A method and system for self-locking control of getting on and off a high-altitude work platform vehicle with multiple safety redundancies

Abstract

This invention discloses a multi-safety-redundant self-locking control method and system for aerial work platforms, including a method for controlling the entry and exit of outriggers. The method includes: after the chassis is in a safe state, collecting signals from outrigger limit switches and hydraulic pressure. The limit switches employ redundant verification with normally open and normally closed contacts. Different contact levels are detected, and a valid displacement signal is generated when the normally open contact is triggered. If the levels are consistent, the switch is considered faulty. The measured outrigger hydraulic pressure is compared with a set threshold, and cross-physical principle verification is performed using the displacement signal to determine the reliability of the outrigger support. Once all outriggers are properly supported, entry and operation can begin. When the boom position reaches the deployment threshold, the outriggers and chassis travel mechanism are locked. After operation, the boom returns to its original position and remains stationary without further operation, restoring the ability to exit the platform. The system issues graded alarms based on various sensor anomalies, restricting aerial work as needed. This provides reliable technical support for the safety of aerial work platform operations.

Description

Technical Field

[0001] This invention belongs to the field of automation control technology, and more specifically, relates to a self-locking control method and system for getting on and off an aerial work platform vehicle with multiple safety redundancies. Background Technology

[0002] Current technologies generally rely solely on mechanical limit switches mounted on the outriggers as the sole basis for judgment. However, the working environment of aerial work platforms is harsh, and the contacts of the limit switches are highly susceptible to poor contact, signal loss, or false triggering due to oxidation, corrosion, vibration, or foreign object jamming. If a limit switch fails, the controller will always assume that the outrigger is not under load, thus incorrectly prohibiting the operation of the boom on the vehicle; conversely, if the switch is stuck in the closed position, it may misjudge that the outrigger is supported even when it is not actually under load, allowing the boom to extend and causing a serious accident such as the entire vehicle overturning.

[0003] Some existing technologies use pressure sensors installed at the outrigger cylinders to indirectly determine whether the outrigger is under force. However, pressure sensors themselves suffer from zero-point drift, temperature drift, and nonlinearity errors. Furthermore, their analog output signals are susceptible to strong electromagnetic interference from engine ignition systems and hydraulic pump station motors during long-distance transmission, leading to distorted measurements. In addition, the hydraulic system may have internal leaks or poor pressure holding, causing pressure readings to fail to accurately reflect the contact force between the outrigger and the ground. Therefore, relying solely on pressure sensors cannot guarantee the absolute reliability of interlock detection.

[0004] In existing technical solutions, limit switches and pressure sensors are often used as alternatives to "OR" logic, or although they are installed simultaneously, they are not deeply integrated or cross-validated. The two detection methods are based on completely different physical principles and should be redundant and mutually reinforcing. However, existing technologies fail to utilize this characteristic to identify the failure modes of a single sensor, resulting in a low overall safety integrity level of the system, which cannot meet higher standards of functional safety requirements.

[0005] Currently, most aerial work platform truck interlocking systems only achieve one-way control, meaning "the boom operation is prohibited when the outriggers are not under load." However, when the boom is already extended and in working condition, the system often does not automatically lock all operating permissions for the operator. The operator may accidentally activate the outrigger extension / retraction switch or the gantry movement handle due to negligence or misoperation. If the boom is under load at a height, the sudden retraction of the outriggers or movement of the chassis will directly cause instability of the vehicle's center of gravity, resulting in catastrophic consequences such as boom breakage or vehicle overturning. Existing technology lacks a complete self-locking logic for "working on-board → locking off-board." Summary of the Invention

[0006] This invention aims to solve the problems of low reliability in outrigger status detection and insufficient interlock protection for getting on and off the vehicle in existing aerial work platforms. By using dual-contact redundant verification of limit switches and cross-physical verification of displacement and hydraulic pressure to determine the outrigger support condition, it achieves linkage self-locking control between getting on and off the vehicle. Supplemented by graded fault alarms, multiple redundancies ensure the stability of vehicle operation and operational safety.

[0007] To address the aforementioned deficiencies or improvement needs of existing technologies, as a first aspect of this invention, the present invention provides a multi-safety-redundant self-locking control method for getting on and off an aerial work platform, comprising:

[0008] S1. When the vehicle chassis is in a preset safety state, the limit switch signals and pressure sensor signals of each outrigger are collected in real time; the limit switch is equipped with normally open contacts and normally closed contacts; the limit switch signals are internally redundantly checked to determine whether the level states of the normally open contacts and normally closed contacts are different; if they are different and the normally open contacts are in the triggered state, the mechanical displacement detection of the outrigger is determined to be normal and a valid displacement signal is generated; if the two states are the same, the limit switch is determined to be faulty and a switch fault signal is generated.

[0009] S2. Extract the pressure detection value of each outrigger's hydraulic circuit and compare the pressure detection value with a preset pressure threshold; perform cross-validation between the effective displacement signal and the pressure comparison result across physical principles to determine whether the corresponding outrigger is in a reliable support force state;

[0010] S3. When it is determined that all outriggers are in the reliable support force state, the control lock on the upper vehicle actuator is released, allowing the upper vehicle boom system to deploy; during the deployment of the upper vehicle boom system, the position and posture parameters of the boom are monitored in real time. When the position and posture parameters reach the preset deployment threshold, the lower vehicle locking logic is triggered, forcibly cutting off the control output permissions of the lower vehicle outrigger system and the chassis driving system, and completing the safety self-locking of the upper vehicle operation on the lower vehicle operation;

[0011] S4. After the operation is completed, continuously monitor the position and posture parameters of the upper boom system. When the position and posture parameters recover to the preset retraction threshold range and there is no upper boom action command for a preset time, release the lower boom locking logic and restore the lower boom operation permission. At the same time, during the execution process, according to the switch fault signal, single channel verification inconsistency or sensor value abnormality, trigger the corresponding level of fault diagnosis and alarm response to restrict or prohibit the corresponding high-altitude operation actions.

[0012] Furthermore, in S1, the specific conditions for determining that the vehicle chassis is in a preset safe state include: the chassis speed is zero, the transmission is in neutral, the parking brake has been applied, and the power take-off unit is engaged.

