-term operating costs and promoting the development of industrial automation. This research not only supports the rapid development of intelligent manufacturing and automated logistics, but also provides scientific basis and practical guidance for the design and application of future AGV systems, driving further upgrades and innovations in related technologies.

[0003] An AGV system consists of several key components, including a power system, sensors, a control module, a drive unit, and a communication system. The proper functioning of these components is a prerequisite for the smooth operation of the AGV system; the failure of any one component can lead to a decline in system performance or even complete system failure. By applying reliability tools such as fault tree analysis (FTA) and failure mode and effects analysis (FMEA), the potential failure modes of these key components can be systematically identified. While existing FTA has some application in safety modeling, its structural model is guided by a "fault causal chain," making it difficult to achieve automatic transitions from a fault state to a safe state in real-time control scenarios. Therefore, there is an urgent need for a control model based on safety logic reasoning, enabling the system to quickly switch to a safe state when potential risks or faults occur, thereby achieving proactive safety control. Summary of the Invention

[0004] In view of this, the present invention provides a safety control system and method for explosion-proof automated guided vehicles based on safety tree logic, which solves the problems of lagging safety control, easy misjudgment, and difficulty in automatic guidance safety of explosion-proof AGVs.

[0005] To solve the above-mentioned technical problems, the present invention is implemented as follows.

[0006] A safety control system for explosion-proof automated guided vehicles based on safety tree logic, comprising: The data acquisition module is used to acquire system operation data and environmental data of the explosion-proof automated guided vehicle in real time. The security logic module stores a security tree logic model; the root node of the security tree logic model corresponds to the target security state; the root node is decomposed into intermediate logic nodes and bottom-level nodes according to the security trigger logic; the child nodes of the same node have importance weights that affect the state of the upper-level node and credibility coefficients that represent the reliability of the current data; the effective weight of the node is calculated based on the importance weights and credibility coefficients, and participates in the security calculation of the upper-level node; The security logic module determines whether the basic security conditions of the underlying nodes are met or close to being met based on system operation data and environmental data, which serves as the node state of the underlying nodes. Based on the node states of the underlying nodes, the security level of each node is calculated layer by layer in a top-down forward order. Starting from the target security conditions corresponding to the root node, it determines whether changes in the security level of the root node weaken the target security conditions, and searches for node combinations that weaken the target security conditions in a top-down reverse order. Then, it outputs security actions according to the preset handling rules corresponding to the node combinations. Furthermore, it dynamically adjusts the importance weight of nodes based on the joint early warning situation of the underlying nodes, and dynamically adjusts the credibility coefficient based on the early warning probability of the underlying nodes. The control execution module is used to execute the security actions output by the security logic module.

[0007] Preferably, the safety tree logic model is based on three risk mechanisms in explosion-proof scenarios: formation of explosive media, formation of ignition sources, and failure of safety handling, and adopts a three-level hierarchical structure of top-level root node - intermediate logic node - bottom-level node; The top-level root node represents the target's safe state; The intermediate logical node is the connection link between the root node and the bottom node, and is divided into three branches: environmental safety control A, ignition source suppression B, and functional safety link C. The bottom-level nodes are the basic data source for the model; the bottom-level nodes of the environmental safety control branch A include combustible gas concentration within the preset safety range (A1), normal ventilation status (A2), and effective closure of the isolation mechanism (A3); the bottom-level nodes of the ignition source suppression branch B include the drive circuit within the intrinsically safe electrical parameter range (B1), the explosion-proof cavity pressure within the allowable range (B2), and the vehicle body electrostatic potential within the allowable range (B3); the bottom-level nodes of the functional safety link branch C include effective anomaly detection (C1), effective risk assessment (C2), and effective action feedback (C3).

[0008] Preferably, the acquisition module is installed on the vehicle body and the monitoring position of the working environment to collect motor temperature, battery voltage, drive current, combustible gas concentration, dust concentration, ventilation equipment operation status, isolation mechanism position status, explosion-proof cavity pressure, vibration signal, vehicle body electrostatic potential and execution feedback status in real time; The collected data is converted into the node status of the underlying nodes after time synchronization, filtering and noise reduction, drift compensation, outlier removal, threshold mapping and multi-source cross-validation. The node status adopts a three-level discrete status value, including at least a safe state value of 1, a warning state value of 0.5 and a failure state value of 0. For the underlying nodes that only need to be determined as true or false, the node status is represented by a binary value: a safe state value of 1 and a failure state value of 0.

