Logistics robot dual-core vcu redundancy control method and system

Abstract

The application discloses a kind of logistics robot double-core VCU redundancy control method and system, belong to logistics robot control field, the method includes: obtaining the working condition data set of logistics robot, and obtaining the state variable of first processing entity;First control instruction of first processing entity is issued with dynamic safety boundary comparison, to determine whether first control instruction falls into dangerous area;Based on state variable, run mirror control law to solve pre-deduction control set every control cycle, and pre-deduction control set is used to drive motor driver;When first processing entity fails, or first control instruction falls into dangerous area, by the arbitration unit independent of first processing entity and second processing entity Trigger takeover, the pre-deduction control set cached is injected into motor driver, and injection is not initialized without mirror control law.The application eliminates the switching overturn hidden danger under full load jacking.

Description

Technical Field

[0001] This invention relates to the field of logistics robot control, and in particular to a dual-core VCU redundancy control method and system for logistics robots. Background Technology

[0002] With the increasing automation of warehousing and logistics, logistics robots are gradually taking on tasks such as heavy-duty handling, high-level lifting, intensive scheduling, and continuous operation. These devices typically rely on a vehicle control unit (VCU) to control the motor drive, steering mechanism, lifting mechanism, and vehicle communication in real time. To improve safety, existing technologies usually employ a main controller and a backup controller; when the main controller malfunctions, the backup controller takes over. However, the existing dual-controller redundancy architecture still has significant drawbacks:

[0003] First, the primary and backup controllers often run the same or highly similar control programs. When the control algorithm has defects, array out-of-bounds errors, division-by-zero anomalies, or state observation errors, both controllers may fail simultaneously, making it difficult to eliminate common software failures. Second, the primary and backup controllers typically use a fixed frequency for data synchronization. In low-risk conditions, this wastes limited bus bandwidth, while in high-risk conditions such as heavy loads, high-speed turns, and high-position lifting, critical state data may not be updated in time, making it difficult for the backup controller to obtain sufficiently fresh control parameters. Third, existing takeover processes typically rely on software interrupts, bus resets, state machine initialization, integrator reconstruction, and control parameter realignment. The takeover process may create control gaps of milliseconds or even longer, leading to interruptions or jumps in motor torque output. For robots under full load or high-position lifting conditions, this interruption may cause cargo overturning, tire slippage, or vehicle instability. Fourth, after a single vehicle enters degraded mode, it usually relies on the upper-level scheduling system to notify surrounding vehicles to avoid it. Once the network is congested or the scheduling system is unavailable, local deadlocks can easily occur in high-density warehousing scenarios. Fifth, under high-risk and complex operating conditions, a large amount of synchronous data may cause the receiving buffer to overflow, causing critical data affecting the continuity of takeover to be squeezed out by historical data.

[0004] Therefore, there is an urgent need for a low-level redundant control scheme that can achieve risk perception synchronization, heterogeneous security judgment, pre-simulation takeover, hardware-level degradation control, trusted avoidance of adjacent devices, and cache congestion anomaly handling in low-level motion control scenarios. Summary of the Invention

[0005] One of the objectives of this invention is to provide a dual-core VCU redundant control method for logistics robots, in order to solve the problems of bandwidth waste in low-risk operating conditions and lag of key data in high-risk operating conditions caused by fixed frequency synchronization of primary and backup controllers in the prior art.

[0006] This invention is achieved through the following technical solution: a dual-core VCU redundancy control method for a logistics robot, comprising the following steps: acquiring the operating condition dataset of the logistics robot and acquiring the state variables of a first processing entity; inputting the operating condition dataset into a physical constraint model to generate a dynamic safety boundary, wherein the physical constraint model differs from the control logic run by the first processing entity in terms of dependent parameters and implementation paths, and the dynamic safety boundary is used to divide the logistics robot into a safe domain and a danger domain; comparing the first control command issued by the first processing entity with the dynamic safety boundary to determine whether the first control command falls into the danger domain. The mirror control law is run based on the state variables to calculate the pre-deduced control set on a control cycle basis, and the pre-deduced control set is cached. The mirror control law is equivalent to the control logic run by the first processing entity, and does not output actual control signals to the motor driver during operation. The pre-deduced control set is used to drive the motor driver. When the first processing entity fails, or the first control command falls into the danger domain, an arbitration unit independent of the first and second processing entities is triggered to take over and inject the cached pre-deduced control set into the motor driver. The injection is not initialized by the mirror control law.

[0007] Furthermore, the first processing entity is the processing core that performs conventional control operations in the dual-core VCU of the logistics robot; the second processing entity is the processing core that performs independent supervision and backup simulation in the dual-core VCU of the logistics robot; the arbitration unit is a hardware arbitrator that is independent of the first and second processing entities and can complete the master-slave switching decision without relying on software.

[0008] Further, the process involves acquiring the operating condition dataset of the logistics robot and obtaining the state variables of the first processing entity, including: a second processing entity determining a risk index based on the operating condition dataset, wherein the risk index characterizes the degree to which the current operating condition of the logistics robot chassis approaches its physical safety boundary; the second processing entity adjusting the bandwidth allocation strategy of the communication link between the first processing entity and the second processing entity based on the risk index, and acquiring the state variables at a synchronization frequency corresponding to the bandwidth allocation strategy.

[0009] Further, the second processing entity determines a risk index based on the working condition dataset, including: acquiring the working condition dataset within a preset time window; determining a first risk component by nonlinearly amplifying the ratio of a first observation data representing the load-bearing state to a preset maximum load capacity based on the working condition data; determining a second risk component by normalizing the product of a second observation data representing the motion rate and a third observation data representing the trajectory curvature based on the working condition data; determining a third risk component by saturating the rate of change of a fourth observation data representing the lifting attitude based on the working condition dataset, wherein the saturation processing causes the third risk component to asymptotically approach its upper limit when the rate of change becomes large; and determining a risk index by weighting and accumulating the first, second, and third risk components within the preset time window according to a time decay weight, wherein the time decay weight gives higher weight to data closer to the current time.

[0010] Furthermore, the first observation data includes the current load capacity of the logistics robot, the second observation data includes the travel speed of the logistics robot, the third observation data includes the curvature of the planned path of the logistics robot, and the fourth observation data includes the fork height of the lifting mechanism of the logistics robot; the travel speed is obtained by at least one of the following methods: wheel encoder combined with differential kinematics calculation, or by integration by inertial measurement unit.

[0011] Furthermore, the second processing entity adjusts the bandwidth allocation strategy based on the risk index and acquires the state variable at a corresponding synchronization frequency, including: comparing the risk index with a first threshold; when the risk index is less than the first threshold, synchronizing the state variable with a first data frame structure and at a first frequency.

[0012] Furthermore, when the risk index is greater than or equal to the first threshold, the communication link is reconstructed into a second data frame structure, and the state variables are synchronized preferentially at a second frequency higher than the first frequency. The second data frame structure gives the state variables a higher bandwidth priority than the first data frame structure. The synchronization frequency is always the first frequency when the risk index is less than the first threshold. When the risk index is greater than or equal to the first threshold, the synchronization frequency smoothly increases based on the first frequency as the risk index exceeds the first threshold, and gradually approaches the second frequency.

[0013] Further, the dynamic safety boundary is generated through the following steps: extracting static structural parameters, including chassis wheelbase and center of gravity reference height, which are pre-stored in the read-only memory of the second processing entity; determining the comprehensive center of gravity height based on the current load and the current displacement of the lifting mechanism; determining the instantaneous centrifugal force based on the data representing the motion rate and trajectory curvature in the working condition dataset, and using the comprehensive center of gravity height and the chassis wheelbase, determining the critical overturning moment threshold to prevent the vertical load on one wheel from dropping to zero based on moment balance; matching the corresponding road surface adhesion parameters according to the working condition dataset, and determining the maximum allowable acceleration to prevent longitudinal slippage based on the Coulomb friction model; the critical overturning moment threshold and the maximum allowable acceleration jointly define a two-dimensional boundary as the dynamic safety boundary.

[0014] Further, determining the overall center of gravity height includes: when the lifting mechanism is in the fully retracted state, the overall center of gravity height is equal to the center of gravity reference height; when the lifting mechanism is raised, the overall center of gravity height is equal to the sum of the center of gravity reference height and the height increment corresponding to the displacement of the lifting mechanism; the critical overturning moment threshold decreases as the overall center of gravity height increases, and the gravity component is cosine corrected according to the chassis roll angle, and an inertial moment margin is reserved; the maximum allowable acceleration is determined jointly based on the road surface adhesion parameters and the chassis pitch angle.

[0015] Furthermore, after comparing the first control command with the dynamic safety boundary, the process further includes: when the predicted acceleration corresponding to the first control command is greater than the maximum allowable acceleration, or the corresponding lateral moment is greater than the critical overturning moment threshold, an out-of-bounds event is determined to have occurred; the second processing entity intercepts subsequent command issuance from the first processing entity, records abnormal error codes, and generates a braking moment sequence with a monotonically decreasing amplitude to zero based on the physical constraint model and outputs it directly, so that the logistics robot stops without overturning.

[0016] Further, the mirror control law is run based on the state variables to calculate the pre-deduced control set cycle by cycle, including: the second processing entity receiving the flux linkage position, electrical angular velocity, torque feedforward, and the direct-axis current sampling value and quadrature-axis current sampling value of the current control cycle calculated by the first processing entity; based on the motor body parameters, determining the first voltage component and the second voltage component required for the motor to reach the expected torque, the motor body parameters including stator resistance, direct-axis inductance, quadrature-axis inductance, and permanent magnet flux linkage; generating corresponding three-phase duty cycle parameters by inverse coordinate transformation of the first voltage component and the second voltage component, as the pre-deduced control set; storing the pre-deduced control set in the circular buffer of the second processing entity, and overwriting the oldest data frame at the end of each control cycle, and keeping the output pins of the second processing entity in an isolated state.