[0013] The limit switch is installed above the oblique elongated hole at the hinge point of the outrigger tilting cylinder, and a fixed pin is inserted into the oblique elongated hole. When the outrigger is subjected to force, the fixed pin generates an oblique upward mechanical displacement along the oblique elongated hole and triggers the limit switch. The stroke of the oblique elongated hole is set to 15~20mm.

[0014] Furthermore, in step S1, before the limit switch signal undergoes internal redundancy verification, the level signals of the normally open and normally closed contacts are subjected to anti-jitter filtering.

[0015] The anti-shake filtering process specifically involves: employing a state machine management mechanism, when a change in the level state of the normally open or normally closed contact is detected, a software delay timer of a preset duration is started; if the level state remains stable within the preset duration, the change is confirmed to be valid and the contact state is updated; if the level state changes again within the preset duration, it is determined to be an interference glitch and the signal is discarded.

[0016] Furthermore, in step S2, the effective displacement signal and the pressure comparison result are cross-validated based on physical principles, specifically including:

[0017] The first derivative of the pressure detection value is calculated in real time to obtain the pressure change rate, and the transition time when the normally open contact of the limit switch changes from open to closed, as well as the time when the pressure detection value first reaches the preset pressure threshold, are recorded.

[0018] Calculate the time difference between the jump moment and the target moment, and combine it with the preset physical stroke of the oblique elongated hole at the hinge point of the outrigger tilting cylinder to calculate the average response speed of the outrigger mechanical displacement.

[0019] The time difference, the pressure change rate, and the average response speed are input into a preset support state determination function for joint verification. The support confidence score is then calculated using the support state determination function.

[0020] Simultaneously, the current position and posture parameters of the upper boom system are obtained, the real-time offset of the vehicle's center of gravity is calculated based on the current position and posture parameters, and a confidence threshold for the current working condition is dynamically generated based on the real-time offset through a preset mapping relationship; the larger the real-time offset, the higher the confidence threshold.

[0021] The support confidence score is compared with the confidence judgment threshold: when the support confidence score is greater than or equal to the confidence judgment threshold, the rigid reliable support stress state signal is output; when the support confidence score is less than the confidence judgment threshold, the unreliable stress state signal is output, and the corresponding fault tracing prompt is output according to the negative contribution of each input variable to the support confidence score.

[0022] Furthermore, the support state determination function specifically includes:

[0023] The input time difference, pressure change rate, and average response speed are dimensionless and mapped to a preset standard feature range to eliminate differences in physical dimensions.

[0024] Extract the pressure increment during the establishment of the outrigger support action, and take the preset physical stroke of the oblique elongated hole as the maximum mechanical displacement. Calculate the ratio of the pressure increment to the maximum mechanical displacement, and define it as the equivalent support stiffness of the outrigger under the current working condition.

[0025] The dimensionless time difference, pressure change rate, average response speed, and equivalent support stiffness are used as input variables, multiplied by their respective dynamic weighting coefficients, and then linearly weighted and summed. A Sigmoid activation function is introduced for nonlinear mapping, and the output is a support confidence score with a value between 0 and 1. The dynamic weighting coefficients of the equivalent support stiffness and the pressure change rate are configured to be greater than the dynamic weighting coefficient of the time difference.

[0026] Furthermore, the calculation process for the confidence threshold specifically includes:

[0027] The current position and posture parameters of the upper boom system are obtained, including the extension length, luffing angle and slewing angle of each boom section; combined with the preset vehicle mass distribution matrix, the projection coordinates of the center of gravity of the upper part in the chassis coordinate system are calculated, and combined with the chassis self-weight center, the real-time offset of the center of gravity of the vehicle is calculated, including the longitudinal offset and the lateral offset.

[0028] Obtain the current span parameters of each outrigger and construct the actual support polygon formed by connecting the grounding points of the four outriggers; based on the longitudinal and lateral offsets, calculate the shortest vertical distance from the projection point of the vehicle's center of gravity to each boundary line segment of the actual support polygon and define it as the stability margin distance under the current working condition.

[0029] A piecewise nonlinear threshold mapping model based on stability margin distance is constructed: a basic safety threshold and a critical safety distance are set; when the stability margin distance is greater than the critical safety distance, the confidence judgment threshold is set to the basic safety threshold; when the stability margin distance is less than or equal to the critical safety distance, the inverse function of the exponential decay function is introduced, so that the confidence judgment threshold increases nonlinearly as the stability margin distance decreases.

[0030] The current motion speed parameters of the upper boom system are obtained, including the amplitude angular velocity and the slewing angular velocity; the dynamic load impact coefficient is calculated based on the motion speed parameters, and the dynamic load impact coefficient is used to positively correct the nonlinearly increasing threshold to obtain the final confidence judgment threshold; wherein, the larger the motion speed parameters are, the larger the dynamic load impact coefficient is.

[0031] Furthermore, in S3, the pose parameters of the boom include the boom luffing angle and the boom extension length;

[0032] The preset deployment threshold is: the boom luffing angle is greater than 2°, or the boom extension length is greater than 0.3m;

[0033] The triggering of the exit locking logic forcibly cuts off the control output permissions of the exit outrigger system and the chassis driving system. Specifically, the vehicle controller switches the exit control state machine to the "upper vehicle working mode" and outputs a low level to the enable pins of the exit outrigger solenoid valve and the chassis driving solenoid valve, physically cutting off their control circuits.

[0034] Furthermore, in S4, the corresponding level of fault diagnosis and alarm response is triggered, specifically including a three-level fault classification strategy:

[0035] First-level fatal fault: When it is determined that the level states of the normally open contact and the normally closed contact are the same, or the pressure detection value exceeds the maximum range of the sensor, all vehicle actions are immediately prohibited and the system is locked, and the corresponding fault code is output.

[0036] Level 2 serious fault: When the limit switch is in the triggered state but the pressure detection value is less than the preset pressure threshold, or the pressure detection value is greater than or equal to the preset pressure threshold but the limit switch is not triggered, the vehicle operation is prohibited, and the specific reason for the failure of the single sensor is output.

