Electric compressor energy speed mapping residual error safety control method and controller

Abstract

The application discloses a kind of electric compressor energy speed mapping residual error safety control method and controller.Controlled to the output stage to be verified, reextract reference bus voltage, reference input power and reference speed and reset cumulative incremental electric energy, select the reference mapping corridor corresponding to compressor configuration, reference state and the stage to be verified;Cumulative positive incremental electric energy is paired with the normalized speed increment after the delay of corresponding sampling time, and the mapping residual error is determined according to its relative corridor position.Stopping output when hard failure;When mapping anomaly, reduce the upper limit of output, and migrate according to the rule that stopping is prior to single backoff;After limited output stabilizes, continuous recovery verification is carried out using independent recovery verification corridor, and the verified lower stage is locked or output is stopped when recovery upper limit is reached.The application is used to identify the combined deviation of input energy and mechanical response.

Description

Technical Field

[0001] This invention relates to a safety control method and controller for energy-speed mapping residuals in electric compressors, specifically a safety control method and controller applicable to electric compressor systems with obtainable input power, actual speed, and controllable speed commands. During the target speed increase and abnormal recovery processes, the method establishes a time-paired joint mapping of the output stage, reference operating state, accumulated incremental energy, and their delayed speed response, and performs stage verification, amplitude limiting, single rollback, recovery verification, and stopping based on the mapping residuals. Background Technology

[0002] The electric compressor in the air conditioning system of new energy vehicles is usually powered by a high-voltage DC bus and operates according to the target speed given by the vehicle's thermal management controller. Different compressors differ in rated voltage, rated power, moment of inertia, internal drive strategy, and mechanical load characteristics. The acceleration response of the same compressor also varies under different bus voltages, initial speeds, and initial input power.

[0003] Existing control methods typically set fixed upper limits or protection thresholds based on target speed, bus voltage, current, temperature, and fault location. When overcurrent, overvoltage, undervoltage, overtemperature, or communication faults reach the corresponding threshold, the controller derated or shuts down. Fixed thresholds can handle fully developed faults, but they are insufficient at recognizing mismatches between input energy and mechanical response before the protection threshold is triggered.

[0004] For example, the target speed has increased and the input power continues to increase, but the actual speed increment of the compressor is significantly insufficient; or, the actual speed feedback shows an abnormal jump while the incremental input power is insufficient. Simply comparing the current, power, or speed with a fixed range makes it difficult to determine whether this state is due to normal load changes, transient delays, abnormal feedback, or insufficient mechanical response.

[0005] Calculating current deviation and speed deviation separately and then weighting them may combine extreme values ​​occurring at different times, or allow a smaller deviation to cancel out another deviation with a clear causal relationship. If the input energy accumulation process in the same stage is not directly paired with the delayed speed response, the so-called multi-parameter judgment may still be an independent threshold comparison.

[0006] Furthermore, the current-speed relationship of an electric compressor is affected by the bus voltage, the speed before command switching, and the input power. If the same fixed mapping is used for all initial states, misjudgments are likely to occur under high load or low voltage conditions; if the calibration is entirely based on experience, it is difficult to explain the formation and updating method of the mapping boundary.

[0007] Therefore, a safety control scheme is needed for the target speed increase process of electric compressors. In each independent response observation window, the baseline is re-extracted and the cumulative incremental energy is reset. The cumulative incremental energy formed at the same power sampling moment is directly paired with the speed response after the delay at that moment. The reference mapping corridor is selected according to the compressor configuration, baseline operating state and output stage to be verified. At the same time, the stage switching corridor and the recovery verification corridor need to be separately calibrated, and a clear number of times or time limit is set for recovery failure, so as to avoid sharing fixed mapping, recovery loop without final state and abnormal branch instruction conflict. Summary of the Invention

[0008] The technical problem to be solved by this invention is: how to identify the joint deviation between input energy and mechanical response without using a refrigerant pressure sensor as a necessary input, through independent window reference reset, time pairing of accumulated positive incremental electrical energy and delayed normalized speed increment, reference mapping corridor bound to the reference state and the stage to be verified, and independent recovery verification corridor, and establish unambiguous state priority rules among abnormal limit, single backoff, recovery verification and determined safe final state. Technical solution

[0009] To address the aforementioned technical problems, this invention provides a method for energy-speed mapping residual safety control of an electric compressor, executed by a controller connected to the electric compressor. The overall process is as follows: Figure 1 As shown. The output phase includes multiple phases that open sequentially; in this specification, the phase that is running stably before the phase switch is called the source output phase, the stop state, standby state, or preset start-up baseline state before the lowest output phase switch is called the source baseline state, and the phase pointed to by the phase switch command and verified within the current response observation window is called the output phase to be verified. Each new operating cycle begins only when there are no unresolved hard fault states or soft anomaly latched states, and verification starts from the lowest output phase.

[0010] Each output stage is associated with the target rotational speed increment, recovery verification rotational speed increment, response delay time, response observation time, effective excitation energy threshold, stage verification threshold, stage anomaly threshold, recovery threshold, number of consecutive abnormal samples M_bad,i, number of direction mismatch samples M_dir,i, number of consecutive verification samples M_good,i, minimum number of effective samples, minimum energy increment, minimum rotational speed response increment, positive normalization scale K_i, number of backoff triggers N_back, number of stops N_stop, number of recovery windows N_recover, maximum number of recovery attempts N_try, maximum recovery duration T_recover,max, preset stabilization time, rotational speed stabilization threshold, input power stabilization threshold, stage switching reference mapping corridor, and recovery verification reference mapping corridor. Where 0 ≤ recovery threshold ≤ stage verification threshold < stage anomaly threshold ≤ 1, N_stop > N_back ≥ 1, N_try is a positive integer, and T_recover,max is greater than zero.

[0011] The stage switching reference mapping corridor is associated with the electric compressor configuration identifier, the reference state category, and the output stage to be verified; the recovery verification reference mapping corridor is associated with the electric compressor configuration identifier, the reference state category, the current restricted output stage, and the recovery verification speed increment category. The recovery verification speed increment category is determined by the preset interval in which the recovery verification speed increment is located. The reference state category is jointly determined by the intervals in which the reference bus voltage, reference input power, and reference speed are located before the start of the corresponding window.

[0012] During normal phased verification, the controller determines the highest permissible output phase based on the target speed, electric compressor configuration identifier, and current operating limitations. Before the response observation window for the lowest output phase begins, U0,i, P0,i, and n0,i are determined within an independent reference time window after the source reference state meets the preset stability condition. Before the response observation window for the remaining output phases begins, U0,i, P0,i, and n0,i are determined within an independent reference time window after the source output phase meets the preset stability condition. Subsequently, the accumulated incremental energy is reset, and a phase switching reference mapping corridor corresponding to the output phase to be verified and the current reference state category is selected. The preset stability condition is: within a preset stability time, the difference between the maximum and minimum values ​​of the effective samples of actual speed does not exceed the speed stability threshold, and the difference between the maximum and minimum values ​​of the effective samples of input power does not exceed the input power stability threshold.

[0013] For the lowest output stage, the controller uses the stop state, standby state, or preset start reference state as the source reference state and issues a start stage command from the source reference state to the lowest output stage. For other output stages, the controller issues a stage switching command from the adjacent lower source output stage to the output stage to be verified. From the moment the command is issued, the current response observation window is formed according to the response observation time. The stage index of the stage switching reference mapping corridor is always the output stage to be verified, not the source output stage before the switch.

[0014] Within the current response observation window, the controller acquires the bus voltage U_dc, bus current I_dc, and actual rotational speed n. Based on U_dc and I_dc, it determines the input power P, and accumulates the positive increment of the input power relative to P0,i over time to obtain Q_i(k). For the k-th effective power sampling time t_k, the actual rotational speed sample corresponding to time t_k+T_d,i is selected, and the increment of this rotational speed relative to n0,i is divided by the target rotational speed increment of this window to obtain S_i(k). Window classification is performed after the required delay when all rotational speed samples are available.

[0015] Each response observation window independently determines the baseline and resets Q_i(k) to zero. The controller pairs Q_i(k) with the corresponding delayed S_i(k) to form a time-paired response pair, without directly carrying over the accumulated energy, baseline power, or baseline speed from the previous window to the next window.