[0017] Further, determining the first voltage component and the second voltage component includes: using the difference between the current sampling value of the current cycle and the previous control cycle as a differential approximation to determine the time change of the current, and thereby determining the inductor voltage drop component in the voltage component; the voltage component also includes the resistance voltage drop component formed by the stator resistance, the cross-coupling component formed by the electrical angular velocity and the direct-axis inductance and quadrature-axis inductance, and the back electromotive force component formed by the electrical angular velocity and the permanent magnet flux linkage, wherein the back electromotive force component only acts on the second voltage component.

[0018] Furthermore, the inverse coordinate transformation includes inverse Park transformation and inverse Clarke transformation. The inverse Park transformation uses the predicted electrical angle obtained by superimposing the current electrical angle with the angle increment within a control cycle as the transformation parameter. The three-phase duty cycle parameter is obtained by normalizing the voltage component relative to the DC bus voltage. The circular buffer is a first-in-first-out ring buffer, which is filled by the new data frame overwriting the oldest data frame.

[0019] Further, triggering takeover and injecting the pre-deduced control set into the motor driver includes: the arbitration unit toggling the selection pin of the channel selector during the clock cycle of detecting the takeover trigger signal, the channel selector being located between the output pin of the second processing entity and the motor driver; connecting the output channel of the first processing entity to the motor driver and disconnecting the output channel of the second processing entity during normal operation of the first processing entity; de-isolating the isolation state configuration of the output pin of the second processing entity; extracting the three-phase duty cycle parameters of the current phase from the cyclic buffer; and bypassing the control law initialization sequence to directly drive the motor driver.

[0020] Furthermore, the takeover trigger signal includes at least one of the following: a timeout overflow signal of the heartbeat monitoring watchdog of the first processing entity, and a hardware comparator output of the out-of-bounds judgment logic of the second processing entity; the arbitration unit is implemented using a hardware entity independent of the first processing entity and the second processing entity, and the hardware entity includes at least one of complex programmable logic devices or field-programmable gate arrays.

[0021] Furthermore, after the trigger takeover, the process further includes switching the logistics robot to a degraded operation mode: activating a hard-coded degraded control flow in the second processing entity, the degraded control flow being pre-stored in the read-only memory of the second processing entity and not modifiable by upper-level instructions; clamping the maximum speed command of the logistics robot to a first speed limit constant; clamping the absolute steering angle of the steering mechanism to the angle limit range; and forcibly shutting off the power supply enable signals of the lifting mechanism and the fork mechanism via hardware level to lock the current mechanical load posture.

[0022] Furthermore, after the degraded operation mode is activated, bypassing the upper-level industrial control computer, an emergency degraded frame is broadcast to adjacent vehicles within a preset physical radius via the first radio frequency link to trigger right-of-way transfer for the adjacent vehicles. The construction and broadcasting of the emergency degraded frame includes: the second processing entity generating a first blinded random number and a second blinded random number, and generating a first commitment value and a second commitment value for the first secret information and the second secret information respectively based on a homomorphic commitment mechanism. The first secret information is a legitimate key identifier, and the second secret information is a real fault code; the first commitment value, the second commitment value, the current local coordinates, and the timestamp are input into a hash function. A challenge value is generated; the first blinded random number is linearly combined with the challenge value and the first secret information to obtain a first response value; the second blinded random number is linearly combined with the challenge value and the second secret information to obtain a second response value; the data packet structure of the emergency degradation frame is constructed, the data packet structure including the first commitment value, the second commitment value, the challenge value, the first response value, the second response value, the current local coordinates, the current heading speed vector, the node identifier, and a status flag indicating the degradation state; the emergency degradation frame is broadcast to the adjacent vehicles via the first radio frequency link.

[0023] Furthermore, the homomorphic commitment mechanism is a commitment scheme based on the discrete logarithm problem, which makes it impossible to deduce the corresponding secret information from the first commitment value and the second commitment value without knowing the blinded random number; the generation of the challenge value incorporates the current local coordinates and the timestamp into the input of the hash function, so that the previously broadcast emergency downgrade frame cannot pass subsequent verification due to changes in coordinates or time; the hash function includes a truncated hash function.

[0024] Furthermore, when the vehicle control unit of the adjacent vehicle receives the emergency downgrade frame, it triggers a preset interrupt service routine. The interrupt service routine includes: performing a one-time verification of the verification equation locally using the received first response value, second response value, first commitment value, second commitment value, and challenge value; when the verification passes, parsing the received current local coordinates and current heading speed vector; determining the longitudinal projection distance and lateral offset distance of its own position relative to the travel route of the transmitting vehicle based on vector geometry; when the longitudinal projection distance is within the safe braking distance range and the lateral offset distance is within the range limited by the superimposed safety margin of the transmitting vehicle's body width, the vehicle control unit of the adjacent vehicle issues a deceleration command to its own motor to zero and retreats to both sides to make way for the straight physical path back to the repair station.

[0025] Furthermore, the longitudinal projection distance is determined by the projection of the position difference vector between the adjacent vehicle position and the transmitter vehicle position onto the unit heading vector of the transmitter vehicle; the lateral offset distance is determined by the magnitude of the position difference vector after deducting its longitudinal projection component; and the safe braking distance increases as the transmitter vehicle's speed increases in the degraded operation mode.

[0026] Furthermore, the redundancy control method further includes: monitoring the occupancy rate of the receive buffer between the first processing entity and the second processing entity; when an overflow warning occurs in the receive buffer, an overflow interrupt is triggered by the memory transfer unit and a pointer overwrite mechanism is executed, the pointer overwrite mechanism skips and discards low-priority historical frames in the receive buffer, the low-priority historical frames including load state historical frames; extracting the high-priority key frame with the highest priority in the receive buffer, the high-priority key frame including the latest slip ratio estimate and torque feedforward; and sending the extracted high-priority key frame into the mirror control law for calculation, so that the delay of the data used by the mirror control law does not exceed one control cycle.

[0027] Another aspect of the present invention provides a dual-core VCU redundancy control system for a logistics robot, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements any of the dual-core VCU redundancy control methods for logistics robots described above.

[0028] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0029] 1. This invention allows the slave core to asymmetrically adjust the master-slave synchronization bandwidth based on the operating condition risk, so that the limited bandwidth is saved in low-risk operating conditions and precisely allocated to key data in high-risk operating conditions, ensuring the freshness of parameters required for safety judgment and inference. By enabling the slave core to run a deterministic physical constraint model that is completely different from the master core in terms of dependent parameters and implementation path, the problem of common software failure is eliminated. By continuously running a mirror control law in the background of the slave core without outputting actual control signals and caching the pre-inferenced control set, and injecting it at the microsecond level by an independent hardware arbitration unit during takeover and skipping the initialization sequence, continuous and disturbance-free takeover of torque output is achieved, eliminating the risk of overturning during switching under full load lifting.

[0030] 2. This invention embeds zero-knowledge proofs into emergency degradation frames, which can run with low latency on computing-constrained units and do not rely on central scheduling. This allows neighboring vehicles to complete right-of-way transfers locally in a one-time verification process that is replay-proof and forgery-proof, thus avoiding local deadlocks in high-density areas. Furthermore, by selectively retaining key frames according to frame priority when the buffer overflows, it ensures that the delay of the inference parameters does not exceed one control cycle under extreme complex conditions.

[0031] 3. This invention can bypass the upper-level control entity to send broadcast data carrying proof data to adjacent devices, enabling adjacent devices to perform obstacle avoidance control after low-latency verification, thereby improving the reliability of local obstacle avoidance in high-density operation areas; at the same time, when the cache is abnormal, high-priority data that affects the freshness of pre-control data is retained first, while low-priority historical data is discarded, which is conducive to maintaining the continuity of takeover control. Attached Figure Description

[0032] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0033] Figure 1 This is a flowchart of the method provided in Embodiment 1 of the present invention.

[0034] Figure 2 The time-domain response curve provided in Embodiment 1 of the present invention.

[0035] Figure 3 This is a stacked area diagram showing the evolution of normalized contribution as a function of operating conditions, provided in Embodiment 1 of the present invention.

[0036] Figure 4 This is a comparison chart showing the impact of the forgetting factor on the time sensitivity of the risk index, as provided in Embodiment 1 of the present invention.

[0037] Figure 5 This is an input-output characteristic curve provided in Embodiment 1 of the present invention.

[0038] Figure 6 This is a three-dimensional surface plot showing the change of the critical overturning moment threshold with respect to the height of the center of mass and the load, as provided in Embodiment 1 of the present invention.

[0039] Figure 7 This is a two-dimensional shrinkage evolution diagram of the dynamic safety envelope as it changes with operating conditions, provided in Embodiment 1 of the present invention.

[0040] Figure 8 The graph shows the verification of the dq-axis voltage prediction accuracy provided in Embodiment 1 of the present invention.

[0041] Figure 9 This is a comparison diagram of torque continuity during master-slave core switching provided in Embodiment 1 of the present invention.

[0042] Figure 10 This is a schematic diagram of the rectangular danger projection domain for right-of-way transfer provided in Embodiment 1 of the present invention.

[0043] Figure 11 This diagram illustrates the effect of the pointer overwrite mechanism in Embodiment 1 of the present invention on ensuring data freshness.