[0037] Level 3 warning fault: When the pressure detection value is in the edge range of 1.8MPa to 2.0MPa, on-board operation is allowed, but a warning message prompting to check the stress status of the outriggers is output through the human-machine interface.

[0038] As a second aspect of the present invention, a multi-safety-redundant self-locking control system for getting on and off an aerial work platform is also provided, comprising:

[0039] The signal acquisition and redundancy verification unit is used to acquire limit switch signals and pressure sensor signals of each outrigger in real time when the vehicle chassis is in a preset safety state. The limit switch is equipped with normally open contacts and normally closed contacts. The unit performs internal redundancy verification on the limit switch signals to determine whether the level states of the normally open contacts and normally closed contacts are different. If they are different and the normally open contact is in the triggered state, the mechanical displacement detection of the outrigger is determined to be normal and a valid displacement signal is generated. If the two states are the same, the limit switch is determined to be faulty and a switch fault signal is generated.

[0040] The cross-principle support state verification unit is used to extract the pressure detection value of each outrigger hydraulic circuit and compare the pressure detection value with a preset pressure threshold; the effective displacement signal and the pressure comparison result are cross-verified across physical principles to determine whether the corresponding outrigger is in a reliable support stress state.

[0041] The self-locking unit for dismounting during upper-vehicle operation is used to release the control lock on the upper-vehicle actuator when it is determined that all outriggers are in the reliable support force state, allowing the upper-vehicle boom system to deploy. During the deployment of the upper-vehicle boom system, the position and posture parameters of the boom are monitored in real time. When the position and posture parameters reach the preset deployment threshold, the dismounting locking logic is triggered, forcibly cutting off the control output permissions of the dismounting outrigger system and the chassis driving system, thus completing the safety self-locking of the dismounting operation during upper-vehicle operation.

[0042] The permission restoration and fault diagnosis unit is used to continuously monitor the position and posture parameters of the upper boom system after the operation is completed. When the position and posture parameters are restored to the preset retraction threshold range and there is no upper boom action command for a preset time, the dismounting locking logic is released and the dismounting operation permission is restored. At the same time, during the execution process, according to the switch fault signal, single channel verification inconsistency or sensor value abnormality, the corresponding level of fault diagnosis and alarm response is triggered to restrict or prohibit the corresponding high-altitude operation actions.

[0043] As a third aspect of the invention, a computer-readable storage medium is also provided, on which a computer program is stored, which is executed by a processor, according to any one of the claims, a multi-safety-redundancy self-locking control method for getting on and off an aerial work platform.

[0044] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects:

[0045] 1. The aerial work platform vehicle of the present invention employs a multi-safety-redundant self-locking control method for getting on and off the vehicle. This method utilizes normally open and normally closed contacts on the outrigger limit switches to perform internal signal redundancy verification. Signal acquisition is initiated only after the chassis meets the safety conditions of zero speed, neutral gear, parking brake application, and PTO engagement. The control system first performs anti-jitter filtering on the two contact level signals to eliminate instantaneous level jumps caused by environmental interference. Then, it compares the two sets of contact level states. If the level states are different and the normally open contact outputs a valid displacement signal, and the levels remain consistent, the limit switch is determined to be faulty, and a corresponding fault signal is generated. This detection method relies on the switch's own dual-contact structure for self-testing, enabling timely identification of short-circuit and open-circuit faults. It eliminates the problem of not being able to detect abnormalities after a single signal failure, ensuring the accuracy and reliability of the outrigger mechanical displacement acquisition results. By establishing safety redundancy conditions from the signal acquisition source, it provides a displacement data source for subsequent cross-verification of the outrigger's stress state, avoiding misjudgments of the outrigger support state caused by erroneous displacement data.

[0046] 2. The multi-safety redundancy self-locking control method for aerial work platforms of the present invention extracts the measured pressure values ​​of the hydraulic circuits of each outrigger and compares them with preset pressure thresholds. It then performs cross-validation across physical principles using the effective displacement signals and pressure comparison results after redundancy verification. The algorithm calculates the outrigger support confidence based on the pressure change rate, the time difference between the switch and hydraulic pressure triggering, the outrigger mechanical response speed, and the equivalent support stiffness. Simultaneously, it calculates the vehicle's center of gravity offset by combining the real-time boom posture parameters. The confidence threshold is dynamically adjusted based on the vehicle's stability margin, relying on mutual verification from detection data based on two different principles: mechanical displacement and hydraulic pressure. Compared to methods relying solely on switches or hydraulic pressure, cross-validation avoids misjudgments of outrigger force caused by the failure of a single sensor. The dynamic threshold can match the vehicle's stability requirements under different boom extension conditions, objectively determining whether a single outrigger provides reliable support, thus serving as a preliminary judgment basis for unlocking the boarding mechanism.

[0047] 3. The multi-safety redundancy self-locking control method for aerial work platforms of the present invention, through setting up interlocking control logic for both loading and unloading and a three-level fault classification and handling rule, releases the locking of the loading mechanism after all outriggers have been verified as reliable supports. When the boom position exceeds the preset deployment parameters, the control output between the unloading outriggers and the chassis driving system is directly cut off. After the boom is retracted to the specified range and there are no operation commands for a period of time, the unloading lock is removed and the unloading operation permission is restored. During operation, various abnormal information such as switch failures and sensor data anomalies are collected, and corresponding control measures are implemented according to the fault level. Level 1 faults directly lock all loading actions, level 2 faults restrict the operation of the loading mechanism, and level 3 critical hydraulic pressure faults only provide interface reminders. The dynamic constraints on loading and unloading permissions can prevent the risk of instability caused by misoperation of the chassis during loading operations. The graded fault handling differentiates the control of equipment actions according to the magnitude of the fault impact, and reasonably retains the available equipment permissions under the premise of ensuring operational safety. Attached Figure Description

[0048] Figure 1 This is a flowchart of a self-locking control method for getting on and off an aerial work platform with multiple safety redundancies, according to an embodiment of the present invention.