[0016] The selected reference mapping corridor has a valid Q range and has a lower and upper boundary at any valid Q that satisfies S_i^-(Q)≤S_i^+(Q). The mapping residual is determined when Q_i(k) is within the valid Q range; when Q_i(k) is outside the valid Q range, the current output stage can be maintained or only the nearest valid Q endpoint can be used for anomaly detection, but no stage verification pass conclusion is formed, nor is a stage verification pass conclusion formed through unconstrained extrapolation.

[0017] When the mapping residuals of M_bad,i consecutive time-paired response pairs all reach the stage anomaly threshold, or when, after Q_i(k) reaches the effective excitation energy threshold, the increase in adjacent cumulative incremental energy of M_dir,i response pairs reaches the minimum energy increment, while the increase in adjacent normalized speed increment does not reach the minimum speed response increment, the controller determines the current response observation window as an abnormal response window. The determination of an abnormal response window takes precedence over the determination of other windows.

[0018] Under normal stage-by-stage verification conditions, the current response observation window is determined to be a stage verification pass window only when Q_i(k) is within the effective Q range and reaches the effective excitation energy threshold, the number of effective time-paired response pairs reaches the minimum effective sample number, the consecutive M_good,i residuals are not higher than the stage verification threshold, and the sampling and speed feedback are effective and there are no hard faults. Other windows that do not meet the abnormal conditions and verification pass conditions are determined to be stage hold windows. Recovered verification windows must not be classified as ordinary stage verification pass windows.

[0019] The hard fault path is independent of the mapping residual determination. When communication is interrupted, the electric compressor fault feedback is set, or existing hardware protection such as overcurrent, overvoltage, undervoltage, or overtemperature is triggered, the controller directly stops the current output.

[0020] In the stage verification pass window, the controller records the output stage to be verified and its corresponding baseline status category. When the output stage to be verified is lower than the highest output stage allowed to be opened in this operating cycle, the next stage is opened sequentially; when the output stage to be verified has reached the highest output stage, the current stage is maintained.

[0021] During the stage hold window, the controller maintains the current stage and does not open the next stage, and the stage hold window does not increment C_bad. When neither the target speed nor the current operating limit changes, a new stage verification response observation window is not automatically generated; when the target speed or the current operating limit changes and triggers a new stage verification request, the baseline state is re-extracted, Qi(k) is reset, and the corresponding stage switching reference mapping corridor is selected to generate a new response observation window.

[0022] In the exception response window, the controller first lowers the current allowed output limit. In implementations that reduce the allowed output change slope, a new allowed output limit not exceeding the output level before the exception occurred is set to avoid simply lowering the slope while still reaching the original high output target. Then, C_bad is incremented, and an exception event cycle is established starting from the first exception response window. State transitions are performed in the order of stopping taking precedence over single rollbacks.

[0023] When the updated C_bad reaches the stop count N_stop, the controller directly stops the current output, sets a soft exception latch state, and disables automatic upgrades, without performing a rollback. The soft exception latch state is written to a non-volatile storage area or a power-off retained storage area when set; the controller reads the soft exception latch state upon power-on, and disables startup or automatic upgrades until it is cleared. The soft exception latch state is not automatically cleared by new startup requests, power-on, or the expiration of a waiting time; it is only cleared by maintenance personnel through a maintenance reset command after completing fault checks or maintenance.

[0024] When C_bad has not yet reached N_stop, C_bad has reached the rollback trigger count N_back, the current stage is higher than the lowest output stage, the rollback has not been executed in this abnormal event cycle, and there exists a recently verified output stage that matches the current baseline state category and is located before the current stage, the controller rolls back to that verified output stage and sets the single rollback flag. The rollback action does not clear C_bad.

[0025] Only one rollback is allowed within the same abnormal event cycle. After the single rollback flag is set, even if C_bad continues to increase but has not yet reached N_stop, the controller will maintain the stage after the rollback or the current derating stage and will no longer rollback continuously step by step. During the abnormal event cycle, the upgrade and zeroing operations based on the normal stage verification pass window will not be performed, and the final state will be guaranteed by the stop threshold, the safe final state when the minimum effective recovery verification speed increment cannot be applied, the maximum number of recovery attempts, or the maximum recovery duration.

[0026] After the output phase following a rollback or after the limited output meets the preset stability conditions, the controller enters the recovery observation phase and records the target speed corresponding to the stable state as the recovery reference target speed. Upon first entering the recovery observation phase, the recovery count and recovery attempt count are initialized to zero, and the recovery phase duration timer is started. If the limit is re-executed or the rollback is reversed due to an abnormal recovery window and the recovery observation phase is re-entered, the recovery attempt count and recovery phase duration timer are retained, and the recovery count is cleared. For each recovery verification response observation window, U0,i, P0,i, and n0,i are redefined, and Q_i(k) is reset so that the sum of the recovery reference target speed and the recovery verification speed increment does not exceed the current allowable output limit, and the corresponding recovery verification reference mapping corridor is selected. The recovery count increases only when the window simultaneously meets the effective excitation energy threshold, the effective sample count requirement, M_good,i consecutive residuals not exceeding the recovery threshold, sampling and feedback are effective, there is no hard fault state, and no abnormal response window is formed; the recovery count is cleared when all recovery qualification conditions are not met. After a recovery window without an abnormal response is completed, the recovery attempt count is incremented once, the target speed is restored to the recovery baseline target speed, and the system waits until the preset stability condition is met again before starting the next independent recovery window. If the current allowed output limit is insufficient to apply the minimum effective recovery verification speed increment, no new recovery verification response observation window will be formed, or invalid recovery attempts will be repeated. If there is no hard fault and a matching verified lower stage exists, the system will lock at the most recently verified lower stage and disable automatic escalation; otherwise, output will stop, and a soft exception latch will be set. When an abnormal response is formed in a recovery window, the recovery count is cleared, the recovery attempt count is not incremented, and the recovery to the recovery baseline target speed before the start of the window is not executed. Instead, the abnormal handling steps of reducing the allowed output limit are returned, and C_bad is incremented once according to the counting rules of the abnormal response window. Then, the stop priority over single rollback state judgment is re-executed. After N_recover recovery verification windows are successful, the abnormal event cycle ends, C_bad, the single rollback flag, the recovery count, and the recovery attempt count are cleared, the recovery phase duration is stopped and cleared, and the automatic escalation prohibition state corresponding to this abnormal event cycle is lifted. The duration of the recovery phase is calculated continuously from the first entry into the recovery observation phase and the start of the timer until the recovery is completed or the safe final state is entered. When N_try or T_recover,max is reached, if there is no hard fault and there is a matching verified lower phase, the most recently verified lower phase is locked; otherwise, the output is stopped and a soft exception latch is set.

[0027] This invention also provides a safety controller 100, including a processor 120, a memory 130, a bus voltage acquisition interface 111, a bus current acquisition interface 112, a speed feedback interface 113, a fault status interface 114, and a control output interface 140. The memory 130 stores the control program executed by the processor 120, the stage switching reference mapping corridor, the recovery verification reference mapping corridor, the index of the stage to be verified, window classification parameters, the recovery attempt limit, and the soft anomaly latch state; the soft anomaly latch state is stored in a non-volatile memory area or a power-down retained memory area. The processor 120 performs the same independent baseline reset, time pairing, effective Q range constraint, anomaly priority classification, stage recording and upgrading after successful stage verification, state clearing after successful recovery, and safe migration after recovery timeout as described above. Beneficial effects

[0028] Compared to setting thresholds solely based on current, power, or rotational speed, this invention re-extracts the baseline and resets the cumulative incremental energy in each independent response observation window. It then pairs the cumulative positive incremental energy formed at each power sampling moment with the normalized rotational speed increment delayed at that moment to form a time-paired response pair, thereby preserving the temporal correspondence between the input energy accumulation process and the mechanical response.

[0029] Compared with zero-delay pairing, instantaneous power-speed threshold, or weighting the extreme values ​​of windows at different times, this invention makes the normal time pairing responses within the same baseline state category more concentrated by offline formation of candidate response delay time, parameter selection, and independent acceptance, and avoids incorrect combination of energy and speed deviations at different times.

[0030] This invention selects a stage switching reference mapping corridor based on the reference bus voltage, reference input power, reference speed, and the output stage to be verified. Within the preset ambient temperature, load, and bus voltage coverage range, an independent acceptance group not involved in parameter selection is used to accept the frozen reference corridor, so that different initial states do not have to share a single fixed mapping.