[0009] Preferably, in the security logic module, starting from the target security condition corresponding to the root node, it determines whether a change in the security level of the root node weakens the target security condition, and retrieves node combinations that weaken the target security condition in a top-down reverse order; then, it outputs a security action according to the preset handling rules corresponding to the node combinations. Each root node has a corresponding critical safety threshold and a safety threshold. If the safety threshold is lower than the critical safety threshold, the node is in a safe state; if it is lower than the safety threshold, it is in a failed state. Intermediate logical nodes only have a security threshold, corresponding to two node states: failure and safety. The underlying nodes have corresponding warning thresholds and safety thresholds. The safety threshold is lower than the warning threshold. When the safety level of a node is higher than the warning threshold, the node is in a safe state. If it is between the two thresholds, the node is in a warning state. If it is lower than the safety threshold, the node is in a failed state. For underlying nodes that only need to perform a valid / unsuccessful judgment, there are only two node states: failed and safe. Based on the extent to which changes in security weaken the target's security conditions, and the type of node combination, tiered measures are implemented: (1) Early warning level handling of general risks: When at least one bottom node changes from a safe state to a warning state, or when the difference between the monitoring value of the safety-related equipment status and the warning threshold is lower than the preset safety margin, but the root node is in a safe state and there is no cross-branch correlation anomaly that meets the preset explosion induction criterion, it is judged as a general risk. The cross-branch association anomaly refers to a situation where, within a preset time window, two or more bottom-level nodes belonging to different intermediate logic branches are simultaneously in a failure state or a warning state, and the combination logic of these bottom-level nodes satisfies a preset explosion triggering criterion. In this case, it is determined that these bottom-level nodes form a combination of nodes that weakens the target's security conditions, and the cross-branch association anomaly occurs. The warning level response is: motor speed limiting and / or active heat dissipation; (2) Controlled safety level handling of moderate risk: When the aforementioned cross-branch association anomaly occurs, but the root node is in a safe state, it is determined to be of medium risk; The controlled safety level procedure is as follows: immediately stop the vehicle and simultaneously activate the explosion-proof isolation mechanism to cut off the exchange of hazardous media between the internal and external environments; (3) Emergency-oriented response to severe risks: When the security level of the root node is between the security threshold and the critical security threshold, and at least one intermediate logical node fails, or the preset high-risk bottom node combination fails or the alarm state continues for more than the preset duration, the top root node is determined to enter the critical failure state; if the security level of the root node is further lower than the security threshold, it is determined to be a root node failure; both root node failure and critical failure are determined to be a serious risk. The emergency guidance level response is as follows: trigger the highest priority response, implement emergency power cut-off and physical energy isolation, so that the explosion-proof automated guided vehicle enters a zero-energy safety state to prevent the formation of an ignition source.

[0010] Preferably, the security logic module dynamically adjusts the importance weight of nodes based on the joint early warning situation of the underlying nodes, specifically including: When an anomaly in cross-branch association is detected, the importance weight of nodes that jointly weaken the security conditions of the same parent node is increased, and then normalization is performed across all child nodes of the parent node.

[0011] Preferably, in the judgment of cross-branch association anomalies, the preset explosion induction criterion is met as follows: the direction, duration and sequence of node state changes satisfy the preset danger evolution law.

[0012] Preferably, the security logic module dynamically adjusts the credibility coefficient based on the warning probability of the underlying node, specifically including: The frequency of anomalies and the probability of failure for each underlying node within a preset statistical period are calculated using historical operational data. The reliability coefficient of the underlying node is then updated based on the frequency of anomalies and the probability of failure. The higher the frequency of anomalies and the greater the probability of failure, the lower the reliability coefficient.

[0013] This invention also provides a safety control method for explosion-proof automated guided vehicles based on safety tree logic, comprising: A security tree logical model is constructed; the root node of the security tree logical model corresponds to the target security state; the root node is decomposed into intermediate logical nodes and bottom nodes in sequence according to the security triggering logic; the child nodes of the same node have importance weights that affect the state of the upper-level node and credibility coefficients that represent the reliability of the current data; the effective weight of the node is calculated according to the importance weight and credibility coefficient, and participates in the security calculation of the upper-level node; Real-time acquisition of system operation data and environmental data collected from explosion-proof automated guided vehicles; Based on system operation data and environmental data, determine whether the basic security conditions of the bottom-level nodes are met or close to being met, and use this as the node state of the bottom-level nodes; based on the node state of the bottom-level nodes, calculate the security level of each node layer by layer in a positive order from bottom to top. Starting from the target security condition corresponding to the root node, determine whether the change in the security level of the root node weakens the target security condition, and retrieve the node combination that weakens the target security condition in a top-down reverse order; then output the security action according to the preset handling rules corresponding to the node combination. The importance weight of nodes is dynamically adjusted based on the joint early warning situation of the underlying nodes, and the credibility coefficient is dynamically adjusted based on the early warning probability of the underlying nodes.

[0014] Beneficial effects: (1) The safety tree logic of this invention is not based on the static composition relationship of vehicle components, but on the explosion-proof hazard mechanism. Accidents in explosion-proof automated guided vehicles in dangerous areas are usually not directly caused by the over-limit of a single parameter, but are formed by the coupling and evolution of three types of conditions in time and space: the formation of explosive medium, the appearance of ignition source, and the failure of safety handling chain. Therefore, the safety tree logic model of this invention is based on the three types of hazard mechanisms of explosive medium formation, ignition source formation, and safety handling failure in explosion-proof scenarios to construct a safety tree. It breaks through the limitation of traditional fault trees that only focus on the fault causal chain. It can integrate multi-source data such as gas, static electricity, temperature, pressure, and electrical parameters in real time, accurately identify potential explosion risks caused by multi-parameter coupling in explosion-proof scenarios, solve the problem of lagging judgment and high misjudgment rate of single sensor, and significantly improve the accuracy and comprehensiveness of hazard identification.