[0044] Figure 12 A comparison chart of the computation time consumption for zero-knowledge proof verification provided in Embodiment 1 of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0046] Example 1

[0047] This embodiment discloses a dual-core VCU redundancy control method for logistics robots. The basic implementation scheme in this embodiment is as follows: A safety control system is constructed with dual-core heterogeneous redundancy as the core and microsecond-level hardware takeover and zero-knowledge proof workshop linkage as key features. First, a working condition risk assessment model based on weighted integrals of multiple dynamic factors is deployed in the core to adaptively adjust the synchronization frequency of the communication bus between the master and slave cores, precisely allocating limited bandwidth resources to high-risk working conditions. Second, the slave core independently calculates the dynamic safety envelope based on a deterministic physical kinematic model different from that of the master core, comparing the legality of the master core's instructions in real time to eliminate common software failures. Simultaneously, the slave core continuously runs F in the background in a shadow mode. The OC control law pre-calculates and caches the three-phase PWM duty cycle for the next control cycle cycle, enabling a seamless switching within microseconds of a clock cycle via a hardware multiplexer when a takeover event is triggered. After takeover, the core broadcasts an emergency hardware degradation frame to surrounding vehicles using a lightweight zero-knowledge proof protocol constructed with Pedersen commitments and Fiat-Shamir heuristics. Surrounding vehicles autonomously determine whether they are within the danger projection domain of the degraded vehicle based on a vector geometry model, thus opening the shortest physical path to the repair station for the degraded vehicle without relying on central dispatch. This ultimately forms a complete closed loop of 'condition perception—heterogeneous judgment—shadow inference—hardware takeover—workshop linkage'. Figure 1 The flowchart of the method in this embodiment is shown. As can be seen from the flowchart, this embodiment includes the following steps:

[0048] Step 1: Obtain the real-time chassis operating condition dataset. The slave core calculates the operating condition risk index in real time based on the real-time chassis operating condition dataset, and dynamically adjusts the communication bus bandwidth allocation strategy between the master core and the slave core based on the operating condition risk index, and obtains key dynamic state variables from the master core at an asymmetric synchronization frequency.

[0049] The chassis real-time operating condition dataset refers to a set of physical quantities used to fully describe the current dynamic operating state of the logistics robot chassis. It comes from various sensors preset on the vehicle, such as load sensors, wheel speed encoders, inertial measurement units (IMUs), steering angle sensors, and lifting mechanism displacement sensors.

[0050] The real-time chassis operating condition dataset includes, but is not limited to, current load, driving speed, path curvature, chassis roll angle, chassis pitch angle, lifting mechanism fork height and its rate of change, etc.

[0051] The current load capacity refers to the total mass of goods currently carried by the forks or platform of the logistics robot, typically output in real time by strain gauge load cells deployed on the lifting mechanism or load-bearing beam. Understandably, the load capacity directly determines the vehicle's center of gravity, rollover threshold, and braking distance, making it the primary variable affecting safety in redundant control.

[0052] Travel speed refers to the instantaneous movement rate of the logistics robot's center of mass relative to the warehouse ground coordinate system. It can be calculated by combining wheel encoders with differential kinematics, or obtained through IMU integration.

[0053] Path curvature refers to the curvature value of the path currently planned by a logistics robot at that point, and is equal to the derivative of the tangent direction angle with respect to the arc length. It can be understood that a larger curvature indicates a more curved path, and therefore a greater centripetal force is required to maintain the current speed.

[0054] The working condition risk index is a scalar value that provides a real-time quantitative assessment of the overall danger level of the current working condition of a logistics robot chassis. The larger the value, the closer the vehicle is to its physical safety boundary (e.g., overturning, skidding, instability, etc.).

[0055] The communication bus bandwidth allocation strategy refers to the allocation scheme of the number of data frames that the hardware bus (such as SPI or CAN) used for real-time communication between the master core and the slave core can carry per unit time. This strategy determines the maximum refresh frequency at which the slave core can obtain key variables inside the master core.

[0056] Key dynamic state variables refer to the core physical quantities that affect the safety judgment and shadow closed-loop inference from the core, including but not limited to the current center of gravity offset, slip ratio estimate, motor flux position, electrical angle, dq axis current sampling value, and torque feedforward.

[0057] It should be noted that in a dual-core redundant architecture, the master core and slave core need to synchronize data via a hardware bus to ensure that the slave core always has the latest chassis status information. However, the bandwidth of the hardware bus is extremely limited. If a fixed frequency is used for synchronization, a large amount of bandwidth will be occupied by meaningless periodic heartbeat messages under low-risk conditions such as unloaded straight-line driving; while under high-risk conditions such as heavy-load high-speed cornering, the update of critical data may be severely delayed, failing to meet the parameter freshness requirements of subsequent shadow closed-loop simulations. Therefore, this embodiment needs to establish a continuous-time risk assessment model that can perceive real-time dynamic changes in the logistics robot and use it to drive the adaptive adjustment of the bus synchronization frequency.

[0058] In this embodiment, the operating condition risk index is calculated in real time based on the chassis real-time operating condition dataset, which may specifically include:

[0059] Obtain the real-time chassis operating condition dataset within a preset time window;

[0060] The load risk component is obtained by nonlinearly amplifying the ratio of the load capacity to the rated maximum load capacity.

[0061] Normalize the product of driving speed and path curvature to obtain the risk component of centrifugal force in curves.

[0062] Substituting the rate of change of the fork height of the lifting mechanism into the exponential saturation function yields the risk component of the lifting action;

[0063] The three risk components mentioned above are weighted and integrated within a preset time window according to a preset forgetting factor function to obtain the working condition risk index.

[0064] The load risk component refers to a scalar value reflecting the threat posed by the current load condition to the vehicle's dynamic stability; its essence is a nonlinear function of the load ratio. It should be noted that since any dynamic disturbance is significantly amplified under heavy load conditions, this embodiment uses a power function to amplify the load ratio, rather than a simple linear scaling. When the load approaches the calibrated maximum load, the load risk component will increase sharply in a power function form, thereby forcing the risk assessment system to assign an overwhelming weight to the fully loaded condition.

[0065] The cornering centrifugal force risk component is a scalar value that reflects the ratio of the instantaneous centripetal acceleration experienced by the vehicle under steering conditions to the vehicle's maximum permissible lateral acceleration. This component characterizes the physical magnitude of the instantaneous centripetal acceleration by multiplying the linear velocity by the path curvature, thus unifying the turning radius and driving speed into a single risk dimension.

[0066] The lifting action risk component refers to a scalar value reflecting the contribution of the rapid change in the center of gravity height caused by the lifting or lowering operation of the lifting mechanism to the vehicle rollover risk. This embodiment uses an exponential saturation function to characterize this component. Its physical meaning is as follows: when the forks are stationary, this component is zero, meaning the lifting mechanism contributes no risk to the current operating condition; when the forks move at low speed, this component increases approximately linearly with the speed; and when the forks move at high speed, this component rapidly approaches its upper limit of 1, thus saturating. This exponential saturation design avoids over-amplification of extremely rapid lifting actions, making the risk assessment numerically more stable.

[0067] The forgetting factor function is a weighted function that decays over time. This function ensures that operating condition data more recent to the current moment receives a higher weight, while historical data further back in time receives an exponentially decaying weight. It's important to note that the physical significance of introducing the forgetting factor is that operating condition risk assessment should focus on the instantaneous state at the current moment, rather than the accumulated historical average.

[0068] For example, in this embodiment, the dynamic condition risk index functional can be constructed as follows:

[0069]

[0070]

[0071] in, for The working condition risk index at any given time. for Real-time load mass at any given moment To calibrate the maximum load mass, the index It is a positive real number greater than 1, used to apply nonlinear amplification penalty to the overload state; for linear velocity at time t, for The path curvature at time t, and its product represent the instantaneous centripetal acceleration. The maximum permissible lateral acceleration; Let be the derivative of the lifting mechanism fork height with respect to time. It is the exponential saturation coefficient; For the forgetting factor function, we can take... In the form of, Forgetting rate parameter; , , These are preset positive definite weighting coefficients used to adjust the relative importance of the three risk factors; This is the preset time window length.

[0072] Figure 2 The time-domain response curves of the dynamic operating condition risk index functional in this embodiment under different operating conditions are shown. It can be seen that in the scenario of full-load high-speed cornering with rapid jacking, due to the combined effect of the power function nonlinear penalty term and the exponential saturation term, the risk index shows a steep jump pulse, which is much higher than in other operating conditions, showing the difference in the time of threshold breaking under different operating conditions. The combined effect of the three can generate a significant surge in risk signals in the composite scenario of full-load high-speed cornering, providing a reliable triggering basis for subsequent adaptive allocation of bus bandwidth. Figure 3 The diagram shows the stacked area of ​​the normalized contribution of the three risk factors in this embodiment as the operating conditions evolve. As can be seen from the diagram, the dynamic complementary characteristics of the three-factor fusion model are evident. The dominant risk factor will naturally switch at different operating conditions. Any single-factor risk assessment model will produce a serious risk underestimation blind spot at a specific stage. Only the joint fusion of the three factors can achieve a robust risk assessment that covers all operating conditions. Figure 4The diagram shows a comparison of the impact of the forgetting factor on the time sensitivity of the risk index in this embodiment. It can be seen that too slow forgetting will cause historical low-risk data to dilute the current high-risk transient signal, while too fast forgetting may be overly sensitive to transient noise. A moderate forgetting rate achieves the optimal balance between preserving recent trend information and highlighting the current transient.

[0073] It is understood that in engineering implementation, the above continuous-time integral needs to be discretized into a weighted summation of the most recent sampling points. The specific sampling period and risk assessment period can be preset by those skilled in the art based on the computing power of the microcontroller, and do not constitute a limitation on this application.

[0074] In this embodiment, to achieve the asymmetric behavior of saving bus bandwidth under low-risk conditions and maximizing the freshness of critical data under high-risk conditions, a strategy for dynamically adjusting the communication bus bandwidth allocation between the master core and slave cores based on the operating condition risk index is implemented. Specifically, this may include:

[0075] Compare the working condition risk index with the first threshold;

[0076] When the working condition risk index is less than the first threshold, maintain basic heartbeat synchronization and synchronize status data at the first frequency.

[0077] When the operating condition risk index is greater than or equal to the first threshold, the data frame structure of the communication bus is reconstructed into a high-risk mode, and the key dynamic state variables are synchronized at a second frequency higher than the first frequency. The key dynamic state variables are forced to include the current center of gravity offset, the estimated slip ratio, and the position of the magnetic flux linkage.