[0049] Figure 2 This is a schematic diagram of a 3D digital model of a vehicle according to an embodiment of the present invention;

[0050] Figure 3 This is a schematic diagram of the system units in an embodiment of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0052] Example 1

[0053] Please refer to Figure 1 This embodiment 1 provides a multi-safety-redundant self-locking control method for getting on and off an aerial work platform, including:

[0054] S1. When the vehicle chassis is in a preset safety state, the limit switch signals and pressure sensor signals of each outrigger are collected in real time; the limit switch is equipped with normally open contacts and normally closed contacts; the limit switch signals are internally redundantly checked to determine whether the level states of the normally open contacts and normally closed contacts are different; if they are different and the normally open contacts are in the triggered state, the mechanical displacement detection of the outrigger is determined to be normal and a valid displacement signal is generated; if the two states are the same, the limit switch is determined to be faulty and a switch fault signal is generated.

[0055] S2. Extract the pressure detection value of each outrigger's hydraulic circuit and compare the pressure detection value with a preset pressure threshold; perform cross-validation between the effective displacement signal and the pressure comparison result across physical principles to determine whether the corresponding outrigger is in a reliable support force state;

[0056] S3. When it is determined that all outriggers are in the reliable support force state, the control lock on the upper vehicle actuator is released, allowing the upper vehicle boom system to deploy; during the deployment of the upper vehicle boom system, the position and posture parameters of the boom are monitored in real time. When the position and posture parameters reach the preset deployment threshold, the lower vehicle locking logic is triggered, forcibly cutting off the control output permissions of the lower vehicle outrigger system and the chassis driving system, and completing the safety self-locking of the upper vehicle operation on the lower vehicle operation;

[0057] S4. After the operation is completed, continuously monitor the position and posture parameters of the upper boom system. When the position and posture parameters recover to the preset retraction threshold range and there is no upper boom action command for a preset time, release the lower boom locking logic and restore the lower boom operation permission. At the same time, during the execution process, according to the switch fault signal, single channel verification inconsistency or sensor value abnormality, trigger the corresponding level of fault diagnosis and alarm response to restrict or prohibit the corresponding high-altitude operation actions.

[0058] Please refer to Figure 2 This embodiment 1 further elaborates on the above steps.

[0059] (1) Signal acquisition and redundancy check

[0060] The control system collects chassis operating parameters in real time via the vehicle's CAN bus or hard-wired interface. The chassis is determined to be in a preset safe state only when the chassis speed sensor reports zero, the transmission gear position sensor reports neutral, the parking brake switch reports being applied, and the power take-off (PTO) engagement switch reports being engaged. In this safe state, the outrigger support status detection module is activated, and it begins real-time synchronous acquisition of limit switch signals and pressure sensor signals from each outrigger.

[0061] The mechanical displacement detection of the outriggers relies on a specific mechanical structure and sensor arrangement. The limit switch, equipped with normally open and normally closed contacts, is specifically installed above an obliquely elongated hole at the hinge point of the outrigger tilting cylinder. A fixing pin passes through this obliquely elongated hole. The axial travel of the obliquely elongated hole is machined and set to 15 to 20 millimeters. When the outriggers extend and contact the ground to bear the weight of the entire vehicle, the outrigger structure undergoes elastic deformation, causing the fixing pin to undergo an obliquely upward mechanical displacement along the obliquely elongated hole. When the displacement reaches the trigger threshold of the limit switch, the mechanical contact of the limit switch is pressed down, thereby converting the force state of the outriggers into an electrical signal.

[0062] After acquiring the original electrical signal from the limit switch, the level signals of the normally open and normally closed contacts are subjected to anti-jitter filtering to eliminate mechanical jitter and electromagnetic interference. This process is implemented using a state machine management mechanism. The input levels of the normally open and normally closed contacts are continuously monitored. When a change in the level state of either contact is detected, the state machine immediately starts a software delay timer of a preset duration. If the level state of the contact remains stable and unchanged during the timer's countdown, the change is confirmed as valid after the timer overflows, and the contact state in the internal register is updated. If the level state of the contact changes again during the timer's countdown, this signal change is determined to be an interference glitch or mechanical bounce. The timer is immediately reset, and the change signal is discarded, maintaining the original contact state.

[0063] After completing the anti-shake filtering, internal redundancy verification is performed on the limit switch signal. Since the limit switch has physically linked normally open and normally closed contacts, their voltage levels are necessarily different during normal operation. The filtered voltage levels of the normally open and normally closed contacts are read and compared logically. If the voltage levels are determined to be different (e.g., the normally open contact is high and the normally closed contact is low), and the normally open contact is confirmed to be in a triggered state, then the mechanical displacement detection of the outrigger is considered normal, and a valid displacement signal is generated. If the comparison finds that the voltage levels are the same (i.e., both normally open and normally closed contacts are high or both are low), then the limit switch is considered to have a physical failure such as contact adhesion, open circuit, or short circuit. A switch fault signal is then generated, and the support status confirmation process for that outrigger is blocked. Simultaneously, pressure sensor signals from the hydraulic circuits of each outrigger are continuously collected, and the verified valid displacement signal is output together with the pressure sensor signal.

[0064] (2) Cross-principle support state verification

[0065] In this embodiment, for any one of the outriggers configured on the aerial work platform (denoted as the first outrigger) (Each outrigger) During the establishment of the undercarriage support action, the controller extracts the pressure detection value of the hydraulic circuit of the outrigger in real time. and the pressure detection value With preset pressure threshold A comparison is performed. Simultaneously, the effective displacement signal of the outrigger is acquired. To determine the first Whether each outrigger is in a reliable stress-bearing state, the effective displacement signal will be used. With the pressure detection value The comparison results are then cross-validated across physical principles. In the initial feature extraction stage of the cross-validation, the pressure detection value is first calculated in real time. Regarding time The first derivative is used to obtain the rate of change of pressure. The calculation formula is as follows:

[0066]

[0067] Simultaneously, record the transition moment when the normally open contact of the outrigger limit switch changes from open to closed. and the pressure detection value The preset pressure threshold is reached for the first time. The moment of achievement Based on these two timestamps, the transition time is calculated. With the time of achievement Time difference between The calculation formula is:

[0068]