[0015] (2) This invention adopts a logical combination of bottom-up calculation of safety level and top-down location of risk source. The occurrence of safety events not only depends on the safety level, but also introduces the node combination that weakens the target safety conditions. It can quantify the overall safety level of the system in real time through the status of the underlying nodes, and can quickly backtrack and lock the risky node combination when the safety level decays. The safety judgment no longer relies solely on the threshold exceeding the limit, but simultaneously introduces the node combination criterion that weakens the target safety conditions, realizing the dual-dimensional judgment of "overall safety level assessment + local risk source location", which greatly improves the accuracy of hazard identification, avoids false triggering or missed judgment of a single parameter, and makes the safety handling actions more accurate and more in line with the actual hazard mechanism.

[0016] Moreover, this invention uses the root node safety level and abnormal node combinations as the core basis for triggering safety events, breaking through the shortcomings of traditional AGVs that rely solely on instantaneous thresholds for judgment. It can effectively distinguish between instantaneous interference, single-parameter drift, and real coupled dangers. The corresponding level of action is only triggered when the safety level is insufficient and there is an abnormal node combination pointing to the risk of explosion. This significantly reduces unnecessary interventions such as accidental shutdowns and power outages, improving the continuous operation efficiency of the equipment while ensuring ultimate safety.

[0017] (3) The present invention establishes a three-level graded safety response mechanism. When a fault occurs, the system automatically and quickly guides the system to a safe state. Based on the safety level of the bottom node, intermediate node and root node, the system performs actions such as early warning speed limit, controlled stop + explosion-proof isolation and emergency power cut-off + energy isolation. After an abnormality is triggered, it can be handled in a closed loop according to the preset logic without manual intervention. It blocks the coupling between the ignition source and the dangerous medium from the source, effectively prevents the accident from escalating, and ensures that the AGV always converges to a safe state in the fault state, which greatly improves the safety of operation in the explosion-proof environment.

[0018] (4) The node weights and reliability coefficients of the present invention are no longer fixed and are adaptively adjusted according to the operating conditions to improve the system’s anti-interference and robustness. The importance weights are dynamically corrected by joint fluctuation events, the reliability coefficients are updated according to the failure frequency, and the multi-source cross-verification and redundancy replacement mechanism are combined to suppress misjudgments caused by sensor drift, single-point failures and instantaneous interference, so that the safety judgment is more in line with the actual working conditions and significantly improves the stability, reliability and anti-interference ability of the system in complex explosion-proof environments.

[0019] (5) The present invention forms a closed-loop safety control system of acquisition-judgment-decision-execution-feedback. It collects data in real time, calculates safety level from bottom to top, locates risk sources from top to bottom, executes graded actions, and updates weights through feedback. It forms an active safety protection closed loop throughout the process, continuously optimizes judgment accuracy, reduces the probability of fault propagation and energy release, extends equipment life, reduces operation and maintenance costs, and improves the long-term operating efficiency of explosion-proof AGV. Attached Figure Description

[0020] Figure 1This is a schematic diagram of the structural framework of the explosion-proof automated guided vehicle safety control system of the present invention.

[0021] Figure 2 This is a schematic diagram of the security tree logic analysis model of the present invention. Detailed Implementation

[0022] To illustrate the technical solution of this application, specific embodiments are described below.

[0023] 1. System Architecture and Interaction See Figure 1 The explosion-proof automated guided vehicle safety control system of the present invention includes a data acquisition module, a safety logic module, and a control execution module.

[0024] The data acquisition module, installed at key locations on the AGV body or in monitoring positions of the operating environment, is used to acquire real-time system operation data and environmental data of the explosion-proof automated guided vehicle. In this embodiment, it acquires real-time data such as motor temperature, battery voltage, drive current, combustible gas concentration, dust concentration, ventilation equipment operating status, isolation mechanism position status, explosion-proof cavity pressure, vibration signal, vehicle body electrostatic potential, and execution feedback status, and transmits this data to the safety logic module for analysis via a bus or industrial communication link.

[0025] The security logic module constructs a multi-layered security judgment system based on a security tree logic structure. Specifically, the security logic module uses the target security condition corresponding to the top-level root node as the judgment benchmark. This target security condition is not a single instantaneous threshold, but is jointly constituted by the root node security criterion and the abnormal node combination criterion.

[0026] The control execution module performs safety actions such as speed limiting, active heat dissipation, controlled parking, explosion-proof isolation, emergency power cut-off, and physical energy isolation based on the output of the safety logic module.

[0027] Figure 2This diagram illustrates the safety tree logic of the present invention for explosion-proof automated guided vehicles (AGVs). The safety tree logic model in this invention is not established based on the static compositional relationships of vehicle components, but rather on the hazard formation mechanism under explosion-proof scenarios. Accidents involving explosion-proof AGVs in hazardous areas are typically not directly caused by a single parameter exceeding its limit, but rather by the temporal and spatial coupling evolution of three conditions: the formation of explosive media, the appearance of an ignition source, and the failure of the safety response chain. Therefore, the safety tree logic model of this invention, based on the three hazard mechanisms of explosive media formation, ignition source formation, and safety response failure under explosion-proof scenarios, adopts a three-level hierarchical structure: top-level root node—intermediate logic nodes—bottom-level nodes. The top-level root node corresponds to the target safety state and is the target for model judgment. The root node is decomposed downwards into intermediate logic nodes and bottom-level nodes according to the safety triggering logic. Child nodes of the same node have importance weights that affect the state of the superior node and a reliability coefficient representing the reliability of the current data. The effective weight of the node is calculated based on the importance weight and the reliability coefficient, and participates in the safety calculation of the superior node.