[0078] The first threshold refers to a preset safety threshold for the operating condition risk index, which is used to delineate the boundary between low-risk and high-risk operating conditions. It is understood that the specific value of the first threshold can be preset by those skilled in the art based on vehicle type, warehouse environment characteristics, and historical operating data; for example, it can be set to a fixed value between 0.6 and 0.8.

[0079] The first frequency refers to the basic heartbeat synchronization frequency between the master and slave cores under low-risk operating conditions, which can be set to, for example, between 100Hz and 500Hz. It should be noted that this frequency is based on meeting the minimum real-time requirements of heartbeat detection, aiming to save bus bandwidth to the greatest extent possible.

[0080] The second frequency refers to the maximum synchronization frequency between the master and slave cores for key dynamic state variables under high-risk operating conditions. This frequency depends on the physical limits allowed by the hardware bus, and can reach 10kHz or even higher.

[0081] The high-risk mode data frame structure refers to the reconstructed data frame format adopted by the communication bus when the operating condition risk index exceeds the first threshold. Under this format, the basic heartbeat message is cut off or even discarded, while key dynamic state variables such as the current center of gravity offset, slip ratio estimate, flux linkage position, and torque feedforward are forcibly promoted to the highest priority, occupying all or most of the bandwidth of the data frame.

[0082] For example, in this embodiment, the asymmetric synchronization frequency mapping function can be constructed as follows:

[0083]

[0084]

[0085] in, For the first The risk index value is calculated from each discrete sampling period. The basic heartbeat synchronization frequency (i.e., the first frequency), The maximum synchronization frequency (i.e., the second frequency) allowed by the hardware bus; This is an indicator function that takes the value 1 when the condition within the parentheses is true, and 0 otherwise. The preset safety threshold (i.e., the first threshold); This is the frequency ramp rate parameter, used to control the steepness of the transition from the fundamental frequency to the limiting frequency. Figure 5 The input-output characteristic curves of the asymmetric synchronization frequency mapping function in this embodiment are shown.

[0086] It should be noted that the physical meaning of the above mapping function is: when At that time, indicator function The output is zero, the entire increment term is set to zero, and the synchronization frequency is always equal to zero. At this point, bus resource consumption is minimal, and a significant amount of bandwidth is saved for other non-critical in-vehicle data transmission; when When the indicator function outputs 1, the synchronization frequency is at... Based on this, an increment controlled by an exponential saturation curve is added, and this increment increases with... The magnitude exceeding the threshold increases smoothly, eventually asymptotically approaching the threshold. Through this mechanism, limited bus bandwidth resources are precisely allocated to high-risk chassis conditions, thereby ensuring the absolute freshness of key parameters (such as current, speed, flux linkage, etc.) required for subsequent shadow closed-loop simulations.

[0087] Understandably, the purpose of using an exponential saturation curve instead of a nonlinear jump is that linear or step frequency increases can cause sudden load changes on the bus, which can easily lead to data frame conflicts and bus jitter, resulting in the loss of synchronization packets. In contrast, the exponential saturation curve allows for a smooth frequency transition, ensuring the speed of frequency increases under high-risk conditions while avoiding impact on the bus physical layer.

[0088] Step 2: Parallel processing of key dynamic state variables is performed to generate safety intervention commands and pre-simulated control sets.

[0089] After obtaining sufficient real-time chassis status data from the slave core through the above-mentioned working condition risk assessment and asymmetric bandwidth allocation model, the next core problem to be solved is: how the slave core can use this data to independently determine the safety of the master core's instructions, and how to achieve truly uninterrupted takeover in the event of master core failure.

[0090] It should be noted that in existing dual-core redundant architectures for logistics robots, the master and slave cores often run the same control software. This control scheme is highly susceptible to common software failures. If a programming error exists in the master core's control algorithm (e.g., division by zero exception or array out-of-bounds error), the slave core running the same code will also crash simultaneously, rendering the dual-core redundancy ineffective. Furthermore, even if the slave core can detect the master core failure and trigger a switchover, the traditional switchover process requires a series of steps, including bus reset, state machine initialization, and PI integrator reconstruction, which typically takes tens of milliseconds. During this period, the motors will completely lose torque output, which can easily cause the lifted goods to tip over for a fully loaded logistics robot.

[0091] Therefore, in this embodiment, the parallel processing of checking key dynamic state variables can be divided into two independent but closely coordinated sub-processes:

[0092] The first is the generation of heterogeneous safety envelopes and boundary crossing comparison based on deterministic physical kinematics models; the second is the shadow closed-loop derivation and control set caching based on the field-oriented control (FOC) state equation.

[0093] 1) Input the real-time operating condition dataset from the kernel into the preset deterministic physical kinematic model, calculate the dynamic safety envelope containing the maximum allowable acceleration and overturning moment threshold; compare the torque distribution command issued by the main kernel with the dynamic safety envelope in real time.

[0094] In this context, a deterministic physical kinematic model refers to a minimal physical model constructed solely based on the first principles of rigid body dynamics (e.g., Newton's second law, the torque balance theorem, Coulomb friction model, etc.), without relying on any complex nonlinear controllers or state observers. Understandably, this model relies only on deterministic physical constants (e.g., gravitational acceleration, chassis wheelbase, etc.) and the absolute raw readings from sensors (e.g., load, angle, etc.), and its computational path is completely independent of the complex path planning and torque distribution algorithms running in the main core.

[0095] The dynamic safety envelope is a two-dimensional boundary surface that is calculated in real time by a deterministic physical kinematic model and used to divide the safe domain and the dangerous domain of vehicle dynamics. This envelope is defined by two core physical thresholds: one is the critical overturning moment threshold to prevent the overturning of the lifted cargo, and the other is the maximum permissible acceleration threshold to prevent longitudinal tire slippage.

[0096] It should be noted that the term 'heterogeneous' used in this embodiment has a specific engineering connotation: it refers to the fact that the security judgment logic used by the slave core and the control algorithm used by the master core are completely different in mathematical structure, dependent parameters and implementation path; this heterogeneity ensures that even if the algorithm of the master core crashes due to software defects, the security judgment logic of the slave core remains intact, thereby reducing the possibility of software failure due to common causes.

[0097] In this embodiment, the specific process of calculating the dynamic security envelope from the kernel can be as follows:

[0098] Extract static vehicle parameters, including chassis track width and center of gravity reference height;

[0099] Calculate the current total center of gravity height of the vehicle based on the current load and the current displacement of the lifting mechanism;

[0100] The instantaneous centrifugal force vector is calculated by combining the driving speed and the curvature of the path, and the critical overturning moment threshold that prevents the vertical load on one side of the wheel from dropping to zero is calculated based on the principle of torque balance using the total center of gravity height and the chassis wheel track.

[0101] Based on the real-time chassis working condition dataset, the corresponding road surface adhesion coefficient is matched, and the maximum allowable acceleration to prevent longitudinal slippage is calculated based on the Coulomb friction model.

[0102] The two-dimensional safety boundary is defined by the critical overturning moment threshold and the maximum permissible acceleration, serving as the dynamic safety envelope.

[0103] Static vehicle parameters refer to geometric and physical constants that are fixed at the time of vehicle manufacture and are independent of the vehicle's current motion state, such as chassis track. Chassis foundation center of gravity height robot body width These parameters are pre-stored in the read-only memory (ROM) of the slave core, and can still be read by the slave core in O(1) complexity even if any software failure occurs on the master core side.

[0104] The total center of gravity height refers to the real-time center of gravity height after comprehensively considering the chassis base center of gravity height and the increase in center of gravity height caused by the lifting mechanism. When the lifting mechanism is in the fully retracted state, the total center of gravity height equals the chassis base center of gravity height; when the lifting mechanism is in the fully raised state, the total center of gravity height equals the chassis base center of gravity height plus the height increment corresponding to the maximum stroke of the lifting mechanism. It should be noted that the real-time accuracy of the total center of gravity height is crucial for the accuracy of the rollover moment threshold, because the higher the center of gravity, the more stringent the vehicle rollover critical conditions.

[0105] The critical overturning moment threshold refers to the limit moment at which the vertical load on one side of the vehicle's wheels will drop to zero and a rollover will occur when the lateral moment acting on the vehicle's center of gravity approaches this threshold. Based on the principle of moment balance, it is known that when the lateral moment acting on the center of gravity exceeds the restoring moment determined by gravity and the width of the supporting surface, the vehicle will rollover.

[0106] The maximum permissible acceleration refers to the maximum longitudinal acceleration that a vehicle can withstand under the current road surface adhesion conditions and chassis attitude without causing tire slippage, calculated based on the Coulomb friction model.

[0107] For example, in this embodiment, the critical overturning moment threshold and the maximum permissible acceleration threshold of the heterogeneous safety envelope can be calculated using the following formulas:

[0108]

[0109]

[0110] in, for Real-time load mass at any given moment It is the acceleration due to gravity. The chassis track. The height of the chassis foundation center of gravity. The increase in center of gravity height caused by the lifting mechanism. That is, the real-time center of gravity height including the lifting height; The chassis roll angle is represented by a cosine correction term used to account for the changes in the gravitational components under tilted conditions. For equivalent rotational inertia, For the maximum permissible angular acceleration, This item is used to reserve a margin for inertial torque; The wheel-ground friction coefficient is estimated in real time. This refers to the chassis pitch angle.

[0111] Based on this, the two-dimensional safety region, i.e., the dynamic safety envelope, is jointly defined by the critical overturning moment threshold and the maximum permissible acceleration threshold. It can be expressed by the following formula:

[0112]

[0113] in, Torque commands issued by the main core This refers to the acceleration commands issued by the main core. The safety envelope defines a rectangular safety region centered at the origin. As long as the main core's control commands fall within this region, they are considered safe commands that comply with physical constraints.