[0069] Subsequently, the preset physical stroke of the oblique elongated hole at the hinge point of the outrigger tilting cylinder is obtained. And in conjunction with the time difference Calculate the average response speed of the outrigger's mechanical displacement. The calculation formula is as follows:

[0070]

[0071] After completing the initial feature extraction, the time difference value The pressure change rate and the average response speed Input the preset support state determination function Perform joint verification. In the support state determination function... Internally, the three physical quantities mentioned above are first made dimensionless. A minimum reasonable boundary for the time difference is then set. With the maximum reasonable boundary Calculate the dimensionless time difference :

[0072]

[0073] Similarly, a minimum reasonable boundary is set for the rate of pressure change. With the maximum reasonable boundary and the minimum reasonable boundary of average response speed. With the maximum reasonable boundary The dimensionless pressure change rate was calculated separately. and dimensionless average response speed Next, extract the first... The pressure increment during the establishment of a leg support movement. and the preset physical stroke of the oblique elongated hole The pressure increment is calculated as the maximum mechanical displacement. With the preset physical travel The ratio of the two values ​​is defined as the equivalent support stiffness of the outrigger under the current working conditions. The calculation formula is:

[0074]

[0075] Subsequently, the dimensionless time difference value The dimensionless pressure change rate The dimensionless average response speed and the equivalent support stiffness As input variables, each variable is multiplied by its corresponding dynamic weight coefficient, then linearly weighted and summed. A sigmoid activation function is then introduced for non-linear mapping, and the output is a support confidence score ranging from 0 to 1. Its core calculation formula is:

[0076]

[0077] in, This is the time difference weighting coefficient. The pressure change rate weighting coefficient, The average response speed weighting coefficient. For equivalent support stiffness weighting coefficient, These are the bias parameters for the Sigmoid function. In the parameter configuration, the equivalent support stiffness weighting coefficient... and the pressure change rate weighting coefficient Configured to be greater than the time difference weighting coefficient .

[0078] While calculating the support confidence score, the logic for generating a dynamic threshold is executed in parallel. First, the current pose parameters of the upper boom system are obtained, specifically including the first... Extension length of the articulated arm Amplitude angle and overall rotation angle Combined with the preset vehicle mass distribution matrix Calculate the projected coordinates of the center of gravity of the upper part in the chassis coordinate system. Let the first... The mass of the boom is Its local centroid in its own coordinate system has the following vertical coordinate: Then the longitudinal projection coordinates of the center of gravity of the upper part in the chassis coordinate system are... The calculation formula is:

[0079]

[0080] Similarly, the lateral projection coordinates can be calculated. Combined with the chassis's center of gravity coordinates Total chassis mass The real-time offset of the vehicle's center of gravity is calculated, specifically including the longitudinal offset. and lateral offset The calculation formula is:

[0081]

[0082]

[0083] in, This refers to the total mass of the loaded portion. The coordinates are the geometric center coordinates of the chassis.

[0084] Based on the real-time offset, the current span parameters of each outrigger are further obtained, and the actual support polygon formed by connecting the grounding points of the four outriggers is constructed. Let the actual supporting polygon be... A certain boundary line segment is defined by its endpoints. and endpoints Composition, the projection point of the vehicle's center of gravity is Constructing vectors with vector Calculate the projection point of the vehicle's center of gravity. The shortest perpendicular distance to the boundary segment The calculation formula is:

[0085]

[0086] Traverse the actual supporting polygon Take the minimum value among all boundary line segments and define it as the stability margin distance under the current operating condition. Subsequently, a stability margin distance is constructed. Piecewise nonlinear threshold mapping model: setting a basic safety threshold and critical safety distance When the stability margin distance Greater than the critical safety distance At that time, the initial confidence level threshold will be determined. Set as the basic security threshold When the stability margin distance Less than or equal to the critical safety distance Then, the inverse function of the exponential decay function is introduced to calculate the preliminary confidence threshold. :

[0087]

[0088] in, This is a non-linear growth adjustment coefficient.

[0089] To compensate for the risks associated with dynamic operations, the current motion speed parameters of the upper boom system are obtained, including the amplitude angular velocity. and rotational angular velocity Based on the current motion speed parameters, calculate the dynamic load impact coefficient. The calculation formula is:

[0090]

[0091] in, The amplitude speed influence coefficient, This is the rotational speed influence coefficient. Utilizing the aforementioned dynamic load impact coefficient... The initial confidence threshold A positive correction is performed to obtain the final confidence threshold. The calculation formula is:

[0092]

[0093] In the final decision-making stage, the calculated support confidence score will be used. The dynamically generated confidence threshold Compare the support confidence scores. Greater than or equal to the confidence threshold At that time, output a rigid and reliable support force state signal. When the support confidence score Less than the confidence threshold When this occurs, an unreliable force-bearing state signal is output. At the same time, it outputs corresponding fault tracing prompts. It is necessary to calculate the support confidence score for each input variable. The negative contribution of the equivalent support stiffness. For example, its negative contribution The calculation formula is:

[0094]

[0095] in, This represents the standard value of the equivalent support stiffness under ideal rigid support conditions. Similarly, the negative contribution of the time difference can be calculated. Negative contribution of pressure change rate and the negative contribution of average response speed The variable corresponding to the maximum value among the four negative contributions is selected as the signal that triggers the unreliable stress state. The core source of the fault is identified, and a corresponding fault tracing prompt is generated. .

[0096] (3) Self-locking when getting off the vehicle while working on the vehicle.

[0097] After completing the cross-principle support status verification, when it is determined that all outriggers are in the reliable support stress state, the control lock on the upper vehicle actuator is released. The upper vehicle control state machine inside the vehicle controller switches from "locked state" to "standby state" or "operating mode". The controller then sends an enable signal to the proportional solenoid valve drive module that controls each action of the upper vehicle boom system, unlocking the input permission of the operating handle or remote control. At this time, the upper vehicle action commands issued by the operator can be normally received and parsed by the controller, converted into corresponding PWM control signals and output to the corresponding proportional solenoid valves, thereby allowing the upper vehicle boom system to start operation.