[0031] This invention separates the stage switching reference mapping corridor from the recovery verification reference mapping corridor; when the recovery window generates an abnormal response, it does not perform recovery to the original recovery reference target speed, but instead prioritizes re-limiting, stopping, or reverting; when the upper limit of the number of recovery attempts or the duration is reached, it enters a determined safe final state, thereby avoiding the recovery loop having no final state and conflicting abnormal branch instructions.

[0032] This invention uses only the phase verification under normal phase-by-phase verification state to perform bounded updates on the phase switching reference mapping corridor through windows, while limiting the single offset and the cumulative offset relative to the frozen baseline corridor; windows with anomalies, recovery, insufficient samples, and those that have reached the recovery limit do not participate in the update, thereby reducing the risk of abnormal data pollution and long-term drift. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating the overall safety control method of the present invention. Figure 2 This is a structural block diagram of the safety controller of the present invention; Figure 3 A schematic diagram of the relationship between the reference mapping corridor, time-paired response points, mapping residuals, and window classification; Figure 4 This is a state transition diagram for phase verification, anomaly handling, and recovery from timeout. Figure 5 This serves as a reference for the flowchart of the mapping corridor formation, parameter selection, independent acceptance, and bounded update.

[0034] 100—Safety Controller; 110—Acquisition and Feedback Interface Group; 111—Bus Voltage Acquisition Interface; 112—Bus Current Acquisition Interface; 113—Speed ​​Feedback Interface; 114—Fault Status Interface; 120—Processor; 121—Reference State Extraction Module; 122—Reference Mapping Corridor Selection Module; 123—Time Pairing Response Pair Generation Module; 124—Mapping Residual and Window Classification Module; 125—Abnormal Event State Machine Module; 126—Recovery Verification Module; 127—Record Management Module ; 130—Memory; 131—Control Configuration Area; 132—Reference Mapping Corridor Area; 133—Verified Stage Record Area; 134—Current Operation Status Area; 140—Control Output Interface; 200—High Voltage Bus and Power Circuit; 300—Electric Compressor; 301—Stage and Baseline Status Input; 302—Time Pairing Response Pair Generation; 303—Reference Mapping Corridor; 304—Time Pairing Response Point; 305—Boundary Distance; 306—Mapping Residual; 307—Window Classification Determination. The present invention will be further described below with reference to the accompanying drawings and embodiments. The embodiments described are for explaining the present invention and are not intended to limit the scope of protection. Detailed Implementation

[0035] In this manual, the configuration identifier for the electric compressor can be formed by the compressor model, rated bus voltage, rated power, rated speed range, drive method, communication interface type, and their combinations. This method is applicable to electric compressors for new energy vehicles that can obtain input power, actual speed, and controllable speed commands, and can also be applied to other electric compressor systems that possess the above signals and control conditions. like Figure 1 As shown, S101 receives a start request; S102 determines whether the target speed required by the start request is higher than the current speed, and simultaneously checks whether there is an unresolved hard fault state or soft abnormal latch state; only when the target speed is higher than the current speed and there is no such fault or latch state does it proceed to S103, otherwise it maintains the current state or prohibits start. S103 initializes the C_bad, single rollback flag and normal stage control state used in this operation, sets the minimum output stage, and determines the maximum output stage allowed to be opened in this operation cycle. S104 ensures that the source reference state composed of the stop state, standby state or preset start reference state meets the preset stability condition when verifying the minimum output stage, and ensures that the source output stage meets the preset stability condition when verifying the other output stages; then, U0,i, P0,i and n0,i are extracted in the independent reference time window, the reference state category is determined and Q_i(k) is reset.

[0036] Figure 1 S105 selects the stage switching reference mapping corridor based on the configuration identifier, baseline state category, and output stage to be verified; S106 issues a stage switching command and forms a normal stage verification response observation window; S107 collects bus voltage, bus current, actual speed, and fault status; S108 detects hard faults. If a hard fault exists, S109 bypasses the window classification and immediately stops the output. If no hard fault exists, S110 forms a Q_i(k) and delayed S_i(k) time pair response pair, and calculates e_i(k) only within the effective Q range according to the stage switching reference mapping corridor.

[0037] Figure 1 S111 performs normal stage window classification and prioritizes the exception response window determination. When stage verification passes, S112 records the output stage to be verified and the corresponding baseline state category, and S113 determines whether to allow opening the next stage; if allowed, S114 opens the next stage and returns to S104; if not allowed or the highest output stage has been reached, the current output stage is maintained. When the stage is maintained, S115 maintains the current output stage and does not open the next stage. The exception response window is entered in S116. Figure 4 The abnormal handling and recovery verification process is shown below; Figure 4 When the recovery is complete, return to S104 to re-establish the independent normal stage verification window, and end the current run when the safe final state is reached.

[0038] like Figure 5As shown, S501 collects normal reference samples with the same configuration identifier as the electric compressor and covering the preset operating conditions, and prepares known abnormal samples under isolated test conditions; S502 divides the samples according to the individual reference compressors, or, if the number of individuals is insufficient, divides the samples according to mutually independent and non-overlapping operating batches, forming non-overlapping corridor formation groups, parameter selection groups, and independent acceptance groups; S503 determines the reference bus voltage range, reference input power range, reference speed range, ambient temperature, refrigerant load, bus voltage coverage range, and corridor type; S504 determines the corridor type, and the stage switching corridor is executed by S505 to switch from the source output stage to the output stage to be verified, and the restoration verification corridor is executed by S506 after the limited output stabilizes by applying the restoration verification speed increment. Figure 5 S507 establishes independent response observation windows, re-extracts the baseline state, resets Q_i(k), and forms Q_i(k) and S_i(k) for multiple candidate response delay times and candidate parameter combinations. S508 uses corridor formation groups to form candidate upper and lower boundaries and effective Q ranges, and calculates the interquartile range of normal S samples in each Q grid interval. The weighted average interquartile range is calculated as the conditional dispersion using the number of effective samples in each interval as the weight. S509 uses parameter selection groups to calculate the false positive rate and detection rate according to the complete response observation window, selecting T_d,i, quantile value, margin, Q grid spacing, decision threshold, and minimum number of samples. The stage switching corridor is indexed by configuration identifier, baseline state category, and output stage to be verified, while the recovery verification corridor is indexed by the current restricted output stage and recovery verification speed increment category.

[0039] Figure 5 S510 uses an independent acceptance group to perform final acceptance on the selected parameters and candidate corridors. The independent acceptance group does not participate in parameter selection or adjustment. S511 judges whether the false positive rate of normal windows, the detection rate of known abnormal windows, and the coverage conditions all meet the preset conditions. If it fails, S512 freezes the acceptance results, returns to the corridor formation group and parameter selection group to adjust the parameters, and supplements or replaces independent compressor individuals or independent operating batches that did not participate in the previous parameter selection and acceptance as new independent acceptance groups. If it passes, S513 forms and locks the frozen reference corridor, and S514 stores the current corridor in online use.

[0040] When a normal window is identified as an abnormal response window, it is considered a false positive; the ratio of the number of false positive windows to the total number of normal windows is the false positive rate. When a known abnormal window is identified as an abnormal response window, it is considered a detected window; the ratio of the number of detected windows to the total number of known abnormal windows is the detection rate. The known insufficient mechanical response window can be formed on the isolation test bench by applying a controllable mechanical load, increasing a preset differential pressure, or limiting the motor output torque. The known feedback abnormal window can be formed by injecting a fixed deviation, step, freeze, or delay through the verification interface. The abnormal label is confirmed by an independent speed measurement device, test bench load measurement results, or a preset abnormal injection record. If independent acceptance fails, the same independent acceptance group will be used again for final acceptance after parameter adjustment.

[0041] If a matching corridor cannot be found during online control, the next output stage will not be opened. When Q_i(k) exceeds the effective Q range, the current output stage can be maintained; or the lower and upper boundaries at the effective Q endpoints closest to Q_i(k) can be used for anomaly monitoring, but no stage verification conclusion will be formed based on this, nor will a verification conclusion be formed through unconstrained extrapolation.

[0042] For each independent response observation window, the cumulative incremental energy is calculated using Q_i(k) = Σ_{j=k0}^{k}max[P(j)-P0,i,0]Δt_j. Here, k0 is the first valid power sample number within the window, P0,i is the reference input power redefined before the start of the window, and Δt_j is the time interval between adjacent valid power samples. Q_i(k) is reset to zero at the start of a new window.

