Cage operation control method based on digital twinning and multi-sensor fusion

Abstract

The present application relates to the technical field of automation control and digital twin simulation, and particularly relates to a cage operation control method based on digital twin and multi-sensor fusion. The cage position, hoisting rope tension, cage way gap, driving braking and safety interlocking state are collected to form a control cycle data frame and a data source validity mask and are fused to obtain a cage physical operation state; a state residual channel and an execution response residual channel are established according to a current digital twin model, a prediction residual source is determined through a sensor counterfactual branch and a model counterfactual branch; an abnormal data source is isolated, or a shadow digital twin model is generated to perform input playback verification and model version switching; a dynamic executable state envelope is used to perform forward simulation on a candidate control instruction sequence, and a target control instruction is output; when there is no target control instruction sequence or composite source prediction residual separation fails, a safety rollback is performed. The present application can improve the safety and reliability of cage operation control.

Description

Technical Field

[0001] This invention relates to the fields of automation control and digital twin simulation technology, and in particular to a cage operation control method based on digital twin and multi-sensor fusion. Background Technology

[0002] A cage is an operating device in a mine hoisting system used to transport personnel, materials, or equipment along the shaft. The operation of the cage is typically controlled by the cage's electrical control system. Existing cage electrical control systems generally acquire multi-source operational data, such as cage position, hoisting rope tension, cage clearance, drive unit, braking unit, and safety interlocking unit, through position detection devices, hoisting rope tension detection devices, cage clearance detection devices, drive unit, braking unit, and safety interlocking unit. Based on this multi-source operational data, the system determines the cage's operating status and then generates hoisting drive commands or braking commands to control the cage to complete operational stages such as acceleration, constant speed, deceleration, crawling, leveling, and stopping.

[0003] With the development of model-based control technology, digital twins are increasingly being applied to the operation control of mining transportation equipment. Control systems employing digital twins typically establish corresponding digital twin models based on physical equipment, operating environment, and actuators. Real-time operating data from the physical equipment is mapped to the digital twin model, which is then used to predict the equipment's operating status. Control commands are then generated or adjusted based on the prediction results.

[0004] For example, Chinese invention patent application CN113741442A discloses an automatic driving system and method for a monorail crane based on digital twin drive. CN113741442A establishes a digital twin model based on the physical information of the tunnel and the monorail crane, uses a positioning system and turnout sensors to obtain the position of the monorail crane and the status of the turnouts, updates the corresponding data to the dynamic digital twin model, and the control unit generates control commands based on the data in the dynamic digital twin model to control the operation of the monorail crane.

[0005] When applying digital twin control to cage operation control, the physical operating state of the cage needs to be represented by multiple data sources. Different data sources may have different sampling periods, transmission delays, measurement uncertainties, and valid states. When some data sources experience measurement deviations, communication anomalies, or state failures, the physical operating state of the cage obtained by fusing multi-source operating data may deviate from the actual operating state. After receiving a deviated physical operating state, the digital twin model may generate a predicted state inconsistent with the actual operation process, causing the control commands generated based on the predicted state to deviate from the current operating conditions of the cage.

[0006] On the other hand, during the long-term operation of the cage, the state of the hoisting rope, the drive and braking response, the state of mechanical components, and the operating conditions of the shaft may change, causing deviations between the model parameters in the digital twin model and the actual state of the cage hoisting system. Even when multi-source operational data is valid but model parameters are deviated, the digital twin model may still produce abnormal prediction results. Current digital twin control methods struggle to distinguish whether prediction anomalies are caused by abnormal data source states or by mismatched digital twin model parameters based on the physical operation of the cage. This may lead to erroneous isolation of normal data sources or the continued participation of model parameters in control that are incompatible with the current cage operating state.

[0007] Furthermore, if the model parameters of the digital twin are adjusted, and it cannot be confirmed whether the adjusted digital twin still meets the current operating state and safety constraints under different operating stages of the cage, the adjusted digital twin may generate control commands that are not applicable to the current operating state of the cage. Control commands generated before the model parameter adjustment but not yet executed may also be inconsistent with the adjusted digital twin, the current multi-source operating data, or the current safety constraints.

[0008] Therefore, a major technical problem that this invention actually solves is: in the process of control simulation using a digital twin model, how to distinguish between multi-source input data anomalies and model parameter mismatches by establishing residual channels within the model and performing counterfactual branch simulation calculations, and how to ensure that the control commands output by the simulation system do not exceed the actual safety constraints of the physical entity by verifying through shadow model playback and forward simulation of dynamic state envelopes. Summary of the Invention

[0009] To overcome the aforementioned technical deficiencies, the present invention aims to provide a cage operation control method based on digital twin and multi-sensor fusion. This invention establishes residual channels corresponding to multi-source operational data, utilizes sensor counterfactual branches and model counterfactual branches to identify and predict residual sources, restricts the participation of abnormal data sources or unverified digital twin model versions in control, and avoids inconsistencies between control commands and the actual operating state and safety constraints of the cage due to abnormal multi-source operational data or digital twin model parameter mismatch. Furthermore, it employs shadow digital twin model playback verification with input, model version switching under operational phase transition boundaries, and forward simulation and safety backoff of candidate control commands under dynamic executable state envelope constraints.