[0114] Figure 6 A three-dimensional surface plot of the critical overturning moment threshold in this embodiment as a function of center of gravity height and load is shown. The plot illustrates the non-monotonic characteristic that the threshold initially increases slightly due to the increase in gravity restoring moment as the load increases, but then decreases sharply as the center of gravity height increases. The overturning moment threshold is much more sensitive to center of gravity height than to load mass. Even if the load remains unchanged, an increase of only 0.3 meters in jacking height can cause the threshold to drop by more than 40%. Figure 7 The diagram shows the two-dimensional shrinkage evolution of the dynamic safety envelope in this embodiment as the operating conditions change. The diagram illustrates the physical characteristic that the dynamic safety envelope shrinks significantly as the load increases and the center of mass rises. When the load is fully loaded and the jacking is at a high position, the safety domain area is only about 25% of that when the load is unloaded, indicating that the probability of the main core command going out of bounds increases significantly under high-risk operating conditions.

[0115] It should be noted that the aforementioned safety envelope equation relies only on defined physical constants (e.g., gravitational acceleration, wheelbase) and absolute sensor readings (e.g., load, angle), and does not contain any complex nonlinear control logic, state observers, or feedback compensation mechanisms. Therefore, regardless of any software defects in the main core's complex path planning and torque distribution algorithms, as long as the control commands it issues... Not a security envelope The kernel immediately identifies the instruction as dangerous and takes over, thus eliminating the possibility of common software failures from the logical and physical source.

[0116] In this embodiment, after the step of comparing the torque distribution command issued by the main core with the dynamic safety envelope in real time, it may further include a handling process for abnormal out-of-bounds errors in the main core isomorphic algorithm:

[0117] If the torque distribution command issued by the main core causes the predicted acceleration to be greater than the maximum allowable acceleration, or the predicted lateral moment to be greater than the critical overturning moment threshold, then it is determined that the main core has experienced an abnormal out-of-bounds error in the isomorphic algorithm.

[0118] After the core intercepts the main core's subsequent instructions, it records the abnormal error codes and uses a deterministic physical kinematic model to generate a gradually decreasing sequence of braking torques for direct output, forcing the vehicle to stop safely without overturning.

[0119] In this context, "isomorphic algorithm out-of-bounds" refers to a situation where the master core's control algorithm, due to software defects, sensor malfunctions, or sudden changes in operating conditions, issues torque or acceleration commands that exceed the physical boundaries of the dynamic safety envelope. In traditional master-slave isomorphic architectures, such out-of-bounds errors often occur simultaneously in both the master and slave cores and cannot be independently identified by either core. However, in this embodiment, because the slave core employs completely heterogeneous judgment logic compared to the master core, such out-of-bounds errors can be detected and addressed independently by the slave core.

[0120] A gradually decreasing braking torque sequence refers to a set of discrete control signals generated from a deterministic physical kinematic model, where the torque amplitude monotonically decreases to zero over time. It should be noted that the design purpose of this braking torque sequence is to ensure that the vehicle stops in the shortest possible time while preventing longitudinal tipping of the lifted cargo due to instantaneous high-torque braking.

[0121] 2) Based on the received motor operating state variables and torque feedforward, the kernel continuously runs the shadow closed-loop control law in the background. Without outputting hardware pulse width modulation (PWM) signals, it calculates and caches the pre-deduced control set for the next control cycle cycle by cycle.

[0122] The shadow closed-loop control law refers to a mirror control law that is mathematically equivalent to the motor control law currently running on the main core, but is forcibly isolated at the hardware output level (i.e., no actual PWM signal is output). In essence, the term 'shadow' describes the core engineering characteristic of this closed-loop control law: it operates continuously in the background at the exact same rate as the main core, but its calculation results do not directly drive the IGBT gate; instead, they are cached within the slave core and only put into physical output after a takeover event is triggered.

[0123] The pre-deduced control set refers to the set of three-phase PWM duty cycle parameters pre-calculated and cached by the shadow closed-loop control law for the next control cycle. This set includes the duty cycle values ​​of three independent channels: phase A, phase B, and phase C.

[0124] It should be noted that, in order to achieve microsecond-level seamless takeover, the slave core must perform real-time simulations of the motor's control state in the background and pre-calculate the three-phase PWM duty cycle required for the next control cycle. The modeling approach in this embodiment is based on the stator voltage equations of the permanent magnet synchronous motor. - In a rotating coordinate system, using the current measurement value of the current cycle and the current value of the previous cycle, the current derivative is approximated by the backward difference method, thereby predicting the current required for the next cycle. - The predicted voltage is then converted to the PWM duty cycle in a three-phase stationary coordinate system using inverse Park and inverse Clarke transformations.

[0125] In this embodiment, the specific process of solving and caching the pre-deduced control set from the kernel shadow closed-loop control law may include:

[0126] The core receives the current flux linkage position, electrical angular velocity, torque feedforward, and current control cycle calculated by the main core. - Shaft current sampling value;

[0127] From the nuclear field-oriented control (FOC) equation of state, based on stator resistance, - Based on motor body parameters such as shaft inductance and permanent magnet flux linkage, the direct-axis voltage component and quadrature-axis voltage component required for the motor to achieve the expected torque are calculated.

[0128] The direct-axis voltage component and the quadrature-axis voltage component are subjected to inverse coordinate transformation (including inverse Park transformation and inverse Clarke transformation) to generate the corresponding three-phase duty cycle parameters.

[0129] The three-phase duty cycle parameters are stored as a pre-deduced control set in the first-in-first-out (FIFO) microsecond-level ring buffer of the slave core, and the oldest data frame is overwritten at the end of each control cycle, while keeping the output pins on the slave side in a high-impedance state.

[0130] Among them, the direct-axis voltage component (d-axis voltage) and the quadrature-axis voltage component (q-axis voltage) refer to the voltage components in a permanent magnet synchronous motor. - In a rotating coordinate system, two mutually orthogonal voltage components are used to drive the stator windings to generate the desired torque. It can be understood that in FOC control, Shaft voltage is mainly used to control the excitation component. The shaft voltage is mainly used to control the torque component. The orthogonal decoupling between the two allows the permanent magnet synchronous motor to be precisely controlled like a DC motor.

[0131] Backward differential refers to a discrete numerical method that approximates the derivative of current with respect to time by using the difference between the current sampled value of the current cycle and the current sampled value of the previous control cycle. Compared with forward differential, this method has better numerical stability and does not require the acquisition of current values ​​at future times, so it is particularly suitable for real-time control scenarios.

[0132] A FIFO microsecond-level circular buffer refers to a circular storage structure deployed within the slave core, managed according to the first-in-first-out principle, where the time for writing and reading a single piece of data is on the order of microseconds. The 'circular' characteristic of the microsecond-level circular buffer is reflected in the fact that when the buffer is full, new data will overwrite the oldest data, thus ensuring that the buffer always stores the pre-drafted control set for the latest several control cycles.

[0133] A high-impedance state refers to a third state in digital circuits where the output pin neither outputs a high nor a low level, but instead exhibits extremely high input impedance. In this embodiment, the PWM output pin on the slave side is required to remain in a high-impedance state throughout the normal operation of the master core. The purpose of this is that, although the slave core continues to perform calculations and cache the pre-deduced control set in the background, its output port is electrically transparent to the underlying motor driver and will not interfere with the actual PWM signal output by the master core, thus ensuring the shadow attribute of the shadow closed-loop control law.

[0134] For example, in this embodiment, the shadow closed-loop deduction - The axis voltage prediction equation can be constructed using the following formula:

[0135]

[0136] in, and For the prediction of the next control cycle shaft and Shaft-stator voltage; For stator resistance, and They are respectively shaft and Shaft inductor, The electrical angular velocity for the current control cycle; and Sampled for the current control cycle shaft and Shaft stator current, and These are the current and previous control cycles, respectively. - Axis current vector, To control the cycle; It is a permanent magnet flux linkage. Figure 8 The figure shows the verification curve of the dq axis voltage prediction accuracy of the shadow closed-loop derivation in this embodiment. The figure verifies that the prediction accuracy of the shadow closed-loop derivation equation based on the backward difference method under typical motor speed and load conditions is sufficient to support the disturbance-free take-off, and the prediction voltage error is controlled within 1% of the bus voltage.

[0137] It should be noted that in the above voltage prediction equation, the first term... Includes resistance voltage drop and - Cross-coupling effect between axes, where and They are respectively shaft and The coupling voltage of the shaft is an inherent characteristic of the motor model in a rotating coordinate system, reflecting the back electromotive force generated by the motor inductance during rotation; the second term uses backward differential. The inductor voltage drop is obtained by multiplying the derivative of the approximate current with respect to time by the inductance; the third term The back electromotive force generated by the rotation of the permanent magnet exists only in In the shaft component, this is the core characteristic that distinguishes permanent magnet synchronous motors from ordinary induction motors.

[0138] In obtaining the prediction - After determining the shaft voltage, it needs to be converted into a three-phase PWM duty cycle that can directly drive the IGBT gate.

[0139] For example, in this embodiment, the three-phase PWM duty cycle can be calculated using the following formula:

[0140]

[0141] in, The three-phase PWM duty cycle vector for the predicted next control cycle; The inverse Park transformation matrix has the following parameters. The predicted electrical angle for the next cycle is the current electrical angle plus an angle increment within a control cycle. It is the inverse Clarke transformation matrix; The voltage command is normalized to the duty cycle by dividing the DC bus voltage by the bus voltage.

[0142] Understandably, the above deduction process involves high-priority cyclic computation within the slave core, with the calculation results continuously pushed into the hardware FIFO cache. When the master core crashes, the slave core does not need to undergo the traditional bus reset, state machine initialization, and PI integrator reconstruction processes that take tens of milliseconds. Instead, it directly retrieves the data from the cache via a hardware multiplexer. By injecting underlying power devices within the current microsecond-level control cycle, zero-dropout torque output is achieved, thus solving the safety problem of cargo overturning that can easily occur when switching the control tube under full-load lifting conditions.