[0043] The normalized speed increment is calculated using S_i(k) = [n(t_k + T_d,i) - n0,i] / Δn_i. Here, Δn_i represents the target speed increment during the normal phase-by-phase verification window and the speed increment during the recovery verification window; t_k is the k-th effective power sampling time for forming Q_i(k), and T_d,i is the response delay time. like Figure 3 As shown, the stage and reference state input 301 provides the output stage and reference state category to be verified to the time-paired response pair generation 302. The verification type is determined by the current control state and corresponds to the selected corridor type. The response observation time is used to limit the power sampling interval. After the response observation time expires, the controller continues to wait for the delayed speed sample corresponding to the last valid power sampling moment in the window, and completes the current window classification after the sample is obtained. Adjacent response observation windows do not overlap and each independently resets the reference and Qi(k).

[0044] A time-paired response pair is generated by generation 302, consisting of Q_i(k) accumulated at the k-th effective power sampling time within the current window, and S_i(k) corresponding to time t_k+T_d,i. This response pair is in Figure 3 The value in the diagram represents the time-paired response point 304. Samples with pairing time errors exceeding the allowable value are not included in the window classification.

[0045] The lower and upper boundaries of the reference mapping corridor 303 at Q_i(k) are denoted as S_i^-(Q_i(k)) and S_i^+(Q_i(k)), respectively. The distance from the time-paired response point 304 to the corresponding corridor boundary is the boundary distance 305. The mapping residual 306 is determined based on the boundary distance and the positive normalization scale K_i, and the mapping residual can be limited to 0 to 1. The positive normalization scale K_i is associated with the electric compressor configuration identifier, output stage, and verification type, and K_i is greater than 0.

[0046] A mapping residual not exceeding the stage verification threshold indicates that the delayed speed increment corresponding to the current input incremental electrical energy is within the reference normal range; a mapping residual reaching the stage anomaly threshold indicates that the energy-speed joint relationship of the paired response pair deviates from the reference range at the same time. 0 ≤ recovery threshold ≤ stage verification threshold < stage anomaly threshold ≤ 1.

[0047] Orientation mismatch is used to identify a state where the input energy increases to a identifiable level, but the mechanical speed response does not reach a preset minimum response level. When Q_i(k)-Q_i(k-1) is not less than the minimum energy increment, and S_i(k)-S_i(k-1) is less than the minimum speed response increment, it is recorded as an orientation mismatch response pair.

[0048] Directional mismatch is only judged after the cumulative incremental electrical energy reaches the effective excitation energy threshold, avoiding misjudgment when the power increment is insufficient to produce a identifiable mechanical response.

[0049] Passing the stage verification also requires that the number of effective response pairs reaches the minimum number of effective samples. If the number of effective samples is insufficient, the cumulative incremental energy is insufficient, or the actual speed feedback is invalid, the current window will not form a verification success conclusion.

[0050] The abnormal response window can be triggered by M_bad,i consecutive residual time-paired response pairs or M_dir,i consecutive directional mismatch time-paired response pairs. M_bad,i and M_dir,i are used to suppress individual noise samples; when the abnormal response window condition is satisfied simultaneously with other window conditions, the window classification decision 307 uses the abnormal response window as the decision result.

[0051] The stage hold window is used to handle situations where transients are insufficient, residuals fall between the stage validation threshold and the stage anomaly threshold, effective stimuli have not yet been reached, effective samples are insufficient, or Q exceeds the effective range. After stage hold, if neither the target speed nor the current operating limits have changed, the current stage is maintained without automatic revalidation; a new response observation window is only established when the target speed or current operating limits change and a new stage validation request is generated. During the recovery observation phase, windows that do not meet all recovery qualification conditions do not result in a normal stage validation pass conclusion. like Figure 4 As shown, S401 represents the normal stage verification or stage hold state, and S402 represents the formation of an abnormal response window. S403 lowers the current allowed output limit; if the speed command change slope is also reduced, an allowed output limit not higher than the output stage before the abnormality occurred is set. S404 increases C_bad and establishes or extends the abnormal event cycle.

[0052] S405 checks if C_bad has reached N_stop; if so, S406 stops the current output, sets a soft exception latch, disables automatic escalation, and stops rollback. If not, S407 checks if the single rollback condition is met; if so, S408 rolls back to the most recently verified lower matching stage, and S409 sets the single rollback flag; if not, S410 maintains the reduced-rate restricted output. Both S408 and S410 proceed to S411 to wait for the rollback or for the restricted output to meet the stability condition.

[0053] S412 records the target rotational speed of the recovery baseline. Upon first entering the recovery observation phase, the recovery count and recovery attempt count are reset to zero, and the recovery phase continuous timing is started; if an exception occurs during the recovery window, and the exception handling is re-executed and the recovery observation phase is entered again, the recovery attempt count and recovery phase continuous timing are retained, and the recovery count is reset to zero. S413 re-extracts the recovery baseline and resets Qi(k).

[0054] S414 determines whether the minimum effective recovery verification speed increment can be applied within the current allowed output limit; if it cannot be applied, S415 will not form a new recovery verification response observation window or repeat invalid recovery attempts, and directly enter the safe final state: if there is no hard fault and there is a matching verified lower stage, then go to S427 to lock at the most recently verified lower stage and set the soft exception latch; otherwise, go to S428 to stop the output and set the soft exception latch; if it can be applied, S416 selects the recovery verification reference mapping corridor and issues the recovery verification speed increment, and S417 forms the recovery verification response observation window.

[0055] S418 prioritizes detecting hard faults. If a hard fault exists, it proceeds to S406 to directly stop the output. If no hard fault exists, S419 determines whether an abnormal response window has been formed. If an abnormal response window is formed, the recovery count is reset to zero, the recovery reference target speed before the start of the window is not restored, the recovery attempt count is not increased, and it returns to S403. S404 then increments C_bad by one. If no abnormal response window is formed, S420 determines whether all recovery qualification conditions are met. If they are met, S421 increments the recovery count; otherwise, S422 resets the recovery count to zero.

[0056] S423 restores the target speed to the recovery reference target speed, waits for the stability condition to be met again, and increments the recovery attempt count by one; S424 determines whether the recovery count has reached N_recover. If it has, S425 clears C_bad, the single rollback flag, the recovery count, and the recovery attempt count, stops and clears the recovery phase duration timer, removes the automatic upgrade prohibition state corresponding to this abnormal event cycle, and returns to normal control; if it has not reached, S426 determines whether the number of recovery attempts has reached N_try or whether the recovery phase duration has reached T_recover,max.

[0057] When the recovery limit is reached in S426, if there is no hard fault and a verified lower output stage matching the current baseline state category exists, then S427 locks the system at the most recently verified lower output stage and sets a soft exception latch; otherwise, S428 stops the output and sets a soft exception latch. If the recovery limit is not reached, the system returns to S413 to form the next independent recovery verification window. The duration of the recovery phase is calculated continuously from the first entry into the recovery observation phase and the start of timing until recovery is completed in S425 or S427 and S428 enter the safe final state. If the minimum effective recovery verification speed increment cannot be applied in S414, the system does not enter the retry loop of S426, but instead directly enters S427 or S428 according to S415.

[0058] The verified phase records from historical operations are not a basis for skipping verification directly during startup. When a new startup request arrives, the current run count is initialized and re-verified from the lowest output phase only if there are no unresolved hard fault states or soft anomaly latch states. Soft anomaly latch states are written to a non-volatile memory area or a power-off retained memory area during setup and are read by the processor upon power-on. This state is not automatically cleared by new startup requests, power-on, or after a preset waiting time; it is only cleared by maintenance personnel through a maintenance reset command after fault inspection or maintenance is completed. like Figure 5As shown in S515 to S520, only normal stage verification windows that are not in the abnormal event cycle recovery phase are allowed to participate in bounded updates; abnormal response windows, hard fault windows, insufficient effective sample windows, invalid speed feedback windows, recovery verification windows, and windows that reach N_try or T_recover,max are not allowed to participate in updates. S515 determines whether the window meets the update eligibility; if it does, S516 uses preset update coefficients to form candidate boundaries, S517 limits the maximum single offset of the candidate boundary relative to the current boundary before the update, and S518 limits the maximum cumulative offset of the candidate boundary relative to the frozen reference corridor.