[0098] During the deployment of the boom system, the control system monitors the boom's position and attitude parameters in real time using a sensor array mounted on the boom. These parameters primarily include the boom luffing angle and the boom extension length. The boom luffing angle is acquired by a tilt sensor mounted on the side of the main boom. The controller reads the analog voltage or digital signal output from the tilt sensor at a preset sampling period and calculates the actual luffing angle value using a tilt compensation algorithm. The boom extension length is acquired by a wire-type displacement sensor or a magnetostrictive displacement sensor installed inside the telescopic boom. The controller reads the feedback signal from the displacement sensor and converts it into the actual extension length value.

[0099] After acquiring the real-time boom luffing angle and boom extension length, the controller continuously compares them logically with preset deployment thresholds. The preset deployment thresholds are specifically set as either a boom luffing angle greater than 2° or a boom extension length greater than 0.3m. This judgment logic uses an "OR" operation mechanism; that is, if either the boom luffing angle exceeds 2° or the boom extension length exceeds 0.3m, the controller determines that the boom has left the safe retracted state and immediately triggers the dismount locking logic.

[0100] Upon triggering the disembarkation locking logic, the vehicle controller forcibly switches the disembarkation control state machine to "boarding operation mode" at the software level. In this mode, the controller blocks all outrigger action commands and chassis driving commands from the disembarkation operation panel. At the hardware execution level, the controller outputs a low-level signal to the enable pins of the disembarkation outrigger solenoid valve and the chassis driving solenoid valve. This low-level signal turns off the power switch in the solenoid valve drive circuit, thereby physically cutting off the power supply to the solenoid valve control circuit. Even if the disembarkation operation switch is accidentally pressed or a short circuit occurs, because the enable pin is at a low level and the control circuit is physically cut off, neither the disembarkation outrigger system nor the chassis driving system can produce any action, thus completing the safety self-locking of the disembarkation operation by the boarding operation.

[0101] (4) Permission recovery and fault diagnosis

[0102] In this embodiment, the permission restoration process after the operation ends relies on continuous monitoring of the boom system's position and posture parameters. The control system collects the boom luffing angle and boom extension length in real time using tilt and displacement sensors. When the boom luffing angle is detected to be less than or equal to 2° and the boom extension length is detected to be less than or equal to 0.3m, it is determined that the boom position and posture parameters have been restored to the preset retraction threshold range. At this time, the command monitoring module inside the control system begins to monitor the input bus of the operating handle or remote control. If no valid loading action command is detected within the preset time window, it is confirmed that the loading operation has completely stopped, satisfying the precondition for releasing the dismounting lock logic.

[0103] Once the above conditions are met, the vehicle controller performs the restoration of disembarkation operation permissions. At the software level, the controller switches the disembarkation control state machine from "onboard working mode" back to "disembarkation control mode," reactivating the instruction parsing channel of the disembarkation operation panel. At the hardware level, the controller restores the output high level to the enable pins of the disembarkation outrigger solenoid valve and chassis travel solenoid valve, re-energizing the power switches in the solenoid valve drive circuit and restoring the physical power supply to their control loops. At this point, the control output permissions of the disembarkation outrigger system and chassis travel system are fully restored, and the operator can continue to perform outrigger retraction or vehicle travel operations.

[0104] Throughout the entire operation cycle, the fault diagnosis module runs in parallel in the background, triggering corresponding levels of fault diagnosis and alarm responses based on collected switch fault signals, single-channel calibration inconsistencies, or abnormal sensor values. When the normally open and normally closed contacts of a limit switch are found to have the same voltage level, or when the pressure sensor's detected pressure value exceeds its calibrated maximum range, a first-level fatal fault response is triggered. The controller immediately cuts off the PWM control signal output of all upper and lower proportional solenoid valves, forcibly locks all actuators in the system, writes the corresponding fatal fault code and its timestamp to non-volatile memory, and displays a red shutdown alarm message through the human-machine interface.

[0105] When a single channel calibration inconsistency is detected, a Level 2 critical fault response is triggered. This includes two physical scenarios: first, the limit switch is triggered but the pressure detection value is less than the preset pressure threshold, which typically indicates zero-point drift of the pressure sensor or internal leakage in the oil circuit; second, the pressure detection value is greater than or equal to the preset pressure threshold but the limit switch is not triggered, which typically indicates mechanical jamming of the limit switch or deformation of the oblique elongated hole structure. For Level 2 critical faults, the controller prohibits all upper boom movements, locks the upper boom control state machine, and outputs the specific cause of the single sensor failure and troubleshooting suggestions on the human-machine interface to prevent forced operation under unreliable support conditions.

[0106] When the detected pressure value falls within the borderline range of 1.8MPa to 2.0MPa, a Level 3 warning fault response is triggered. This range is defined as the critical transition zone of the outrigger's stress state, indicating that the outrigger has made contact with the ground but has not yet reached a fully rigid and reliable support state. In this state, the controller does not relinquish control authority, allowing the operator to continue performing onboard fine-tuning or offboard outrigger pressurization operations. Simultaneously, the controller sends a warning message to the human-machine interface via the CAN bus. The interface displays a warning message in a highlighted yellow pop-up window prompting the operator to check the outrigger's stress state, accompanied by intermittent short beeps, reminding the operator to pay attention to the outrigger's grounding and confirm that the support pads are laid flat.

[0107] Example 2

[0108] Please refer to Figure 3 This embodiment 2 provides a multi-safety-redundant self-locking control system for getting on and off an aerial work platform, including:

[0109] The signal acquisition and redundancy verification unit is used to acquire limit switch signals and pressure sensor signals of each outrigger in real time when the vehicle chassis is in a preset safety state. The limit switch is equipped with normally open contacts and normally closed contacts. The unit performs internal redundancy verification on the limit switch signals to determine whether the level states of the normally open contacts and normally closed contacts are different. If they are different and the normally open contact is in the triggered state, the mechanical displacement detection of the outrigger is determined to be normal and a valid displacement signal is generated. If the two states are the same, the limit switch is determined to be faulty and a switch fault signal is generated.

[0110] The cross-principle support state verification unit is used to extract the pressure detection value of each outrigger hydraulic circuit and compare the pressure detection value with a preset pressure threshold; the effective displacement signal and the pressure comparison result are cross-verified across physical principles to determine whether the corresponding outrigger is in a reliable support stress state.