[0028] In this embodiment, the intermediate logic node is the connection link between the root node and the bottom-level nodes, divided into three branches: Environmental Safety Control A, Ignition Source Suppression B, and Functional Safety Link C. Environmental Safety Control Branch A characterizes whether hazardous media enrichment conditions have formed in the work area; Ignition Source Suppression Branch B characterizes whether electrical, electrostatic, or mechanical energy release conditions exist inside the vehicle body that could ignite the environment; and Functional Safety Link Branch C characterizes whether the closed-loop of anomaly detection, risk assessment, and safety execution is effective. This tree construction method can directly reflect the hazard formation path in explosion-proof scenarios and supports risk reasoning from single-variable anomalies to multi-variable coupled anomalies.

[0029] The bottom-level nodes are the foundational data source for the model. The bottom-level nodes for Environmental Safety Control Branch A include: combustible gas concentration within a preset safe range (A1); normal ventilation (A2); and effective closure of the isolation mechanism (A3). The bottom-level nodes for Ignition Source Suppression Branch B include: drive circuit within intrinsically safe electrical parameter range (B1); explosion-proof cavity pressure within allowable range (B2); and vehicle body electrostatic potential within allowable range (B3). The bottom-level nodes for Functional Safety Link Branch C include: effective anomaly detection (C1); effective risk assessment (C2); and effective action feedback (C3). These bottom-level nodes are not directly equivalent to the instantaneous sampled values ​​of a single sensor. Instead, they are node state values ​​formed by time synchronization, filtering and noise reduction, drift compensation, outlier removal, threshold mapping, and multi-source cross-validation of data from various sensors. Among them, A1, the concentration of explosive media is within a safe range, determined by the detected concentration of combustible gas or dust in the working environment, after averaging over a time window, drift compensation, and conversion to the lower explosive limit; A2, the normal ventilation status, is determined by the combined status of ventilation equipment operation, air volume information, differential pressure information, or valve status; A3, the effective isolation boundary, is determined by the combined status of isolation mechanism position feedback, locking status, and sealing boundary status; B1, the energy released by the electrical circuit is within an intrinsically safe range, is determined by the combined status of power battery output voltage, drive circuit current, motor winding temperature, etc.; B2, the effective maintenance of the integrity of the explosion-proof cavity, is determined by the combined status of explosion-proof cavity pressure status, sealing status, and structural integrity status; B3, the static electricity accumulation of the vehicle body is within an allowable range, is determined by the static electricity potential status of the vehicle body; C1, the effective anomaly detection, is determined by the combined results of sensor chain self-inspection, anomaly detection, and data consistency verification; C2, the effective risk assessment, is determined by the combined results of safety logic module output, threshold comparison, and rule verification; C3, the effective safety execution feedback, is determined by the combined action feedback status of actuators such as power-off, braking, and isolation.

[0030] Based on system operation data and environmental data collection, the basic safety conditions of the underlying nodes are determined to be met or nearly met, serving as the node state of the underlying nodes. Specifically, the collected raw parameters are converted into node state values ​​of the underlying nodes after time synchronization, filtering and noise reduction, drift compensation, outlier removal, threshold mapping, and multi-source cross-validation. In one embodiment, the underlying node state values ​​are represented by a three-level discrete representation: 1 for a safe state, 0.5 for a warning state, and 0 for a failure state; for underlying nodes that only require a conditional / failure determination, a binary representation is used: 1 for a conditional state and 0 for a conditional state. Thus, each underlying node represents whether the corresponding basic safety conditions are met, rather than the instantaneous sampled value of a single sensor.

[0031] Child nodes of the same node have importance weights that affect the state of the parent node, and each bottom-level node is also associated with a credibility coefficient that characterizes the reliability of the current data. The security logic module calculates the effective weight of a node based on the importance weights and credibility coefficients, and uses these effective weights to participate in the security degree calculation of the parent node and the top-level root node. The importance weight characterizes the contribution of a child node to the security judgment result of its parent node, and the credibility coefficient characterizes the reliability of the current node's data. In one embodiment, under the same parent node, the combined weight of each child node is obtained according to "importance weight × credibility coefficient," and the combined weight is normalized to form the effective node weight; the security degree of the parent node is obtained by weighted summation of the state values ​​of each child node and the corresponding effective node weights, and the security degree of the top-level root node is obtained by comprehensively calculating the security degrees of each intermediate logic node according to preset branch weights.

[0032] The security judgment logic of the security logic module is as follows: based on the node status of the bottom-level nodes, the security degree of each node is calculated layer by layer in a forward order from bottom to top; starting from the target security condition corresponding to the root node, it is determined whether the change in the security degree of the root node leads to the weakening of the target security condition, and the node combination that leads to the weakening of the target security condition is retrieved in a reverse order from top to bottom; then, a security action is output according to the preset handling rules corresponding to the node combination; and the importance weight of the node is dynamically adjusted according to the joint early warning situation of the bottom-level nodes, and the credibility coefficient is dynamically adjusted according to the early warning probability of the bottom-level nodes.