[0059] Figure 5 S519 checks that the updated upper and lower boundaries must not intersect and the effective Q range must not be expanded; if these conditions are met, S520 saves the updated current corridor; if not, the candidate boundary is truncated to the allowed boundary or the update is abandoned. The frozen baseline corridor remains unchanged during the online update process and is only allowed to be replaced by a newly formed and locked frozen baseline corridor after the new maintenance and recalibration are completed.

[0060] If multiple consecutive bounded updates move in the same direction, a recalibration prompt will appear in the maintenance tool. After the maintenance recalibration is complete, a new frozen reference corridor can be generated and locked; before this recalibration is completed, online updates must not change the original frozen reference corridor. like Figure 2 As shown, the safety controller 100 includes a data acquisition and feedback interface group 110, a processor 120, a memory 130, and a control output interface 140. The data acquisition and feedback interface group 110 includes a bus voltage acquisition interface 111, a bus current acquisition interface 112, a speed feedback interface 113, and a fault status interface 114. The bus voltage acquisition interface 111 can be connected to a high-voltage sampling circuit, and the bus current acquisition interface 112 can be connected to a Hall current sensor, a shunt, or a current data interface provided by the electric compressor 300.

[0061] The speed feedback interface 113 receives the actual speed output by the electric compressor 300 via CAN, LIN, PWM or other communication methods, and can also receive the speed estimate generated by the sensorless estimator inside the electric compressor 300.

[0062] The fault status interface 114 receives the communication status, the fault bit of the electric compressor 300, and the existing hardware protection status such as overcurrent, overvoltage, undervoltage, and overtemperature. After a fault status is triggered, the processor 120 does not wait for a response and the observation period ends.

[0063] The high-voltage bus and power circuit 200 provides high-voltage electrical energy to the electric compressor 300, and inputs the bus voltage sampling signal and bus current sampling signal to the bus voltage acquisition interface 111 and the bus current acquisition interface 112, respectively. The electric compressor 300 inputs the actual speed feedback and fault status to the speed feedback interface 113 and the fault status interface 114, respectively. The acquisition and feedback interface group 110 provides acquisition and feedback data to the processor 120. The processor 120 and the memory 130 can read and write bidirectionally, and the processor 120 sends the target speed, the upper limit of the allowable speed, or the allowable output change slope to the electric compressor 300 through the control output interface 140; the control output interface 140 can also output modulation control quantities to the independent power drive stage.

[0064] This invention does not require refrigerant high-pressure, low-pressure, or temperature sensors as necessary inputs for determining the mapping residual. When additional sensors are available, their data can be used to further subdivide the baseline state category, but without altering the joint mapping relationship between the cumulative incremental electrical energy and the speed increment.

[0065] like Figure 2 As shown, the processor 120 may include a reference state extraction module 121, a reference mapping corridor selection module 122, a time-paired response pair generation module 123, a mapping residual and window classification module 124, an abnormal event state machine module 125, a recovery verification module 126, and a record management module 127. These modules can be implemented by the same processor 120 executing the control program in the memory 130.

[0066] The control configuration area 131 in memory 130 stores the target speed increment, recovery verification speed increment, response delay time, response observation time, effective excitation energy threshold, various residual thresholds, M_bad,i, M_dir,i, M_good,i, minimum effective sample count, minimum energy increment, minimum speed response increment, positive normalization scale K_i, N_back, N_stop, N_recover, N_try, T_recover,max, preset stabilization time, speed stabilization threshold, and input power stabilization threshold. The reference mapping corridor area 132 stores the stage switching reference mapping corridors associated with the configuration identifier, baseline state category, and output stage to be verified, and stores the recovery verification reference mapping corridors associated with the configuration identifier, baseline state category, current restricted output stage, and recovery verification speed increment category; each corridor stores the upper and lower boundary functions, effective Q range, frozen baseline corridor, and the current corridor after online update. The running state area 134 includes at least a non-volatile storage sub-area or a power-down retained storage sub-area for persistent soft anomaly latching states.

[0067] Verified stage recording area 133 stores the currently running, verified output stages to be verified and their corresponding baseline state categories. Current running state area 134 stores C_bad, single rollback flag, recovery count, recovery attempt count, recovery stage duration, most recently verified stage, current baseline state category, automatic upgrade prohibited state, abnormal event cycle state, soft anomaly latch state, and hard fault state; wherein the soft anomaly latch state is written to the non-volatile storage sub-area or the power-down retained storage sub-area when set, the processor 120 reads this state during the power-on initialization phase, and clears it after the maintenance reset command arrives.

[0068] The processor may be an automotive-grade microcontroller, digital signal processor, system-on-a-chip, or other processing unit capable of executing the aforementioned calculation and control programs.

[0069] The following is a configuration example for illustrating the calculation relationship only, and does not represent actual measured performance data. Assume that the target speed increment at a certain stage is 1000 rpm, the reference input power is 800 watts, and the sampling period is 0.1 seconds; at a certain effective sampling moment, the cumulative incremental energy Q is 60 joules, and the normalized speed increment S is 0.42.

[0070] If the reference mapping corridor for this baseline state category and stage has a lower boundary of 0.45 and an upper boundary of 0.65 at Q equal to 60 joules, and a normalized scale K of 0.20, then the mapping residual is (0.45-0.42) / 0.20=0.15. This calculation only illustrates how the residuals of the same QS response pair are formed relative to the corridor.

[0071] The following is a configuration example for illustrating the recovery verification control relationship only; this example does not represent actual performance data. Assuming the recovery baseline target speed after rollback or limited output stabilization is 3000 rpm, the minimum effective recovery verification speed increment is 200 rpm, and the current allowed output limit is 3400 rpm, then the recovery verification target speed is 3200 rpm. Only when no abnormal response occurs within this recovery window will the target speed be restored to 3000 rpm, and a recovery attempt count be incremented. If an abnormal response occurs within the recovery window, the recovery attempt count is not incremented; instead, C_bad is incremented, and the abnormal limiting and stop priority judgment are re-executed. If the current allowed output limit is lower than 3200 rpm and the minimum effective recovery verification speed increment cannot be applied, an invalid small-amplitude recovery window is not formed, and the number of recovery attempts is not consumed through rapid repetition judgment. Instead, the output is locked or stopped directly based on whether a matching verified lower stage exists, and a soft abnormal latch is set.

[0072] The following describes the implementation method for parameter formation and acceptance, and does not represent fictitious measured performance data. Samples are divided according to individual reference compressors, or, if the number of individuals is insufficient, according to independent and non-overlapping operating batches, forming a corridor formation group, a parameter selection group, and an independent acceptance group. Individual compressors or operating batches may not simultaneously enter more than two data groups. For each candidate response delay time and candidate parameter combination, a candidate corridor is formed using the corridor formation group, and the conditional dispersion is calculated. The parameter selection group selects T_d,i, the baseline state interval, quantile, margin, Q-grid spacing, decision threshold, and minimum sample size according to the complete response observation window. The independent acceptance group is only used to perform final acceptance on the selected parameters. The false positive rate is obtained by dividing the number of normal windows judged as abnormal response windows by the total number of normal windows. The detection rate is obtained by dividing the number of known mechanical response insufficiency windows or feedback abnormal windows judged as abnormal response windows by the total number of known abnormal windows. Samples of insufficient mechanical response can be generated by applying a controllable mechanical load, increasing the preset differential pressure, or limiting the motor output torque. Samples of abnormal feedback can be generated by injecting fixed deviations, step jumps, freezing, or delays through the verification interface, and confirmed by independent speed measurement results, bench load measurement results, or preset abnormal injection records. Only when the false judgment rate of the independent acceptance group is not higher than the preset upper limit, the detection rate is not lower than the preset lower limit, and all covered operating conditions pass, is the sample written into the frozen benchmark corridor. If it fails, the acceptance result is frozen, returned to the corridor formation group and parameter selection group for adjustment, and a new independent acceptance group is added or replaced. The original independent acceptance group is not used and the parameters are adjusted again before it is used as the final acceptance group.

[0073] If multiple consecutive response pairs satisfy the condition that the adjacent increment of Q reaches the minimum energy increment, while the adjacent increment of S does not reach the minimum speed response increment, and the effective excitation energy threshold is met, then a direction mismatch response pair is formed, and an abnormal response window can be formed based on the consecutive number of pairs. When an abnormal response is formed in the recovery window, this abnormality determination takes precedence over recovery counting, target speed recovery, and preparation for the next recovery window.