[0111] The self-locking unit for dismounting during upper-vehicle operation is used to release the control lock on the upper-vehicle actuator when it is determined that all outriggers are in the reliable support force state, allowing the upper-vehicle boom system to deploy. During the deployment of the upper-vehicle boom system, the position and posture parameters of the boom are monitored in real time. When the position and posture parameters reach the preset deployment threshold, the dismounting locking logic is triggered, forcibly cutting off the control output permissions of the dismounting outrigger system and the chassis driving system, thus completing the safety self-locking of the dismounting operation during upper-vehicle operation.

[0112] The permission restoration and fault diagnosis unit is used to continuously monitor the position and posture parameters of the upper boom system after the operation is completed. When the position and posture parameters are restored to the preset retraction threshold range and there is no upper boom action command for a preset time, the dismounting locking logic is released and the dismounting operation permission is restored. At the same time, during the execution process, according to the switch fault signal, single channel verification inconsistency or sensor value abnormality, the corresponding level of fault diagnosis and alarm response is triggered to restrict or prohibit the corresponding high-altitude operation actions.

[0113] Example 3

[0114] This embodiment 3 also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement any step of a multi-safety-redundant self-locking control method for getting on and off an aerial work platform.

[0115] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0116] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0117] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A self-locking control method for getting on and off an aerial work platform vehicle with multiple safety redundancies, characterized in that, include: S1. When the vehicle chassis is in a preset safety state, the limit switch signals and pressure sensor signals of each outrigger are collected in real time; the limit switch is equipped with normally open contacts and normally closed contacts; the limit switch signals are internally redundantly checked to determine whether the level states of the normally open contacts and normally closed contacts are different; if they are different and the normally open contacts are in the triggered state, the mechanical displacement detection of the outrigger is determined to be normal and a valid displacement signal is generated; If both states are the same, the limit switch is determined to be faulty and a switch fault signal is generated. S2. Extract the pressure detection values ​​of each outrigger's hydraulic circuit and compare the pressure detection values ​​with a preset pressure threshold; The effective displacement signal and the pressure comparison result are cross-validated across physical principles to determine whether the corresponding outrigger is in a reliable support stress state. S3. When it is determined that all outriggers are in the reliable support force state, the control lock on the upper vehicle actuator is released, allowing the upper vehicle boom system to deploy; during the deployment of the upper vehicle boom system, the position and posture parameters of the boom are monitored in real time. When the position and posture parameters reach the preset deployment threshold, the lower vehicle locking logic is triggered, forcibly cutting off the control output permissions of the lower vehicle outrigger system and the chassis driving system, and completing the safety self-locking of the upper vehicle operation on the lower vehicle operation; S4. After the operation is completed, continuously monitor the position and posture parameters of the upper boom system. When the position and posture parameters recover to the preset retraction threshold range and there is no upper boom action command for a preset time, release the lower boom locking logic and restore the lower boom operation permission. At the same time, during the execution process, according to the switch fault signal, single channel verification inconsistency or sensor value abnormality, trigger the corresponding level of fault diagnosis and alarm response to restrict or prohibit the corresponding high-altitude operation actions.

2. The method for multi-safety-redundant self-locking control of aerial work platforms for getting on and off, as described in claim 1, is characterized in that, In S1, the specific conditions for determining that the vehicle chassis is in a preset safe state include: the chassis speed is zero, the transmission is in neutral, the parking brake has been applied, and the power take-off unit is engaged. The limit switch is installed above the oblique elongated hole at the hinge point of the outrigger tilting cylinder, and a fixed pin is inserted into the oblique elongated hole. When the outrigger is subjected to force, the fixed pin generates an oblique upward mechanical displacement along the oblique elongated hole and triggers the limit switch. The stroke of the oblique elongated hole is set to 15~20mm.

3. The method for multi-safety redundancy self-locking control of a high-altitude work vehicle for getting on and off, as described in claim 1, is characterized in that... In step S1, before the limit switch signal undergoes internal redundancy verification, the level signals of the normally open contact and normally closed contact are subjected to anti-jitter filtering. The anti-shake filtering process specifically involves: employing a state machine management mechanism, when a change in the level state of the normally open or normally closed contact is detected, a software delay timer of a preset duration is started; if the level state remains stable within the preset duration, the change is confirmed to be valid and the contact state is updated; if the level state changes again within the preset duration, it is determined to be an interference glitch and the signal is discarded.

4. The method for multi-safety-redundant self-locking control of aerial work platforms for getting on and off, as described in claim 1, is characterized in that... In step S2, the effective displacement signal and the pressure comparison result are cross-validated across physical principles, specifically including: The first derivative of the pressure detection value is calculated in real time to obtain the pressure change rate, and the transition time when the normally open contact of the limit switch changes from open to closed, as well as the time when the pressure detection value first reaches the preset pressure threshold, are recorded. Calculate the time difference between the jump moment and the target moment, and combine it with the preset physical stroke of the oblique elongated hole at the hinge point of the outrigger tilting cylinder to calculate the average response speed of the outrigger mechanical displacement. The time difference, the pressure change rate, and the average response speed are input into a preset support state determination function for joint verification. The support confidence score is then calculated using the support state determination function. Simultaneously, the current position and posture parameters of the upper boom system are obtained, the real-time offset of the vehicle's center of gravity is calculated based on the current position and posture parameters, and a confidence threshold for the current working condition is dynamically generated based on the real-time offset through a preset mapping relationship; the larger the real-time offset, the higher the confidence threshold. The support confidence score is compared with the confidence judgment threshold: when the support confidence score is greater than or equal to the confidence judgment threshold, the rigid reliable support stress state signal is output; when the support confidence score is less than the confidence judgment threshold, the unreliable stress state signal is output, and the corresponding fault tracing prompt is output according to the negative contribution of each input variable to the support confidence score.