[0033] 2. Hierarchical security response measures for security logic modules First, let's explain the status of each node.

[0034] Each root node has a corresponding critical safety threshold and a safety threshold. When the safety threshold is lower than the critical safety threshold, the node is in a safe state; if it is lower than the safety threshold, it is in a failed state.

[0035] The intermediate logical nodes only have a safety threshold, corresponding to two node states: failure and safety.

[0036] The underlying nodes have corresponding warning thresholds and safety thresholds. The safety threshold is lower than the warning threshold. When the safety level of a node is higher than the warning threshold, the node is in a safe state. If it is between the two thresholds, the node is in a warning state. If it is lower than the safety threshold, the node is in a failed state. For underlying nodes that only need to make a valid / unsuccessful judgment, there are only two node states: failed and safe.

[0037] This step assesses the risk level based on the security level of each node and the combination of nodes that weaken the target's security conditions, and then sets up tiered security response measures. Risk classification is determined comprehensively based on the current underlying node state value, dynamically updated node effective weights, root node safety degree, and abnormal node combination criteria. The risk classification judgment itself directly calls the node effective weights and root node safety degree results obtained in the current solution, without temporarily modifying the node weights when a risk is triggered.

[0038] (1) Early warning level response (general risk): When at least one underlying node changes from a safe state to a warning state, or when the difference between the monitoring value of the safety-related equipment status and the warning threshold is lower than the preset safety margin, but the root node is in a safe state and there is no cross-branch correlation anomaly that meets the preset explosion induction criterion, it is judged as a general risk.

[0039] The control execution module performs motor speed limiting and / or active cooling actions to suppress temperature rise by reducing energy density and to retain a safety margin for subsequent judgment.

[0040] The cross-branch association anomaly refers to a situation where, within a preset time window, two or more bottom-level nodes belonging to different intermediate logic branches are simultaneously in a failure state or a warning state, i.e., deviating from their respective safety baselines, and the combination logic of these bottom-level nodes satisfies a preset explosion induction criterion, i.e., the deviation physically points to the same explosion risk link. In this case, it is determined that these bottom-level nodes form a node combination that weakens the target safety conditions, and the cross-branch association anomaly occurs, resulting in a significant decrease in the safety margin of the root node.

[0041] (2) Controlled safety level response (medium risk): When a cross-branch association anomaly occurs, that is, when at least two bottom-level nodes belonging to different intermediate logical nodes simultaneously exceed their respective association thresholds within the same preset time window, and their logical combination satisfies the preset explosion triggering criterion, but the root node is in a safe state, it is determined that a cross-branch association anomaly has occurred, and it is considered that there is a moderate risk of explosion triggering.

[0042] The control execution module immediately issues a controlled shutdown command and simultaneously activates the explosion-proof isolation mechanism to cut off the exchange of hazardous media between the internal and external environments. For example, if the concentration of gas A1 and the pressure of the explosion-proof structure B2 both exceed their respective thresholds, or if the concentration of gas A1 and the electrostatic potential of the vehicle body B3 are both abnormal within the same time window, then a cross-branch correlation anomaly is determined to exist.

[0043] For node linkage anomalies that occur only within the same intermediate logical branch, see point (1), such as the common anomalies of A1 and A2, A1 and A3, or C1 and C3. It is preferred to use them to increase the local importance weight of the corresponding anomaly's underlying node under its parent node, trigger the warning upgrade, or serve as an auxiliary basis for the subsequent root node critical failure judgment, rather than directly as the basis for cross-branch association anomaly judgment.

[0044] (3) Emergency-level response (high risk): When the security level of the root node is between the security threshold and the critical security threshold, and at least one intermediate logical node fails, or the preset high-risk bottom node combination fails or the alarm state continues for more than the preset duration, the top-level root node is determined to enter a critical failure state; if the security level of the root node further falls below the security threshold, it is determined to be a root node failure; both root node failure and critical failure are determined to be a serious risk.

[0045] The control execution module triggers the highest priority response, implementing an emergency power outage and physical energy isolation to put the explosion-proof automated guided vehicle into a zero-energy safety state to prevent the formation of an ignition source.

[0046] 3. Adaptive adjustment mechanism for node weights in the security tree In this invention, the security logic module has adaptive update capabilities; its node importance weights and credibility coefficients are not fixed but adjusted in real time. Specifically, the node importance weights characterize the contribution of child nodes to the security judgment results of the parent node, and the node credibility coefficients characterize the reliability of the current node's data. The effective node weight is obtained by combining the node importance weights and the node credibility coefficients.

[0047] (1) Dynamic updates based on environmental relevance: Since the dangers in explosion-proof scenarios are usually manifested as multivariate coupled evolution rather than a single parameter independently exceeding the limit, this invention introduces a joint fluctuation discrimination mechanism when selecting the underlying nodes and designing the node value rules.

[0048] The joint fluctuation event refers to the simultaneous occurrence of state changes exceeding their respective association thresholds within the same preset time window by two or more bottom-level nodes, and the logical combination of these changes satisfies a preset explosion triggering criterion, thus detecting a cross-branch association anomaly. The preset explosion triggering criterion can be that the direction, duration, and sequence of node state changes satisfy a preset danger evolution law; specifically, the direction of change is used to determine whether the increase or decrease of each state quantity points to the same dangerous link, the duration is used to eliminate instantaneous glitches, and the sequence is used to determine the temporal rationality of the multivariate coupled evolution.