[0010] This invention discloses a cage operation control method based on digital twin and multi-sensor fusion, executed by the cage electrical control system, comprising:

[0011] Collect cage position, hoisting rope tension, cage clearance, drive braking and safety interlock status, form control cycle data frames, generate data source validity mask and fuse to obtain the physical operating status of the cage;

[0012] Input the physical operating status of the cage and the executed control commands into the current digital twin model. Based on the predicted status, predicted execution response, measured status and measured execution response, establish residual channels and residual allowable intervals, and determine abnormal residual channels.

[0013] Based on the data source relationship and model propagation relationship corresponding to the abnormal residual channel, determine the data source group to be judged and the candidate model parameters. Replace the state of the data source group to be judged with the constraint reconstruction state to establish the sensor counterfactual branch. Replace the model parameter with the model parameter perturbation value to establish the model counterfactual branch. Determine the sensor source prediction residual, model source prediction residual or composite source prediction residual based on the branch residual recovery set, cumulative state propagation delay and execution response residual change.

[0014] Isolate sensor source prediction residual data source group and form state uncertainty interval, determine minimum parameter set based on model source prediction residual and generate shadow digital twin model, use historical data to perform same input playback verification, and switch model version by conversion boundary during operation;

[0015] Based on the braking capacity, the elastic elongation of the hoisting rope, and the wellbore boundary, a dynamic executable state envelope is formed. A verified digital twin model is used to perform forward simulation on the candidate control command sequence. The first control command in the target control command sequence whose predicted state tube is located within the dynamic executable state envelope is executed. If there is no target control command sequence or the composite source prediction residual separation fails, a safe backoff command is generated and the system enters a safe latching state.

[0016] Preferably, the current digital twin model includes a cage kinematics sub-model, a hoisting rope dynamics sub-model, a drive and braking sub-model, a shaft boundary sub-model, and a safety interlocking sub-model;

[0017] The input state, output state, and adjustable model parameters of each sub-model are used as model nodes, and the state propagation relationship between each model node within a control cycle is used as directed edges to form a model state propagation graph. Each directed edge records the source model node, the target model node, the propagation state, and the state propagation delay interval, respectively.

[0018] The output state node corresponding to the abnormal residual channel is traced along the reverse directed edge of the model state propagation graph to form a candidate residual propagation path;

[0019] For adjacent abnormal residual channels on the same candidate residual propagation path, the timing of the occurrence of abnormal residuals is determined based on the control cycle difference that the adjacent abnormal residual channels first exceed the corresponding residual allowable interval, and the candidate residual propagation path that covers the control cycle difference in the cumulative state transmission delay interval is determined as the residual propagation path.

[0020] Preferably, the multi-source operating data characterizing the same state component in the physical operating state of the cage are divided into at least two data source groups, and a common cause topology graph of the data sources is established.

[0021] The data source common cause topology graph includes sensor nodes, power supply branch nodes, communication link nodes and data source group nodes. Each data source group node is connected to the corresponding sensor node, power supply branch node and communication link node through dependency edges. Each dependency edge records the dependency type and fault propagation delay interval.

[0022] When abnormal prediction residuals occur in the residual channels corresponding to multiple data source groups, trace the common upstream node of each data source group node along the common cause topology graph of the data source.

[0023] Data sources that share the same common upstream node and whose abnormal residual occurrence timing matches the cumulative fault propagation delay interval from the common upstream node to each data source group node are grouped into the same data source group to be judged.

[0024] Each set of upstream nodes that do not intersect with each other is identified as an independent data source group, and the data source group to be judged and the independent data source group are respectively input into the sensor counterfactual branch.

[0025] Preferably, the sensor counterfactual branch is established in the following manner:

[0026] The validity identifier of the data source group to be judged in the data source validity mask is set to invalid, and the first candidate state interval is determined according to other valid data source groups representing the same state component and the corresponding measurement uncertainty interval.