5. The method for multi-safety redundancy self-locking control of an aerial work platform vehicle for getting on and off, as described in claim 4, is characterized in that... The support state determination function specifically includes: The input time difference, pressure change rate, and average response speed are dimensionless and mapped to a preset standard feature range to eliminate differences in physical dimensions. Extract the pressure increment during the establishment of the outrigger support action, and take the preset physical stroke of the oblique elongated hole as the maximum mechanical displacement. Calculate the ratio of the pressure increment to the maximum mechanical displacement, and define it as the equivalent support stiffness of the outrigger under the current working condition. The dimensionless time difference, pressure change rate, average response speed, and equivalent support stiffness are used as input variables, multiplied by their respective dynamic weighting coefficients, and then linearly weighted and summed. A Sigmoid activation function is introduced for nonlinear mapping, and the output is a support confidence score with a value between 0 and 1. The dynamic weighting coefficients of the equivalent support stiffness and the pressure change rate are configured to be greater than the dynamic weighting coefficient of the time difference.

6. The method for multi-safety-redundant self-locking control of a high-altitude work vehicle for getting on and off, as described in claim 4, is characterized in that... The calculation process of the confidence threshold specifically includes: The current position and posture parameters of the upper boom system are obtained, including the extension length, luffing angle and slewing angle of each boom section; combined with the preset vehicle mass distribution matrix, the projection coordinates of the center of gravity of the upper part in the chassis coordinate system are calculated, and combined with the chassis self-weight center, the real-time offset of the center of gravity of the vehicle is calculated, including the longitudinal offset and the lateral offset. Obtain the current span parameters of each outrigger and construct the actual support polygon formed by connecting the grounding points of the four outriggers; based on the longitudinal and lateral offsets, calculate the shortest vertical distance from the projection point of the vehicle's center of gravity to each boundary line segment of the actual support polygon and define it as the stability margin distance under the current working condition. A piecewise nonlinear threshold mapping model based on stability margin distance is constructed: a basic safety threshold and a critical safety distance are set; when the stability margin distance is greater than the critical safety distance, the confidence judgment threshold is set to the basic safety threshold; when the stability margin distance is less than or equal to the critical safety distance, the inverse function of the exponential decay function is introduced, so that the confidence judgment threshold increases nonlinearly as the stability margin distance decreases. The current motion speed parameters of the upper boom system are obtained, including the amplitude angular velocity and the slewing angular velocity; the dynamic load impact coefficient is calculated based on the motion speed parameters, and the dynamic load impact coefficient is used to positively correct the nonlinearly increasing threshold to obtain the final confidence judgment threshold; wherein, the larger the motion speed parameters are, the larger the dynamic load impact coefficient is.

7. The method for multi-safety-redundant self-locking control of aerial work platforms for getting on and off, as described in claim 1, is characterized in that... In S3, the boom's pose parameters include the boom luffing angle and the boom extension length. The preset deployment threshold is: the boom luffing angle is greater than 2°, or the boom extension length is greater than 0.3m; The triggering of the exit locking logic forcibly cuts off the control output permissions of the exit outrigger system and the chassis driving system. Specifically, the vehicle controller switches the exit control state machine to "onboard working mode" and outputs a low level to the enable pins of the exit outrigger solenoid valve and the chassis driving solenoid valve, physically cutting off their control circuits.

8. The method for multi-safety-redundant self-locking control of a high-altitude work vehicle for getting on and off, as described in claim 1, is characterized in that, In S4, the corresponding level of fault diagnosis and alarm response is triggered, specifically including a three-level fault classification strategy: First-level fatal fault: When it is determined that the level states of the normally open contact and the normally closed contact are the same, or the pressure detection value exceeds the maximum range of the sensor, all vehicle actions are immediately prohibited and the system is locked, and the corresponding fault code is output. Level 2 serious fault: When the limit switch is in the triggered state but the pressure detection value is less than the preset pressure threshold, or the pressure detection value is greater than or equal to the preset pressure threshold but the limit switch is not triggered, the vehicle operation is prohibited, and the specific reason for the failure of the single sensor is output. Level 3 warning fault: When the pressure detection value is in the edge range of 1.8MPa to 2.0MPa, on-board operation is allowed, but a warning message prompting to check the stress status of the outriggers is output through the human-machine interface.

9. A multi-safety-redundant self-locking control system for getting on and off an aerial work platform, characterized in that, include: The signal acquisition and redundancy verification unit is used to acquire limit switch signals and pressure sensor signals of each outrigger in real time when the vehicle chassis is in a preset safety state. The limit switch is equipped with normally open contacts and normally closed contacts. The limit switch signals are internally redundant verified to determine whether the level states of the normally open contacts and normally closed contacts are different. If they are different and the normally open contacts are in the triggered state, the mechanical displacement detection of the outrigger is determined to be normal and a valid displacement signal is generated. If both states are the same, the limit switch is determined to be faulty and a switch fault signal is generated. A cross-principle support status verification unit is used to extract the pressure detection value of each outrigger hydraulic circuit and compare the pressure detection value with a preset pressure threshold. The effective displacement signal and the pressure comparison result are cross-validated across physical principles to determine whether the corresponding outrigger is in a reliable support stress state. The self-locking unit for dismounting during upper-mounted operation is used to release the control lock on the upper-mounted actuator when it is determined that all outriggers are in the reliable support force state, allowing the upper-mounted boom system to deploy for operation; During the deployment of the upper boom system, the position and posture parameters of the boom are monitored in real time. When the position and posture parameters reach the preset deployment threshold, the lowering locking logic is triggered, and the control output permissions of the lowering outrigger system and the chassis driving system are forcibly cut off, thus completing the safety self-locking of the uppering operation on the lowering operation. The permission restoration and fault diagnosis unit is used to continuously monitor the position and posture parameters of the upper boom system after the operation is completed. When the position and posture parameters are restored to the preset retraction threshold range and there is no upper boom action command for a preset time, the dismounting locking logic is released and the dismounting operation permission is restored. At the same time, during the execution process, according to the switch fault signal, single channel verification inconsistency or sensor value abnormality, the corresponding level of fault diagnosis and alarm response is triggered to restrict or prohibit the corresponding high-altitude operation actions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is executed by the processor as described in any one of claims 1-8: a multi-safety-redundant self-locking control method for getting on and off an aerial work platform.

Images