[0074] The above-described embodiments can be combined without conflict. The core of this invention includes: independently extracting the baseline and resetting the cumulative incremental energy for each observation window; pairing the cumulative positive incremental energy with the delayed normalized speed increment at the same sampling time; selecting the stage switching reference mapping corridor according to the configuration identifier, baseline state, and stage to be verified; selecting the independent recovery verification reference mapping corridor according to the restricted output state and recovery increment category; and entering a determined safe final state when the number of abnormal recovery attempts or the time limit is reached.

Claims

1. A method and controller for energy-speed mapping residual safety control of an electric compressor, characterized in that, Executed by a controller connected to the electric compressor, the process includes: dividing the target speed increase process of the electric compressor into at least three sequentially open output stages; defining the stable output stage before stage switching as the source output stage; defining the stop state, standby state, or preset start-up reference state before switching to the lowest output stage as the source reference state; and defining the output stage pointed to by the stage switching command as the output stage to be verified; before the start of each normal stage verification response observation window, ensuring that the source reference state meets the preset stability condition for the lowest output stage, and ensuring that the source output stage meets the preset stability condition for the remaining output stages; and determining the reference bus voltage U0,i, the reference input power P0,i, and the reference... within an independent reference time window. The rotational speed n0,i is determined based on the preset intervals where U0,i, P0,i, and n0,i are located. The cumulative incremental energy Q_i(k) is reset to zero, and a stage switching reference mapping corridor corresponding to the electric compressor configuration identifier, the reference state category, and the output stage to be verified is selected. The stage switching reference mapping corridor has an effective Q range and a lower boundary function S_i^-(Q) and an upper boundary function S_i^+(Q) within the effective Q range. A stage switching command is issued to the output stage to be verified, and a response observation window is formed from the moment the stage switching command is issued. The bus voltage, bus current, and actual rotational speed are collected within the response observation window. Based on the bus voltage and bus current, the actual rotational speed is determined. Given a fixed input power P; for the k-th effective power sampling time t_k, the positive increment of the input power relative to P0,i is accumulated over time to obtain Q_i(k). The actual speed sample corresponding to time t_k plus the response delay time T_d,i is selected, and the increment of this actual speed sample relative to n0,i is divided by the target speed increment Δn_i corresponding to this window to obtain the normalized speed increment S_i(k). Q_i(k) and S_i(k) form a time-paired response pair. When Q_i(k) is within the effective Q range of the selected stage switching reference mapping corridor, the mapping residual e_i(k) is determined according to the position of S_i(k) relative to S_i^-(Q_i(k)) and S_i^+(Q_i(k)). When Q_i(k) exceeds the effective Q range, no stage verification conclusion is formed; before window classification, hard fault states are detected. When communication interruption, electric compressor fault feedback setting, or existing hardware protection is triggered, window classification is bypassed and the current output is stopped immediately; in the absence of hard fault states, when the mapping residuals of M_bad,i consecutive time-paired response pairs all reach the stage abnormal threshold, or when Q_i(k) reaches the effective excitation energy threshold, M_dir,i consecutive time-paired response pairs satisfy that the increase in adjacent cumulative incremental energy is not less than the minimum energy increment and the increase in adjacent normalized speed increment is less than the minimum speed response increment, the current response observation window is determined to be an abnormal response window;The current response observation window is determined to be a stage verification pass window only when Q_i(k) is within the effective Q range and reaches the effective excitation energy threshold, the number of effective time-paired response pairs reaches the minimum effective sample number, the consecutive M_good,i mapping residuals are not higher than the stage verification threshold, the bus sampling and actual speed feedback are effective, and the current stage is not in the abnormal event recovery stage. Window that does not meet the abnormal response window condition and the stage verification pass window condition is determined to be a stage hold window, with the abnormal response window determination taking priority. The output stage to be verified and its baseline state category are recorded in the stage verification pass window, and the next output stage is opened before the highest allowed output stage is reached. The current output is held in the stage hold window. The system will not open the next output stage; in the exception response window, the current allowed output limit will be reduced, the exception window counter C_bad will be increased, and an exception event cycle will be established or extended, wherein the number of stops N_stop is greater than the number of rollback triggers N_back; when C_bad reaches N_stop, the current output will be stopped and the soft exception latch flag will be set; when C_bad does not reach N_stop but reaches N_back, the current output stage is higher than the lowest output stage, the single rollback flag is not set and there is a recently verified lower output stage that matches the current baseline state category, rollback will be performed to the recently verified lower output stage and the single rollback flag will be set. Only one rollback is allowed in the same exception event cycle. After the output phase following the rollback or after the limited output meets the preset stability condition, the recovery observation phase begins. The target rotational speed corresponding to the stable state is recorded as the recovery reference target rotational speed. Upon first entering the recovery observation phase, the recovery count and recovery attempt count are initialized to zero, and the recovery phase continuous timing is started. If an abnormal response is generated in the recovery verification response observation window, the process returns to the abnormal handling phase and re-enters the recovery observation phase. The recovery attempt count and recovery phase continuous timing are retained, and the recovery count is cleared to zero. For each recovery verification response observation window, U0,i, P0,i, and n0,i are redefined, and Q_i(k) is reset. Under the condition that the current allowed output limit is not exceeded, a recovery verification rotational speed is applied relative to the recovery reference target rotational speed. The incremental value is determined based on the preset interval where the incremental recovery verification speed is located. A recovery verification reference mapping corridor corresponding to the electric compressor configuration identifier, the current reference state category, the current restricted output stage, and the incremental recovery verification speed category is selected. The mapping residual is determined according to the same time pairing method as the normal stage verification. A recovery verification response observation window is counted as a recovery qualified window only when the cumulative incremental energy reaches the effective excitation energy threshold, the number of effective time-paired response pairs reaches the minimum effective sample number, the consecutive M_good,i mapping residuals are not higher than the recovery threshold, the bus sampling and actual speed feedback are effective, there is no hard fault state, and no abnormal response window is formed.If no abnormal response is generated in the recovery verification response observation window and the recovery attempt count is incremented once, the target speed is restored to the recovery reference target speed, and the system waits for the preset stability condition to be met again. If the recovery is successful, the recovery count is incremented; if not all recovery success conditions are met, the recovery count is reset to zero. If the current allowed output limit is insufficient to apply the minimum effective recovery verification speed increment, no new recovery verification response observation window is generated. If there is no hard fault state and there is a verified lower output stage that matches the current reference state category, the system locks the most recently verified lower output stage and disables automatic escalation; otherwise, the system stops output and sets a soft anomaly latch flag. If an abnormal response is generated in the recovery verification response observation window, the recovery count is reset to zero, the recovery attempt count is not incremented, the target speed is not restored to the recovery reference target speed before the window started, and the abnormal handling steps of reducing the allowed output limit are returned. C_bad is then set according to the abnormal response window. The counting rule is incremented once, and then migration is performed in the order of stop priority over single rollback; when N consecutive recovery verification response observation windows are all recovery qualified windows, the abnormal event cycle is exited, C_bad, single rollback flag, recovery count and recovery attempt count are cleared, the recovery phase duration is stopped and cleared, and the automatic upgrade prohibition state corresponding to this abnormal event cycle is removed; the recovery phase duration is the continuous time from the first entry into the recovery observation phase and the start of the timer until the exit from the abnormal event cycle or the entry into the safe final state; when the number of recovery attempts reaches the maximum number of recovery attempts N_try or the recovery phase duration reaches the maximum recovery duration T_recover,max, if there is no hard fault state and there is a verified lower output phase that matches the current baseline state category, then the most recently verified lower output phase is locked and automatic upgrade is prohibited; otherwise, output is stopped and the soft exception latch flag is set.