[0027] The second candidate state interval is determined based on the predicted state of the current digital twin model within the same control cycle;

[0028] The dynamic executable state envelope is projected onto the state dimension corresponding to the state component to obtain the state constraint interval;

[0029] Determine the common interval of the first candidate state interval, the second candidate state interval, and the state constraint interval, and determine the state value with the smallest absolute value of the difference between the corresponding state component and the physical operation state of the cage in the previous control cycle within the common interval as the constraint reconstruction state;

[0030] Under the condition that the model parameters of the current digital twin model and the executed control instructions remain unchanged, the state value corresponding to the data source group to be judged is replaced with the constraint reconstruction state, and the prediction residual of each residual channel is obtained again.

[0031] Preferably, restoring access to the isolated data source group includes:

[0032] The current valid data source group is merged to form a first fusion state, and the current valid data source group and the data source group to be restored are merged together to form a second fusion state;

[0033] Using the same current digital twin model and the same candidate control instruction sequence, forward simulations are performed on the first fusion state and the second fusion state respectively to obtain the first prediction state tube and the second prediction state tube;

[0034] The minimum distance from each cross section of the first and second predicted state tubes to the boundary corresponding to the dynamic executable state envelope is determined, and the minimum value among the minimum distances corresponding to the first predicted state tube is determined as the first safety boundary distance, and the minimum value among the minimum distances corresponding to the second predicted state tube is determined as the second safety boundary distance.

[0035] When both the first and second predictive state tubes are located within the dynamic executable state envelope, the first control command determined by the two forward simulations is the same, the second safety boundary distance is not less than the first safety boundary distance, and the set of residual propagation paths formed after the recovery of access is consistent with the set of residual propagation paths before the recovery of access, the data source group to be recovered is set to be valid.

[0036] The fusion weight of the data source group to be restored is increased from zero in each control cycle until the target fusion weight is determined according to the corresponding measurement uncertainty interval. When the first control command determined by the two forward simulations is different or the second safety boundary distance is less than the first safety boundary distance, the validity flag of the data source group to be restored is set to invalid and the corresponding fusion weight is set to zero.

[0037] Preferably, the counterfactual branch of the model is established in the following manner:

[0038] Based on the residual propagation path, determine the upstream adjustable model parameter node of the output state node corresponding to the abnormal residual channel, and form a candidate model parameter set;

[0039] Within the range of physical parameters corresponding to each candidate model parameter, positive parameter perturbation and negative parameter perturbation are applied to each candidate model parameter respectively;

[0040] While keeping the control cycle data frame, the data source validity mask, the cage physical operating state, and the executed control commands unchanged, the current digital twin models before and after parameter perturbation are used for playback.

[0041] Record the residual channels affected by parameter perturbation of each candidate model parameter, the direction of prediction residual change, the control period in which the prediction residual first changes from the parameter perturbation input control period, and the consistency change between the prediction execution response and the measured execution response, to form the parameter residual influence relationship;

[0042] The control period in which the first predicted residual change occurs is matched with the cumulative state propagation delay interval corresponding to the residual propagation path, and the candidate model parameters corresponding to the matching result are retained.

[0043] Preferably, the sensor source prediction residual, the model source prediction residual, or the composite source prediction residual is determined in the following manner:

[0044] When the sensor counterfactual branch causes the predicted residuals of all abnormal residual channels to enter the corresponding residual allowable range, the predicted residuals of each normal residual channel to remain within the corresponding residual allowable range, and the predicted residuals of the execution response residual channel to enter the corresponding residual allowable range, the sensor source predicted residual is determined.

[0045] When the model counterfactual branch causes the predicted residuals of all abnormal residual channels to enter the corresponding residual allowable range, the predicted residuals of each normal residual channel to remain within the corresponding residual allowable range, the predicted residuals of the execution response residual channel to enter the corresponding residual allowable range, and after the sensor counterfactual branch processing, at least one abnormal residual channel still has a predicted residual exceeding the corresponding residual allowable range, the model source predicted residual is determined.

[0046] When the sensor counterfactual branch causes the first abnormal residual channel set to enter the corresponding residual allowable interval, and the model counterfactual branch causes the second abnormal residual channel set to enter the corresponding residual allowable interval, and both the first abnormal residual channel set and the second abnormal residual channel set are non-empty proper subsets of the entire abnormal residual channel set, and the union of the first abnormal residual channel set and the second abnormal residual channel set is equal to the entire abnormal residual channel set, the composite source prediction residual is determined.

[0047] Preferably, separating the composite source prediction residual includes:

[0048] Sequentially invalidate the data source groups whose corresponding residual channels change from within the residual allowable range to outside the residual allowable range between adjacent control cycles, and re-obtain the physical operating status of the cage and the predicted residuals of each residual channel.

[0049] The difference in the predicted residual value of the corresponding residual channel before and after each time the data source group is set to invalid is determined as the sensor source residual component of the corresponding data source group.

[0050] The sensor source residual component is subtracted from the composite source prediction residual channel by channel, and the remaining prediction residual is input into the model counterfactual branch. The model source residual component is determined according to the parameter residual influence relationship.