[0049] The security logic module pre-sets basic importance weights for each underlying node, and after detecting a joint fluctuation event, increases the importance weight of nodes that jointly weaken the same upper-level security conditions, and then completes normalization processing within all child nodes of the parent node.

[0050] For example, for joint fluctuation events within the same branch, such as A1 and A2 exhibiting increased concentration of explosive media and decreased ventilation capacity respectively, or A1 and A3 exhibiting simultaneous anomalies, or C1 and C3 exhibiting simultaneous anomalies, the local importance weight of the corresponding anomaly's bottom-level node under its parent node is increased to characterize the risk of hazardous media enrichment or the decline in the reliability of functional safety links. For cross-branch related anomalies, such as the joint anomalies of A1 and B3 or A1 and B2, they are given priority as the basis for determining moderate risk, and the risk sensitivity of the relevant branches in the root node safety solution can be optionally increased.

[0051] (2) Dynamic updates based on failure frequency: The system calculates the frequency of anomalies and the probability of failure for each underlying node within a preset statistical period using historical operational data. It then updates the reliability coefficient of each node based on these parameters, limiting the coefficient to a range of 0 to 1. Higher anomaly frequencies and failure probabilities result in lower reliability coefficients. The security logic module then recalculates the effective weight of each node based on the updated reliability coefficient.

[0052] The failure probability of a certain bottom-level node can be defined as the proportion of the number of times a certain bottom-level node enters a failure state to the total number of samples, or the proportion of the duration of entering a failure state to the total observation time; the anomaly frequency can be defined as the proportion of the number of times a certain bottom-level node enters a warning state to the total number of samples.

[0053] Furthermore, the adjustment of the reliability coefficient can also incorporate additional information, including the fluctuation characteristics of nodes under different operating conditions, the consistency of redundant information, and false alarms. When the reliability coefficient of a certain bottom-level node is lower than the replacement threshold, it is determined that the reliability of the current data of that node has decreased. At the same time, the system compensates and adjusts the associated redundant nodes that represent the same safety condition as the node with decreased reliability. The associated redundant nodes are preferably other bottom-level nodes that belong to the same parent node and jointly represent the same safety condition. The multi-source cross-validation includes: consistency verification of redundant sensors of the same type, physical correlation verification between dissimilar state variables, and continuity verification with historical sliding window trends. The redundancy replacement refers to the process of using the state value of a redundant node that represents the same safety condition, or the result of weighted fusion of multiple redundant nodes, to replace the node in the solution of the parent node's safety factor when the reliability coefficient of a certain node is lower than the replacement threshold. Through multi-source information cross-validation and redundancy replacement, the amplification effect of the performance degradation of a single sensor on the overall risk judgment result can be suppressed, thereby avoiding system misjudgment caused by single-point drift, local failure, or instantaneous anomaly of the sensor, and improving the stability and robustness of the safety tree logic model under complex operating conditions.

[0054] 4. Operation process and reliability The system operation process includes the following steps: Step 301: Construct a security tree logical model. The root node of the security tree logical model corresponds to the target security state; the root node is decomposed into intermediate logical nodes and bottom-level nodes according to the security triggering logic; the child nodes of the same node have importance weights that affect the state of the upper-level node and credibility coefficients that represent the reliability of the current data; the effective weight of the node is calculated based on the importance weights and credibility coefficients, and participates in the security calculation of the upper-level node.

[0055] Step 302: Acquire system operation data and environmental data of the explosion-proof automated guided vehicle in real time to determine the node status of the underlying nodes.

[0056] Step 303: Determine whether the basic security conditions of the bottom-level nodes are met or close to being met based on the system operation data and environmental data collected, and use this as the node state of the bottom-level nodes; based on the node state of the bottom-level nodes, calculate the security degree of each node layer by layer in a positive order from bottom to top.

[0057] Step 304: Starting from the target security condition corresponding to the root node, determine whether the change in the security level of the root node weakens the target security condition, and retrieve the node combination that weakens the target security condition in a top-down reverse order; then output the security action according to the preset handling rules corresponding to the node combination.

[0058] In this step, the root node's security level is compared with both the security threshold and the critical security threshold. When the root node's security level is lower than the security event determination threshold, a security event is determined to have occurred. When the root node's security level is higher than the security event determination threshold but not higher than the critical security threshold, and at least one intermediate logical node fails or a preset high-risk anomaly combination persists for more than a preset duration, the top-level root node is determined to have entered a critical failure state and is classified as a severe risk. When neither of the aforementioned two situations exists but cross-branch related anomalies are present, it is classified as a moderate risk. When at least one bottom-level node enters a warning state or the difference between the relevant monitoring value and the warning threshold is lower than a preset security margin, it is classified as a general risk.

[0059] The control execution module automatically executes corresponding safety measures based on the safety assessment results: for general risks, it executes speed limits and / or active heat dissipation; for moderate risks, it executes controlled shutdown and explosion-proof isolation; for severe risks or safety incidents, it executes emergency power cut-off and physical energy isolation, so that the AGV can quickly return to a safe state when a fault occurs, preventing the accident from escalating.