[0143] Step 3: Output Takeover and Hardware-Level Workshop Interlocking Control: When a heartbeat failure of the main core or a torque distribution command exceeding the dynamic safety envelope is detected, a takeover mechanism is triggered. The slave core directly injects the pre-calculated control set into the underlying motor driver and forces the vehicle to switch to limp-down mode. Simultaneously, the slave core bypasses the upper-level industrial control computer and directly broadcasts an emergency hardware downgrade frame to adjacent vehicles within a preset physical radius via the vehicle's local radio frequency bus to trigger the underlying right-of-way yielding logic of adjacent vehicles. Specifically, this may include the following sub-steps:

[0144] 1) Inject the pre-deduced control set directly into the underlying motor driver from the core.

[0145] The core feature of the takeover action in this embodiment is its lack of disturbance, meaning that the motor torque output before and after the takeover is uninterrupted or jumpless in the physical time sequence. To achieve this feature, this embodiment employs a microsecond-level physical channel switching mechanism based on a hardware arbitrator, rather than a millisecond-level response mechanism based on software interrupts.

[0146] In this embodiment, the step of directly injecting the pre-deduced control set from the core into the underlying motor driver may specifically include:

[0147] The hardware arbiter, configured outside the master and slave cores, toggles the selection pin of the hardware multiplexer within a microsecond-level clock cycle of detecting the takeover trigger signal.

[0148] Remove the high-impedance configuration from the core output pin;

[0149] The three-phase duty cycle parameters of the current phase are extracted directly from the microsecond-level circular buffer.

[0150] By bypassing the conventional control law initialization sequence, it directly drives the IGBT gate of the underlying motor driver.

[0151] Among them, the hardware arbitrator refers to a physical arbitration unit deployed outside the master core and slave core, implemented using an independent hardware entity (e.g., a complex programmable logic device CPLD or a field-programmable gate array FPGA), which can complete the master-slave switching decision without relying on any software instructions.

[0152] Understandably, the purpose of hardware arbitrators is that any software-based arbitration logic may be affected by the main core software failure, while independent hardware arbitrators are completely decoupled from the main core's operating state, thereby ensuring the reliability of switching decisions.

[0153] A hardware multiplexer is a physical channel selector deployed between the slave core's PWM output pin and the gate of the underlying motor driver's IGBT. The level of its selection pin is directly controlled by a hardware arbiter. During normal operation of the master core, the hardware multiplexer connects the master core's PWM output channel to the IGBT gate, while disconnecting the slave core's PWM output channel. At the moment a takeover event is triggered, the hardware multiplexer flips its selection pin, disconnecting the master core channel and connecting the slave core channel.

[0154] The takeover trigger signal is a hardware level signal generated by the slave core or hardware arbitrator after detecting a master core jump failure or a master core instruction out of bounds, used to trigger a hardware multiplexer to toggle. The specific physical source of the takeover trigger signal can be the timeout overflow signal of the master core jump monitoring watchdog, or the output of the hardware comparator of the slave core out-of-bounds judgment logic; this application does not impose any restrictions on this.

[0155] Understandably, conventional control law initialization sequences typically include a series of steps such as PI integrator reset, state observer initialization, electrical angle alignment, and current sampling calibration. In traditional master-slave switching, the cumulative time consumed by these steps often reaches tens of milliseconds. However, in this embodiment, since the slave core has been running the shadow closed-loop control law in the background at a completely synchronized pace with the master core, all its internal states, such as the PI integrator, state observer, and electrical angle, are completely aligned with the master core. Therefore, the initialization sequence can be skipped directly, enabling immediate takeover. Figure 9 A comparison diagram of torque continuity during master-slave core switching is shown in this embodiment and in the traditional embodiment.

[0156] 2) Force the vehicle to switch to limp downgrade mode.

[0157] Limping downgrade mode refers to a downgraded working mode in which, after the main core fails, the vehicle continues to drive with a set of hard-coded, strictly limited motion parameters in order to autonomously return to a repair station or safe parking area without causing any secondary safety accidents.

[0158] In this embodiment, the step of forcibly switching the vehicle to limp-down mode may specifically include:

[0159] Activate the hard-coded degradation control flow from the kernel;

[0160] The maximum speed command of the vehicle is clamped to a preset limp safety speed constant;

[0161] The absolute steering angle of the steering mechanism is clamped to the preset minimum anti-skid angle limit range;

[0162] The power supply enable signals of the lifting mechanism and fork mechanism are forcibly shut off by hardware level to lock the current mechanical load posture.

[0163] In this context, hard-coded degradation control flow refers to degradation control logic branches that are burned into the slave kernel ROM, cannot be modified by any upper-level instructions, and are characterized by deterministic parameter limiting. It can be understood that 'hard-coded' emphasizes the immutability and unbypassability of this control flow; even if any malicious software injection occurs on the master kernel side, it cannot affect the slave kernel's degradation behavior.

[0164] The limp safety speed constant refers to the preset maximum speed at which a vehicle is allowed to travel in limp mode. This speed is usually between 10% and 30% of the normal operating speed, for example, 0.1 m / s to 0.5 m / s.

[0165] The minimum steering angle limit for anti-skid refers to the preset maximum absolute angle range that the steering mechanism of the vehicle is allowed to deflect in limp mode. In limp mode, an excessive steering angle will increase the risk of lateral tipping of the lifted cargo. Therefore, the steering angle is forcibly limited to a physical safety range that can ensure the minimum turning radius.

[0166] Forcibly shutting down the power supply enable signals of the lifting and forklift mechanisms via hardware level refers to directly pulling down the power supply enable signals of these mechanisms through the GPIO output pins from the core, thereby cutting off their physical drive capability. Hardware level switching is used instead of software instruction switching because software instructions can still be maliciously modified or affected by software malfunctions, while pulling down hardware level signals is a fundamental physical signal that cannot be bypassed.

[0167] The significance of locking the current mechanical load attitude is that the vehicle's attitude is already relatively fragile in limp mode, and any movement of the lifting mechanism may cause additional changes in the center of gravity height, thereby triggering new overturning risks; by forcibly locking the current attitude, the physical state of the cargo is frozen from the core, so that the vehicle dynamics model remains stable in limp mode.

[0168] 3) By bypassing the upper-level industrial control computer, the underlying hardware emergency downgrade frame is broadcast directly to adjacent vehicles within a preset physical radius via the vehicle local radio frequency bus to trigger the underlying right-of-way transfer and avoidance logic of adjacent vehicles.

[0169] After solving the dual-core redundancy safety takeover problem within a single vehicle using the aforementioned heterogeneous safety envelope and shadow inference model, a more complex comprehensive problem needs to be considered:

[0170] When a logistics robot experiences a single-core failure and enters limp mode, it needs to bypass the upper-level central dispatch system and directly send emergency avoidance frames to surrounding vehicles via the lower-level radio frequency broadcast to clear the physical path to the repair station. However, the lower-level radio frequency communication is highly vulnerable to replay attacks or malicious forgery. If an attacker forges an emergency frame, all surrounding robots will be forced to avoid it, leading to warehouse paralysis and physical deadlock. Traditional asymmetric encryption verification (such as RSA) is computationally time-consuming and requires a connection to the central dispatch system to verify certificates, a connection that is impossible to obtain in degraded mode.

[0171] To address this, this embodiment embeds a decentralized authentication protocol within the underlying hardware emergency degradation frame. This protocol operates with extremely low latency on computationally limited microcontrollers and does not rely on a central scheduling system. In this embodiment, the protocol employs zero-knowledge proof technology from cryptography, allowing the sending vehicle to prove to surrounding vehicles that 'I possess legitimate warehouse access credentials, and my underlying hardware has indeed generated a serious degradation fault code,' without exposing its own network address to prevent the convoy from being tracked and located, and without revealing specific system vulnerability codes to prevent attackers from launching secondary attacks using known vulnerabilities.

[0172] In this embodiment, the step of broadcasting the underlying hardware emergency downgrade frame may specifically include:

[0173] Two random blinding factors are generated from the kernel at the moment of takeover, and two commitment values ​​are generated for the legitimate key identifier and the real fault code respectively based on the Pedersen commitment scheme;

[0174] Substitute the two commitment values, the current local coordinates, and the timestamp into a preset lightweight hash function to generate challenge values ​​based on the Fiat-Shamir heuristic;

[0175] By linearly combining the two random blinding factors with the challenge value and the original secret information, two zero-knowledge response values ​​are obtained.

[0176] The underlying hardware emergency degradation frame data packet structure is constructed. The data packet structure includes: two commitment values, a challenge value, two zero-knowledge response values, the vehicle's current local coordinates, the current heading speed vector, the vehicle's MAC address, and an emergency vector flag indicating the limp state.

[0177] Emergency hardware downgrade frames are broadcast to adjacent vehicles within a preset physical radius via the vehicle's local radio frequency bus.

[0178] Among them, the randomization factor refers to the value generated by the true random number generator built into the kernel during each commitment generation, with a value range of modulo 1. The random number of the set of integers. It should be noted that the core physical meaning of introducing the blinding factor is that even with the same key identifier or fault code, completely different commitment values ​​will be generated each time a commitment is made, thus ensuring the concealment of the commitment, that is, a third party cannot deduce the original information by comparing multiple commitment values.

[0179] The Pedersen commitment scheme is a homomorphic cryptographic commitment scheme based on the discrete logarithm problem. Its core is that the commitment value can be publicly transmitted and verified, but no one can deduce the original information from the commitment value without knowing the blinding factor.