2. The safety control method according to claim 1, characterized in that, The response delay time, stage switching reference mapping corridor, and recovery verification reference mapping corridor are formed in the following way: Multiple reference compressor individuals or multiple independent operating batches with the same configuration identifier as the electric compressor are selected, and stage switching and recovery verification are repeatedly performed within multiple reference bus voltage ranges, reference input power ranges, reference speed ranges, and preset ambient temperature, refrigerant load, and bus voltage coverage conditions; samples are divided according to the reference compressor individuals, or, when the number of compressor individuals is insufficient, samples are divided according to independent and non-overlapping operating batches, forming non-overlapping corridor formation groups, parameter selection groups, and independent acceptance groups; within preset... Multiple candidate response delay times are set within the physical delay range, and Q_i(k) and S_i(k) are formed according to the method described in claim 1 for multiple candidate quantile values, margins, Q grid spacing, decision thresholds, and minimum sample number combinations; the corridor forming group is used to form candidate lower boundary functions, candidate upper boundary functions, and effective Q ranges corresponding to each candidate response delay time and candidate parameter combination, and the effective Q range is divided into multiple Q grid intervals. The interquartile range of normal S samples is calculated in each Q grid interval, and the weighted average interquartile range is calculated using the effective sample number of the corresponding Q grid interval as the weight. The weighted average interquartile range is used as the conditional dispersion. Using the parameter selection group, the false positive rate and detection rate are calculated according to the complete response observation window. The response delay time and parameter combination that meet the preset upper limit of conditional dispersion, the false positive rate is not higher than the preset upper limit of false positive rate and the detection rate is not lower than the preset lower limit of detection rate are selected as the parameters to be accepted. For the lowest output stage, a switch is executed from the stop state, standby state, or preset start baseline state to the lowest output stage; for the other output stages, a switch is executed from the adjacent lower output stage to the output stage to be verified. For recovery verification, recovery verification speed increments falling into different preset ranges are applied during the rollback phase or after the restricted output stabilizes. Normal stage verification time pairing response pairs with the same configuration identifier, baseline state category, and output stage to be verified are grouped into the same stage switching category, and recovery verification time pairing response pairs with the same configuration identifier, baseline state category, current restricted output stage, and recovery verification speed increment category are grouped into the same recovery verification category.

3. The safety control method according to claim 2, characterized in that, The independent acceptance group is only used for the final acceptance of the parameters to be accepted and the candidate reference mapping corridors determined by the corridor formation group and the parameter selection group. It does not participate in the selection and adjustment of response delay time, quantile value, margin, Q grid spacing, judgment threshold or minimum sample number. The false positive rate is calculated as the ratio of the number of normal windows judged as abnormal response windows to the total number of normal windows. The detection rate is calculated as the ratio of the number of known abnormal windows judged as abnormal response windows to the total number of known abnormal windows. The known abnormal windows are formed by applying controllable mechanical response restrictions or injecting preset speed feedback anomalies under isolated test conditions, and are confirmed by independent speed measurement results, bench load measurement results or preset anomaly injection records. The controllable mechanical response restrictions include at least one of applying controllable mechanical load, increasing preset pressure difference or limiting motor output torque. The preset speed feedback anomalies include at least one of fixed deviation, step, freeze or delay. The frozen reference corridor is formed and locked only when the false positive rate of the independent acceptance group is not higher than the preset false positive rate upper limit, the detection rate is not lower than the preset detection rate lower limit and all coverage conditions are passed. If an independent acceptance test fails, the test results are frozen, and the parameters to be accepted are adjusted in the corridor formation group and parameter selection group. Independent compressors or independent operating batches that did not participate in the previous parameter selection and acceptance are added or replaced as new independent acceptance groups. At the same Q grid point, the lower boundary value is determined by subtracting a preset lower margin from the lower quantile value of the normal S sample, and the upper boundary value is determined by adding a preset upper margin to the upper quantile value of the normal S sample. When the boundary values ​​of adjacent Q grid points do not satisfy the constraint that the cumulative incremental energy does not decrease, monotonic processing is applied to the corresponding boundary values. At any valid Q, S_i^-(Q)≤S_i^+(Q) is maintained, and lower and upper boundary functions are formed by interpolation between adjacent Q grid points. Q grid points with insufficient sample size are not used to form a verification pass conclusion or are incorporated into adjacent Q intervals. When the online Q_i(k) exceeds the valid Q range, the current output stage is maintained, or the boundary at the nearest valid Q endpoint is used for anomaly monitoring, but a stage verification pass conclusion is not formed based on this, nor is a stage verification pass conclusion formed through unconstrained extrapolation.

4. The safety control method according to claim 1, characterized in that, Said mapping residual e_i(k) is determined according to the following formula: when S_i^-(Q_i(k))≤S_i(k)≤S_i^+(Q_i(k)), e_i(k)=0; when S_i(k)<S_i^-(Q_i(k)), e_i(k)=[S_i^-(Q_i(k))-S_i(k)] / K_i; when S_i(k)>S_i^+(Q_i(k)), e_i(k)=[S_i(k)-S_i^+(Q_i(k))] / K_i; wherein K_i is a positive normalization scale associated with the verification type and the output stage, and amplitude limiting from 0 to 1 is implemented on e_i(k); said that the cumulative incremental electric energy increases but the normalized rotating speed increment does not reach the minimum response means that adjacent time paired response pairs satisfy that Q_i(k)-Q_i(k-1) is not less than the minimum energy increment, and S_i(k)-S_i(k-1) is less than the minimum rotating speed response increment.

5. The safety control method according to claim 1, characterized in that, After the stage holding window is formed, if both the target rotating speed and the current operation limit have not changed, the current output stage is maintained and a new stage verification response observation window is not automatically formed repeatedly; only when the target rotating speed or the current operation limit changes and triggers a new stage verification request, the source reference state is re-enabled to meet the preset stability condition for the lowest output stage, the source output stage is re-enabled to meet the preset stability condition for the remaining output stages, U0,i, P0,i and n0,i are re-extracted, Q_i(k) is reset, and a new response observation window is formed after re-selecting the stage switching reference mapping corridor corresponding to the output stage to be verified.

6. The safety control method according to claim 1, characterized in that, The preset stability conditions are as follows: within the preset stability time, the difference between the maximum and minimum values ​​of the effective samples of actual rotational speed does not exceed the rotational speed stability threshold, and the difference between the maximum and minimum values ​​of the effective samples of input power does not exceed the input power stability threshold; the abnormal window counter C_bad, single rollback flag, recovery count, recovery attempt count, and recovery phase duration timer are managed according to one abnormal event cycle, and N_stop>N_back≥1, N_try is a positive integer, and T_recover,max is greater than zero; after the abnormal response window is formed, the allowed output upper limit is first reduced, and then C_bad is increased; when C_bad reaches When N_stop is reached, output is stopped and a soft exception latch flag is set; when C_bad does not reach N_stop but reaches N_back, the current output stage is higher than the lowest output stage, the single back-off flag is not set, and there is a recently verified lower output stage that matches the current baseline state category, back-off to the recently verified lower output stage and set the single back-off flag; when entering the recovery observation stage for the first time, the recovery stage continuous timer is started, and after the recovery verification response observation window does not form an abnormal response and is completed, the recovery attempt count is increased, the target speed is restored to the recovery baseline target speed, and the system waits to meet the preset stability condition again; when If the current allowed output limit cannot be applied to the minimum effective recovery verification speed increment, recovery attempts will not be repeated. If there is no hard fault state and there is a verified lower output stage that matches the current baseline state category, the most recently verified lower output stage will be locked and automatic escalation will be prohibited; otherwise, output will be stopped, and a soft exception latch flag will be set in both cases. When an abnormal response is formed in the recovery verification response observation window, the recovery count will be cleared, the recovery attempt count will not be increased, the abnormal handling steps of reducing the allowed output limit will be returned, and C_bad will be incremented once according to the counting rules of the abnormal response window. Then, the stop priority over single return will be re-executed. The state transition during the rollback is as follows: When all N_recover recovery verification response observation windows are recovery qualified windows, the abnormal event cycle is exited, C_bad, the single rollback flag, the recovery count, and the recovery attempt count are cleared, the recovery phase duration is stopped and cleared, and the automatic upgrade prohibition state corresponding to this abnormal event cycle is removed; when N_try or T_recover,max is reached, if there is no hard fault state and there is a verified lower output stage that matches the current baseline state category, the most recently verified lower output stage is locked; otherwise, output is stopped, and the soft exception latch flag is set in both cases. The soft anomaly latch flag is written to a non-volatile storage area or a power-off retention storage area when it is set. When the controller is powered on again, it reads the soft anomaly latch flag and prevents startup or automatic upgrade if the flag is not cleared. The soft fault latch flag is not automatically cleared by a new startup request, power-on, or waiting time; it is only cleared by a maintenance reset command after a maintenance check.