[0060] Step 305: Perform status feedback and reset, and write the anomaly frequency, failure probability, consistency verification results, and execution feedback results collected in this round into the statistical periodic data. This data will be used to update the node reliability coefficient and effective node weight in subsequent cycles. Repeat steps 301-305 to achieve continuous safety control of the explosion-proof automated guided vehicle. By adjusting the node weight and node reliability coefficient, adaptive optimization for different operating environments can be achieved, further improving the reliability and sensitivity of safety control.

[0061] This concludes the process.

[0062] As can be seen, the safety tree logic model uses safety events as root nodes and constructs a decision-making path oriented towards safety goals through the logical relationships between nodes. The model can integrate the changing trends and mutual corroboration relationships of multiple monitoring quantities to form a dynamic assessment of "whether it is in a safe state". The system adopts a top-down reverse logic solution method: first, it determines whether the safety level of the root node is lower than the preset safety threshold or whether there is an abnormal node combination that meets the preset explosion induction criteria; when the safety level of the root node decreases or an intermediate logic node outputs an abnormality, it searches backwards along the hierarchical relationship of root node—intermediate logic node—bottom node to find the bottom node combination that weakens the target safety conditions, and determines the current risk source and handling priority by combining the state value, importance weight, and credibility coefficient of each bottom node; then, it calls the preset handling rules corresponding to the bottom node combination to generate one or more safety actions such as speed limit, heat dissipation, shutdown, isolation, and power failure. Unlike traditional fault tree analysis based on "fault mechanism", this invention organizes the logical structure from the perspective of "safety goal", enabling the system to automatically guide to a safe state after a fault at any stage of operation, while facilitating rule addition and maintenance updates in engineering practice.

[0063] In summary, the aim is to construct a safety logic system with the capability of "automatically guiding faults to a safe state." This system, driven by safety objectives, organically maps environmental monitoring data, operational status, and control commands to form a self-consistent judgment-decision-execution closed loop, thereby achieving safety monitoring and proactive protection throughout the AGV's entire lifecycle. By unifying safety criteria and handling rules at the system level, this invention provides a portable and scalable safety control approach for complex and high-risk operating conditions without altering the existing scheduling and control architecture. This improves the timeliness of anomaly identification and the consistency of handling actions, reducing the probability of fault propagation and energy release.

[0064] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A safety control system for explosion-proof automated guided vehicles based on safety tree logic, characterized in that, include: The data acquisition module is used to acquire system operation data and environmental data of the explosion-proof automated guided vehicle in real time. The security logic module stores a security tree logic model; security The root node of the tree logic model corresponds to the target security state; the root node is decomposed into intermediate logic nodes and bottom-level nodes according to the security triggering logic; the child nodes of the same node have importance weights that affect the state of the upper-level node and credibility coefficients that represent the reliability of the current data. The effective weight of a node is calculated based on its importance weight and credibility coefficient, and then used to calculate the security level of the parent node. The security logic module determines whether the basic security conditions of the underlying nodes are met or close to being met based on system operation data and environmental data, which serves as the node state of the underlying nodes. Based on the node states of the underlying nodes, the security level of each node is calculated layer by layer in a top-down forward order. Starting from the target security conditions corresponding to the root node, it determines whether changes in the security level of the root node weaken the target security conditions, and searches for node combinations that weaken the target security conditions in a top-down reverse order. Then, it outputs security actions according to the preset handling rules corresponding to the node combinations. Furthermore, it dynamically adjusts the importance weight of nodes based on the joint early warning situation of the underlying nodes, and dynamically adjusts the credibility coefficient based on the early warning probability of the underlying nodes. The control execution module is used to execute the security actions output by the security logic module.

2. The system as described in claim 1, characterized in that, The safety tree logic model is based on three risk mechanisms in explosion-proof scenarios: formation of explosive media, formation of ignition sources, and failure of safety handling. It adopts a three-level hierarchical structure of top-level root node - intermediate logic node - bottom-level node. The top-level root node represents the target's safe state; The intermediate logical node is the connection link between the root node and the bottom node, and is divided into three branches: environmental safety control A, ignition source suppression B, and functional safety link C. The bottom-level nodes are the basic data source for the model; The bottom-level nodes of the environmental safety control branch A include combustible gas concentration within the preset safety range (A1), normal ventilation (A2), and effective closure of the isolation mechanism (A3); the bottom-level nodes of the ignition source suppression branch B include the drive circuit within the intrinsically safe electrical parameter range (B1), the explosion-proof cavity pressure within the allowable range (B2), and the vehicle body electrostatic potential within the allowable range (B3); the bottom-level nodes of the functional safety link branch C include effective anomaly detection (C1), effective risk assessment (C2), and effective action feedback (C3).

3. The system as described in claim 2, characterized in that, The acquisition module is installed on the vehicle body and the monitoring position of the working environment to collect data in real time, including motor temperature, battery voltage, drive current, combustible gas concentration, dust concentration, ventilation equipment operating status, isolation mechanism position status, explosion-proof cavity pressure, vibration signal, vehicle body electrostatic potential, and execution feedback status. The collected data is converted into the node status of the underlying nodes after time synchronization, filtering and noise reduction, drift compensation, outlier removal, threshold mapping and multi-source cross-validation. The node status adopts a three-level discrete status value, including at least a safe state value of 1, a warning state value of 0.5 and a failure state value of 0. For the underlying nodes that only need to be determined as true or false, the node status is represented by a binary value: a safe state value of 1 and a failure state value of 0.