[0180] The challenge value is a unique and unpredictable random number obtained by hashing the commitment value, location coordinates, and timestamp using the Fiat-Shamir heuristic algorithm. Including the location and timestamp in the hash input effectively prevents replay attacks; even if an attacker intercepts a previously legitimate emergency frame, the old proof will fail verification because the location and time have changed.

[0181] The zero-knowledge response value refers to the number of algebraic values ​​that can be obtained by linearly combining the random blinding factor, the challenge value, and the original secret information, enabling the verifier to confirm the validity of the proof without knowing the original secret.

[0182] For example, in this embodiment, the Pedersen commitment can be generated by the following formula:

[0183]

[0184]

[0185] in, To identify the legitimate key The value of the commitment, To detect real fault codes The value of the commitment; and For a pre-defined elliptic curve group of large prime order The two generators, Modulus of a large prime number; and The random blinding factor generated from the kernel at the moment of takeover has a value range of 1. .

[0186] After the Pedersen commitment is generated, the challenge and response construction phase begins. A non-interactive zero-knowledge proof is built, allowing the sending vehicle to complete the proof without multiple rounds of communication with the verifier. A non-cryptographic hash function binds the commitment value, current location coordinates, and timestamp together to generate a unique and unpredictable challenge value. Even if an attacker intercepts a previous legitimate emergency frame, the old proof will fail verification because the location and time have changed.

[0187] The challenge value and the zero-knowledge response value can be calculated using the following formulas:

[0188]

[0189]

[0190]

[0191] in, Challenge value, For lightweight hash functions (such as a truncated version of SHA-256), For data splicing symbols, The coordinates of the sending vehicle's current location. This is the current timestamp; and Zero knowledge response value, zero knowledge response value and It encodes both the blinding factor and the original secret information algebraically, but since the blinding factor is randomly generated and exists only within the kernel, it relies solely on... and The value is such that no third party can separate the original value. or This ensures that the proof is zero-knowledge-based.

[0192] Based on the above calculations, the complete format of the V2V emergency safety frame broadcast by the transmitting vehicle is as follows:

[0193]

[0194] in, Let be the heading velocity vector of the transmitting vehicle.

[0195] When the VCU of an adjacent vehicle receives an emergency hardware degradation frame at the underlying radio frequency communication interface, it triggers a preset interrupt service routine. The execution process of the interrupt service routine may specifically include:

[0196] Using the two received zero-knowledge response values, two commitment values, and a challenge value, a one-time equation verification is performed on the zero-knowledge verification equation within the local microcontroller;

[0197] If the verification passes, then parse the current local coordinates and the current heading velocity vector;

[0198] The longitudinal projection distance and lateral offset distance of its own position relative to the route of the transmitting vehicle are calculated based on the vector geometry model.

[0199] If the longitudinal projection distance is within the preset safe braking distance range, and the lateral offset distance is within the range limited by the width of the transmitting vehicle plus the safety margin, then the VCU of the adjacent vehicle directly sends a deceleration command to its own motor to zero and moves backward to both sides, giving way to the transmitting vehicle to return to the maintenance station with the shortest straight physical path.

[0200] For example, in this embodiment, the zero-knowledge verification equation performed by adjacent vehicles is as follows:

[0201]

[0202] Among them, the verifier uses the received , , , and The validity of the proof is determined by whether the left and right sides of the above equation are equal.

[0203] After verifying the validity of the downgraded emergency frame through zero-knowledge proof, the neighboring vehicle that receives the valid emergency frame needs to perform physical geometry avoidance. A local danger domain determination model based on vector geometry is established in the underlying controller of each neighboring vehicle, so that it can autonomously determine whether it is on the travel path of the downgraded vehicle and trigger braking and lateral avoidance when necessary.

[0204] For example, in this embodiment, neighboring vehicles The longitudinal projection distance and lateral offset distance relative to the downgraded vehicle can be calculated using the following formulas:

[0205]

[0206]

[0207] in, For nearby vehicles Location coordinates, The location coordinates of the downgraded vehicle. The unit heading vector for the downgraded vehicle. The heading angle for the downgraded vehicle; The longitudinal projection distance is obtained by the dot product of the position difference vector and the heading vector; a positive value indicates that it is located in front of the degraded vehicle. The lateral offset distance is obtained by calculating the magnitude of the position difference vector minus its longitudinal projection component.

[0208] The physical transfer trigger function can be represented by the following formula:

[0209]

[0210] in, The safe braking distance is dynamically calculated based on the limp speed of the downgraded vehicle; the faster the speed, the greater the required safe distance. The width of the robot body. For safety margin; Indicates nearby vehicles If the vehicle is within the danger projection zone of the downgraded vehicle, physical transfer is required. This indicates that the vehicle is not within the danger zone and no action is required.

[0211] Figure 10 The diagram shows a rectangular danger projection domain for right-of-way transfer in this embodiment. The diagram illustrates the spatial geometric logic of the distributed right-of-way transfer determination mechanism based on vector projection. Only adjacent vehicles that are ahead of the degraded vehicle and whose lateral offset is within half the vehicle width plus the safety margin are required to give way. Other vehicles are not affected, thereby achieving a precise balance between minimizing the avoidance range and maximizing the passage protection.

[0212] It should be noted that the model is calculated entirely in the underlying vehicle control unit, with strict determinism and extremely low computational latency. It does not rely on high-level map topology search or network communication, thus enabling the physical opening of a direct retreat route to the repair station for degraded vehicles experiencing single-core failure in the shortest possible time, completely eliminating the risk of local deadlock in high-density areas caused by network latency.

[0213] Step 4: Handling anomalies such as bus communication congestion and buffer overflow edge conditions.

[0214] In actual warehousing operations, when the chassis is in a high-lift position and simultaneously undergoing high-speed cornering, the operational risk assessment model will output an extremely high risk index, triggering data transmission at the highest synchronization frequency between the master and slave cores. However, at such a high synchronization frequency, due to the instantaneous influx of a large number of concurrent data frames, the SPI ring receive buffer between the master and slave cores may overflow, causing frame loss of key parameters (such as slip ratio estimates and torque feedforward) on which subsequent shadow closed-loop inference relies. In severe cases, it may even cause the slave core's inference calculations to use outdated operational data, resulting in unpredictable torque jumps.

[0215] Therefore, in response to the aforementioned edge cases, this embodiment may also include exception handling logic, the specific process of which is as follows:

[0216] When the chassis is in a high position and performing high-speed cornering compound actions, the occupancy rate of the SPI ring receive buffer between the master core and the slave core is monitored in real time.

[0217] When an overflow warning is detected in the SPI ring receive buffer, the direct memory access (DMA) controller of the slave core triggers an overflow interrupt;

[0218] A custom pointer overwrite mechanism is implemented to skip and discard load status history frame data packets in the SPI circular receive buffer;

[0219] Forcefully locate and extract the latest slip ratio estimate and torque feedforward timestamp data with the highest priority within the SPI ring receive buffer;

[0220] The extracted data is immediately fed into the shadow closed-loop control law for deduction and calculation.

[0221] The Direct Memory Access (DMA) controller is a hardware acceleration unit deployed in the slave core that can complete memory data transfer without consuming CPU computing resources. The purpose of using DMA instead of CPU interrupts to handle overflow events is that, at high synchronization frequencies, the response latency of CPU interrupts may become a new bottleneck, while DMA can complete data transfer at speeds close to the hardware limits.

[0222] A custom pointer overwrite mechanism refers to pointer adjustment logic pre-configured in the DMA controller that selectively discards low-priority frames and retains high-priority frames based on the priority label of the data frame. The key feature of this mechanism is 'selective discarding', meaning that different types of data frames have different priority weights. Load status history frames are given the lowest priority because they change slowly and have little real-time impact on the extrapolation calculation; while slip ratio estimates and torque feedforward values ​​are given the highest priority because they directly determine the accuracy of the PWM duty cycle in the next cycle.

[0223] Through the above-mentioned exception handling logic, even under extreme complex action conditions, the freshness of the parameters used in the derivation and calculation of the shadow closed-loop control law will not exceed the delay of one control cycle, thus ensuring the mathematical feasibility of disturbance-free take-off.

[0224] Figure 11The diagram illustrates the data freshness guarantee effect of the pointer overwrite mechanism when the SPI ring receive buffer overflows in this embodiment. It can be seen that the customized pointer overwrite mechanism in this embodiment, under extreme bus congestion scenarios, selectively discards low-priority load history frames and forcibly extracts the latest high-priority slip rate and torque feedforward data, strictly controlling the parameter delay within one control cycle.

[0225] Simulation experiments show that, in the combined working condition test of logistics robots performing full-load lifting and high-speed cornering, compared with the traditional master-slave isomorphic dual-core redundant control method, the continuity index of motor torque output when the master core suddenly crashes is reduced from millisecond-level torque interruption to microsecond-level zero-stuttering, and the overturning rate of lifted goods is reduced from 18.6% to 0.3%. In the malicious attack test of forged emergency frames, the zero-knowledge proof protocol of this invention has a rejection rate of over 99.99% for forged frames, while the traditional plaintext broadcast protocol has a physical deadlock rate of up to 73.4% for the entire warehouse under the same attack. Figure 12 A comparison chart showing the computation time of zero-knowledge proof verification in this embodiment is provided.

[0226] Example 2

[0227] This embodiment discloses a dual-core VCU redundant control system for a logistics robot.

[0228] Specifically, the dual-core VCU redundant control system for the logistics robot can be integrated into the vehicle control unit of the logistics robot. This vehicle control unit can be an embedded control device installed in warehouse handling robots, automated forklifts, evacuation handling robots, lifting logistics robots, or composite mobile robots. The vehicle control unit may include hardware structures such as a master core, slave cores, a dual-core communication bus, underlying motor drivers, a hardware arbitrator, an RF transceiver, and a power drive interface.