7. The safety control method according to claim 2, characterized in that, Only use the valid time pairing response pairs in the verification window that are not in the abnormal event cycle recovery phase to perform a bounded update on the corresponding phase switching reference mapping corridor; A frozen reference corridor is a reference mapping corridor that is formed and locked after bench calibration, prototype verification, or maintenance recalibration, and does not change with online bounded updates; The bounded update uses a weighted update amount no greater than a preset update coefficient to limit the maximum offset of the lower and upper boundary functions after a single update relative to the boundary functions before the update, and to limit the maximum cumulative offset of the updated boundary functions relative to the frozen reference corridor. After the update, the upper and lower boundaries do not intersect and the original effective Q range is not expanded. Abnormal response windows, hard fault windows, insufficient effective sample windows, invalid speed feedback windows, recovery verification windows, and windows that have reached the upper limit of recovery attempts or durations are not included in the bounded update.

8. The safety control method according to claim 1, characterized in that, The input power is the product of the bus voltage and the bus current, or the input power value provided by the electric compressor controller; the actual speed is fed back by the electric compressor, or provided by the speed estimator inside the electric compressor controller; the method does not use a refrigerant pressure sensor as a necessary input, but before forming the freezing reference corridor, a coverage verification is performed for a preset ambient temperature, refrigerant load, and bus voltage range. Only when the false positive rate of normal samples under each coverage condition meets the preset upper limit is the corresponding reference state category and reference mapping corridor used for online stage verification.

9. A residual safety controller for energy-speed mapping of an electric compressor, characterized in that, The system includes a processor, memory, bus voltage acquisition interface, bus current acquisition interface, speed feedback interface, fault status interface, and control output interface. The memory stores the control program, electric compressor configuration identifier, at least three sequentially open output stages, target speed increment, recovery verification speed increment, response delay time, response observation time, effective excitation energy threshold, stage verification threshold, stage anomaly threshold, recovery threshold, minimum effective sample count, minimum energy increment, minimum speed response increment, positive normalization scale K_i, stage switching reference map corridor, recovery verification reference map corridor, effective Q range, number of consecutive anomaly samples M_bad,i, number of direction mismatch samples M_dir,i, number of consecutive verification samples M_good,i, number of recovery windows N_recover, and number of rollback triggers N_ The parameters include back, number of stops N_stop, maximum number of recovery attempts N_try, maximum recovery duration T_recover,max, and stability determination parameters, where N_stop>N_back≥1; when the processor executes the control program: before the normal stage verification response observation window begins, for the lowest output stage, the source reference state consisting of the stop state, standby state, or preset start reference state satisfies the stability conditions defined by the stability determination parameters; for the other output stages, the source output stage satisfies the stability conditions; independently extracts the reference bus voltage U0,i, reference input power P0,i, and reference speed n0,i; resets the cumulative incremental energy Q_i(k); and selects the stage switching reference mapping corridor according to the electric compressor configuration identifier, reference state category, and output stage to be verified. A stage switching command is issued to the output stage to be verified. For the effective power sampling time t_k, the cumulative positive incremental energy Q_i(k) of the input power relative to P0,i is formed. The actual speed sample corresponding to t_k+T_d,i is selected to form the normalized speed increment S_i(k). Q_i(k) and S_i(k) form a time-paired response pair. The mapping residual is determined according to the upper and lower boundaries only when Q_i(k) is within the effective Q range of the selected reference mapping corridor. If it is outside the effective Q range, no stage verification conclusion is formed. Before window classification, hard fault states are detected. If a communication interruption, electric compressor fault feedback setting, or existing hardware protection trigger is detected, window classification is bypassed and output is immediately stopped. If no hard fault states exist, the window is classified into stage verification pass, stage hold, or abnormal response based on the effective stimulus, effective sample number, consecutive M_bad,i residuals, consecutive M_dir,i direction mismatch response pairs, and consecutive M_good,i residuals, with abnormal response classification taking priority. When stage verification is passed, the output stage to be verified and its corresponding baseline state category are recorded as verified records. If the output stage to be verified is lower than the maximum allowed output stage, the next output stage is opened. When the maximum output stage is reached, the current output stage is held. When the stage is held, the current output stage is maintained and the next output stage is not opened. When an abnormality occurs, the allowed output limit is reduced and C_bad is increased. When C_bad reaches N_stop, output is stopped and a soft abnormality latch is set. If C_bad does not reach N_stop but reaches N_back and meets the single rollback condition, rollback will be performed to the most recently verified lower output stage. Only one rollback is allowed in the same abnormal event cycle. After the restricted output meets the stability condition, the recovery observation stage will be entered. Upon first entry, the recovery count and recovery attempt count will be cleared and the recovery stage continuous timer will be started. Upon re-entry, the recovery attempt count and continuous timer will be retained and the recovery count will be cleared. The recovery baseline will be re-extracted and Q_i(k) will be reset. A recovery verification speed increment not exceeding the current allowed output limit will be applied. The recovery verification reference mapping corridor will be selected according to the configuration identifier, baseline state category, current restricted output stage, and recovery verification speed increment category. The window will be counted as a recovery qualified window only if the recovery window reaches the effective excitation energy threshold, the effective sample number requirement, the consecutive M_good,i residuals are not higher than the recovery threshold, the sampling and speed feedback are effective, there is no hard fault state, and no abnormal response is formed. If no abnormal response is generated during the recovery window and the recovery attempt count is increased upon completion, the target speed is restored to the recovery reference target speed and stabilization is awaited. If the recovery is successful, the recovery count is increased; otherwise, it is reset to zero. If the minimum effective recovery verification speed increment cannot be applied, the recovery attempt is not repeated. If no hard fault state exists and a verified lower output stage matching the current reference state category exists, the most recently verified lower output stage is locked and automatic escalation is disabled; otherwise, output is stopped and a soft anomaly latch flag is set. If an abnormal response is generated during the recovery window, the recovery count is reset to zero, the recovery attempt count is not increased, and the recovery is not restored to the recovery reference target speed before the start of the window. Instead, the abnormal handling steps that reduce the allowable output upper limit are returned, and C_ba is reset. d. The count is incremented once according to the exception response window counting rules, and then the exception state transition is re-executed first. After N_recover consecutive recovery windows are qualified, the exception event cycle is exited, C_bad, single rollback flag, recovery count and recovery attempt count are cleared, the recovery phase duration is stopped and cleared, and the automatic upgrade prohibition state corresponding to this exception event cycle is removed. When the recovery attempt reaches N_try or the recovery phase duration reaches T_recover,max, if there is no hard fault state and there is a verified lower output phase that matches the current baseline state category, the most recently verified lower output phase is locked. Otherwise, the output is stopped, and a soft exception latch flag that can only be cleared by the maintenance reset command is set. The soft anomaly latch flag is stored in a non-volatile memory area or a power-off retention memory area. When the power is restored, the soft anomaly latch flag is read and the startup or automatic upgrade is prohibited if it is not cleared.

10. The safety controller according to claim 9, characterized in that, The memory includes a control configuration area, a reference mapping corridor area, a verified stage recording area, and an operating status area. The control configuration area stores output stage parameters, target speed increment, recovery verification speed increment, response delay time, response observation time, effective excitation energy threshold, stage verification threshold, stage anomaly threshold, recovery threshold, M_bad,i, M_dir,i, M_good,i, minimum effective sample count, minimum energy increment, minimum speed response increment, positive normalization scale K_i, N_back, N_stop, N_recover, N_try, T_recover,max, preset stabilization time, speed stabilization threshold, and input power stabilization threshold. The reference mapping corridor area sets the stage switching reference mapping corridor according to the electric compressor configuration identifier, reference bus voltage range, reference input power range, and reference speed range. The output stages to be verified are associated with the storage, and the recovery verification reference mapping corridors are associated with the electric compressor configuration identifier, the baseline state category, the current restricted output stage, and the recovery verification speed increment category. Each reference mapping corridor includes a lower boundary function, an upper boundary function, an effective Q range, and a frozen baseline corridor. The verified stage record area stores the output stages to be verified that have passed verification in this run and their corresponding baseline state categories. The running state area stores C_bad, single rollback flag, recovery count, recovery attempt count, recovery stage duration, current baseline state category, automatic upgrade prohibited state, soft anomaly latched state, and hard fault state. The running state area includes at least a non-volatile storage sub-area or a power-loss retained storage sub-area. The soft anomaly latched state is stored in the non-volatile storage sub-area or the power-loss retained storage sub-area and is read by the processor upon power-on.

Images