4. The system as described in claim 1, characterized in that, In the security logic module, starting from the target security condition corresponding to the root node, it determines whether a change in the security level of the root node weakens the target security condition, and retrieves node combinations that weaken the target security condition in a top-down reverse order; then, it outputs a security action according to the preset handling rules corresponding to the node combinations. Each root node has a corresponding critical safety threshold and a safety threshold. The safety threshold is lower than the critical safety threshold. When the safety level of a node is higher than the critical safety threshold, the node is in a safe state. If it falls below the safety threshold, it is in a failed state; Intermediate logical nodes only have a security threshold, corresponding to two node states: failure and safety. The underlying nodes have corresponding warning thresholds and safety thresholds. The safety threshold is lower than the warning threshold. When the safety level of a node is higher than the warning threshold, the node is in a safe state. If it is between the two thresholds, the node is in a warning state. If it is lower than the safety threshold, the node is in a failed state. For underlying nodes that only need to perform a valid / unsuccessful judgment, there are only two node states: failed and safe. Based on the extent to which changes in security weaken the target's security conditions, and the type of node combination, tiered measures are implemented: (1) Early warning level handling of general risks: When at least one bottom node changes from a safe state to a warning state, or when the difference between the monitoring value of the safety-related equipment status and the warning threshold is lower than the preset safety margin, but the root node is in a safe state and there is no cross-branch correlation anomaly that meets the preset explosion induction criterion, it is judged as a general risk. The cross-branch association anomaly refers to a situation where, within a preset time window, two or more bottom-level nodes belonging to different intermediate logic branches are simultaneously in a failure state or a warning state, and the combination logic of these bottom-level nodes satisfies a preset explosion triggering criterion. In this case, it is determined that these bottom-level nodes form a combination of nodes that weakens the target's security conditions, and the cross-branch association anomaly occurs. The warning level response is: motor speed limiting and / or active heat dissipation; (2) Controlled safety level handling of moderate risk: When the aforementioned cross-branch association anomaly occurs, but the root node is in a safe state, it is determined to be of medium risk; The controlled safety level procedure is as follows: immediately stop the vehicle and simultaneously activate the explosion-proof isolation mechanism to cut off the exchange of hazardous media between the internal and external environments; (3) Emergency-oriented response to severe risks: When the security level of the root node is between the security threshold and the critical security threshold, and at least one intermediate logical node fails, or the preset high-risk bottom node combination fails or the alarm state continues for more than the preset duration, the top root node is determined to enter the critical failure state; if the security level of the root node is further lower than the security threshold, it is determined to be a root node failure; both root node failure and critical failure are determined to be a serious risk. The emergency guidance level response is as follows: trigger the highest priority response, implement emergency power cut-off and physical energy isolation, so that the explosion-proof automated guided vehicle enters a zero-energy safety state to prevent the formation of an ignition source.

5. The system as described in claim 4, characterized in that, The security logic module dynamically adjusts the importance weights of nodes based on the joint early warning situation of the underlying nodes, specifically including: When an anomaly in cross-branch association is detected, the importance weight of nodes that jointly weaken the security conditions of the same parent node is increased, and then normalization is performed across all child nodes of the parent node.

6. The system as described in claim 4, characterized in that, In the judgment of cross-branch association anomalies, the preset explosion induction criterion is met as follows: the direction, duration and sequence of node state changes satisfy the preset danger evolution law.

7. The system as described in claim 4, characterized in that, The security logic module dynamically adjusts the credibility coefficient based on the early warning probability of the underlying nodes, specifically including: The frequency of anomalies and the probability of failure for each underlying node within a preset statistical period are calculated using historical operational data. The reliability coefficient of the underlying node is then updated based on the frequency of anomalies and the probability of failure. The higher the frequency of anomalies and the greater the probability of failure, the lower the reliability coefficient.

8. A safety control method for explosion-proof automated guided vehicles based on safety tree logic, characterized in that, include: Construct a security tree logical model; the root node of the security tree logical model corresponds to the target security state; The root node is decomposed into intermediate logical nodes and bottom-level nodes according to the security triggering logic; the child nodes of the same node have importance weights that affect the state of the upper-level node and a credibility coefficient that represents the reliability of the current data. The effective weight of a node is calculated based on its importance weight and credibility coefficient, and then used to calculate the security level of the parent node. Real-time acquisition of system operation data and environmental data collected from explosion-proof automated guided vehicles; Based on system operation data and environmental data, determine whether the basic security conditions of the bottom-level nodes are met or close to being met, and use this as the node state of the bottom-level nodes; based on the node state of the bottom-level nodes, calculate the security level of each node layer by layer in a positive order from bottom to top. Starting from the target security condition corresponding to the root node, determine whether the change in the security level of the root node weakens the target security condition, and retrieve the node combination that weakens the target security condition in a top-down reverse order; then output the security action according to the preset handling rules corresponding to the node combination. The importance weight of nodes is dynamically adjusted based on the joint early warning situation of the underlying nodes, and the credibility coefficient is dynamically adjusted based on the early warning probability of the underlying nodes.

Images