[0229] In this embodiment, the master core can be used to perform complex control tasks such as path tracking, speed planning, torque distribution, fork action coordination, and task scheduling interface parsing; the slave core can be used to perform safety control tasks such as independent safety monitoring, working condition risk assessment, heterogeneous physical safety envelope generation, shadow closed-loop control simulation, fault takeover, and low-level vehicle-to-vehicle emergency cooperative avoidance.

[0230] In this embodiment, the master core and slave core can be located in the same dual-core microcontroller or can be implemented by two independent microcontroller chips. The master core and slave core can communicate with each other via SPI, CAN, FlexRay, UART or on-chip shared memory bus. The underlying motor driver may include an inverter, gate driver and power switching device for driving the travel motor, steering motor, lifting motor or fork actuator.

[0231] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A dual-core VCU redundancy control method for a logistics robot, characterized in that, The redundancy control method includes: Obtain the operational data set of the logistics robot and the state variables of the first processing entity; The operating condition dataset is input into the physical constraint model to generate dynamic safety boundaries. The physical constraint model differs from the control logic run by the first processing entity in terms of dependent parameters and implementation path. The dynamic safety boundary is used to divide the safety domain and danger domain of the logistics robot. The first control command issued by the first processing entity is compared with the dynamic safety boundary to determine whether the first control command falls into the danger zone. Based on the state variables, a mirror control law is run to solve the pre-deduced control set cycle by cycle. The pre-deductive control set is cached, the mirror control law is equivalent to the control logic run by the first processing entity, and no actual control signal is output to the motor driver during operation. The pre-deductive control set is used to drive the motor driver. When the first processing entity fails, or the first control command falls into the danger zone, an arbitration unit independent of the first and second processing entities takes over and injects the cached pre-deduced control set into the motor driver, and the injection is not initialized by the mirror control law.

2. The dual-core VCU redundancy control method for logistics robots according to claim 1, characterized in that, The step of obtaining the operational data set of the logistics robot and obtaining the state variables of the first processing entity includes: The second processing entity determines a risk index based on the working condition dataset, the risk index representing the degree to which the current working condition of the logistics robot chassis approaches its physical safety boundary; The second processing entity adjusts the bandwidth allocation strategy of the communication link between the first and second processing entities based on the risk index. The state variables are obtained at a synchronization frequency corresponding to the bandwidth allocation strategy. The second processing entity determines a risk index based on the operating condition dataset, including: Obtain the operating condition dataset within the preset time window; Based on the operating condition data, the ratio of the first observation data that centrally represents the load-bearing state to the preset maximum load capacity is used to determine the first risk component through nonlinear amplification. Based on the aforementioned working condition data, the product of the second observation data, which centrally represents the motion rate, and the third observation data, which represents the degree of trajectory curvature, is normalized to determine the second risk component. Based on the working condition dataset, the rate of change of the fourth observation data representing the jacking attitude is used to determine the third risk component after saturation processing. The saturation processing makes the third risk component asymptotically approach the upper limit when the rate of change increases. The first risk component, the second risk component, and the third risk component within the preset time window are weighted and accumulated according to the time decay weight to determine the risk index. The time decay weight gives higher weight to data that is closer to the current time.

3. The dual-core VCU redundancy control method for logistics robots according to claim 2, characterized in that, The second processing entity adjusts the bandwidth allocation strategy based on the risk index and acquires the state variables at the corresponding synchronization frequency, including: Compare the risk index with a first threshold; When the risk index is less than the first threshold, the state variables are synchronized using a first data frame structure and at a first frequency. When the risk index is greater than or equal to the first threshold, the communication link is reconstructed into a second data frame structure, and the state variables are synchronized preferentially at a second frequency higher than the first frequency. The second data frame structure makes the state variables occupy a higher bandwidth priority than the first data frame structure. The synchronization frequency is always the first frequency when the risk index is less than the first threshold; When the risk index is greater than or equal to the first threshold, the synchronization frequency increases smoothly from the first frequency as the risk index exceeds the first threshold, and gradually approaches the second frequency.

4. The dual-core VCU redundancy control method for logistics robots according to claim 1, characterized in that, The dynamic security boundary is generated through the following steps: Extract static structural parameters, which include: The chassis wheel track and center of gravity reference height, the static structural parameters are pre-stored in the read-only memory of the second processing entity; The overall center of gravity height is determined based on the current load and the current displacement of the lifting mechanism; Based on the data representing motion speed and trajectory curvature in the working condition dataset, the instantaneous centrifugal force is determined, and using the comprehensive center of gravity height and the chassis wheel track, the critical overturning moment threshold to prevent the vertical load on one side of the wheel from dropping to zero is determined based on the torque balance. Based on the working condition dataset, the corresponding road surface adhesion parameters are matched, and the maximum allowable acceleration to prevent longitudinal slippage is determined based on the Coulomb friction model. The two-dimensional boundary, defined by the critical overturning moment threshold and the maximum permissible acceleration, serves as the dynamic safety boundary. Determining the height of the overall centroid includes: When the lifting mechanism is in the fully retracted state, the overall center of gravity height is equal to the center of gravity reference height; When the lifting mechanism is raised, the overall center of gravity height is equal to the sum of the center of gravity reference height and the height increment corresponding to the displacement of the lifting mechanism; The critical overturning moment threshold decreases as the overall center of gravity height increases, and the gravity component is cosine corrected according to the chassis roll angle, while reserving an inertial moment margin. The maximum permissible acceleration is determined based on the road surface adhesion parameters and the chassis pitch angle.

5. The dual-core VCU redundancy control method for logistics robots according to claim 1 or 4, characterized in that, After comparing the first control command with the dynamic safety boundary, the process further includes: When the predicted acceleration corresponding to the first control command is greater than the maximum allowable acceleration, or the corresponding lateral moment is greater than the critical overturning moment threshold, an out-of-bounds event is determined to have occurred. The second processing entity intercepts subsequent instructions issued by the first processing entity, records abnormal error codes, and generates a braking torque sequence with a monotonically decreasing amplitude to zero based on the physical constraint model, and outputs it directly so that the logistics robot stops without overturning.

6. The dual-core VCU redundancy control method for logistics robots according to claim 1, characterized in that, The process of running a mirror control law based on the state variables to solve the pre-deduced control set cycle by cycle includes: The second processing entity receives the flux linkage position, electrical angular velocity, torque feedforward, and the direct-axis current sampling value and quadrature-axis current sampling value of the current control cycle calculated by the first processing entity; Based on the motor body parameters, the first voltage component and the second voltage component required for the motor to achieve the expected torque are determined. The motor body parameters include stator resistance, direct-axis inductance, quadrature-axis inductance and permanent magnet flux linkage. The first voltage component and the second voltage component are inversely transformed by coordinates to generate corresponding three-phase duty cycle parameters, which are used as the pre-deduction control set. The pre-deduction control set is stored in the circular buffer of the second processing entity, and the oldest data frame is overwritten at the end of each control cycle, while keeping the output pin of the second processing entity in an isolated state. The determination of the first voltage component and the second voltage component includes: using the difference between the current sampling value of the current cycle and the current sampling value of the previous control cycle as a differential approximation to determine the time change of the current, and thereby determining the inductor voltage drop component in the voltage component. The voltage component also includes a resistance voltage drop component formed by the stator resistance, a cross-coupling component formed by the electrical angular velocity and the direct-axis inductance and quadrature-axis inductance, and a back electromotive force component formed by the electrical angular velocity and the permanent magnet flux linkage, wherein the back electromotive force component acts only on the second voltage component.

7. The dual-core VCU redundancy control method for logistics robots according to claim 1, characterized in that, The trigger takeover and injection of the pre-deductive control set into the motor driver includes: The arbitration unit flips the selection pin of the channel selector during the clock cycle of detecting the takeover trigger signal. The channel selector is located between the output pin of the second processing entity and the motor driver. During normal operation of the first processing entity, the output channel of the first processing entity is connected to the motor driver, and the output channel of the second processing entity is disconnected. Remove the isolation state configuration of the output pin of the second processing entity; Extract the three-phase duty cycle parameters of the current phase from the circular buffer; Bypassing the control law initialization sequence, the motor driver is directly driven; The takeover trigger signal includes: At least one of the following: the timeout overflow signal of the heartbeat monitoring watchdog of the first processing entity, and the hardware comparator output of the boundary judgment logic of the second processing entity; The arbitration unit is implemented using a hardware entity independent of the first processing entity and the second processing entity, and the hardware entity includes at least one of complex programmable logic devices or field-programmable gate arrays.

8. The dual-core VCU redundancy control method for logistics robots according to claim 7, characterized in that, Following the triggering of the takeover, the process also includes switching the logistics robot to a degraded operation mode: In the second processing entity, a hard-coded degradation control flow is activated. The degradation control flow is pre-stored in the read-only memory of the second processing entity and cannot be modified by upper-level instructions. The maximum speed command of the logistics robot is clamped to the first speed limit constant; the absolute steering angle of the steering mechanism is clamped to the angle limit range; The power supply enable signals for the lifting mechanism and fork mechanism are forcibly shut off by hardware level to lock the current mechanical load posture.

9. The dual-core VCU redundancy control method for logistics robots according to claim 1, characterized in that, The redundancy control method further includes: Monitor the occupancy rate of the receive buffer between the first processing entity and the second processing entity; When an overflow warning occurs in the receive buffer, the memory transfer unit triggers an overflow interrupt and executes a pointer overwrite mechanism. The pointer overwrite mechanism skips and discards low-priority historical frames in the receive buffer, including load status historical frames. Extract the highest priority key frame from the receive buffer, the high priority key frame including the latest slip ratio estimate and torque feedforward; The extracted high-priority keyframes are fed into the mirror control law for calculation, so that the delay of the data used by the mirror control law does not exceed one control cycle.

10. A dual-core VCU redundant control system for a logistics robot, characterized in that, The redundant control system includes: processor; The memory stores a computer program that, when executed by a processor, implements the dual-core VCU redundancy control method for logistics robots as described in any one of claims 1 to 9.

Images