[0051] The sensor source residual component and the model source residual component are combined channel by channel to form the reconstructed residual;

[0052] When the difference between the reconstructed residual and the composite source prediction residual are both within the corresponding residual allowable interval, it is determined that the separation of the composite source prediction residual is complete.

[0053] When the difference corresponding to at least one residual channel exceeds the corresponding residual allowable range, the range of the candidate model parameter set and the data source group to be judged is expanded along the model state propagation graph and the data source common cause topology graph, and the separation of the composite source prediction residual is performed again.

[0054] If separation is not completed after reaching the preset maximum expansion level, the expansion of the candidate model parameter set and the range of the data source group to be judged is stopped, and a safe rollback instruction is generated.

[0055] Preferably, the minimum model parameter set is determined in the following manner:

[0056] Based on the parameter residual influence relationship, determine the abnormal residual channel set and normal residual channel set covered by each candidate model parameter respectively;

[0057] Candidate model parameters whose predicted residuals for all normal residual channels after parameter perturbation are located within the corresponding residual allowable interval;

[0058] The candidate parameter combination is determined from the retained candidate model parameters. The union of the abnormal residual channels covers all abnormal residual channels, the parameter perturbation propagation direction is consistent with the residual propagation path, and the control period of the first occurrence of predicted residual change is located within the corresponding cumulative state propagation delay interval.

[0059] The candidate parameter combination with the fewest number of candidate model parameters is determined as the minimum model parameter set;

[0060] When there are multiple candidate parameter combinations containing the same number of candidate model parameters, the candidate parameter combination with the smallest sum of normalized residuals of all abnormal residual channels after parameter perturbation is determined as the minimum model parameter set.

[0061] Preferably, multiple candidate parameter update combinations are formed within the physical parameter range of each candidate model parameter in the minimum model parameter set, and candidate shadow digital twin models are generated respectively.

[0062] Select playback data segments covering the acceleration, constant speed, deceleration, crawling, leveling and braking phases of the cage from the historical control cycle data frames.

[0063] The initial physical operating status of the cage, the data source validity mask, and the executed control commands corresponding to each playback data segment are respectively input into the current digital twin model and each candidate shadow digital twin model;

[0064] Candidate shadow digital twin models are defined as those where all predicted state tubes are within the envelope of the dynamic executable state, the absolute value of the playback residual of each abnormal residual channel is less than the absolute value of the playback residual corresponding to the current digital twin model, and the playback residual of each normal residual channel is within the corresponding residual allowable range.

[0065] When multiple shadow digital twin models exist to be activated, the shadow digital twin model with the smallest maximum normalized outlier residual is determined as the shadow digital twin model.

[0066] Preferably, the model version switching includes:

[0067] Configure a current model version identifier and a model version identifier to be activated for the current digital twin model and the shadow digital twin model, respectively;

[0068] When the safety interlock sub-model determines that the cage has reached the transition boundary of the allowable operation stage, and both the hoisting drive device and the braking device return the execution receipt of the previous control command, the version identifier of the model to be activated and the corresponding model parameters are written into the version area of ​​the model to be submitted.

[0069] At the start of the next control cycle, the shadow digital twin model in the model version area to be submitted is switched to the current digital twin model, and the current digital twin model before the switch is saved as the rollback model version;

[0070] The candidate control instruction sequence that carries the model version identifier before the switch and is in the pending execution state is set to invalid, and the candidate control instruction sequence is regenerated using the current digital twin model after the switch.

[0071] During the switching verification period from the start of the model version switch until both the boosting drive device and the braking device complete their corresponding execution responses, if the number of abnormal prediction residuals or target control command sequences formed by the current digital twin model after the switch is zero, the rollback model version is restored, and the identifier of the model version to be activated is set to a frozen state.

[0072] Preferably, the dynamic executable state envelope is determined in the following manner:

[0073] The current braking capacity range is determined based on the measured braking response of the braking device and the predicted braking response of the drive braking sub-model during the most recent braking control process.

[0074] The elastic elongation range of the lifting rope is determined based on the current load, current lifting rope tension, and the lifting rope dynamics sub-model in the control cycle data frame.

[0075] Based on the current braking capacity range, the elastic elongation range of the lifting rope, and the remaining distance from the cage to the target stopping position, determine the joint boundary of position and velocity corresponding to each predictive control cycle;

[0076] Based on the cage clearance, cage lateral motion state and wellbore boundary sub-model in the control cycle data frame, determine the lateral displacement boundary corresponding to each predicted control cycle.

[0077] The position and velocity joint boundary, the lateral displacement boundary, the lifting rope tension difference boundary, the driving current boundary, and the safety interlock state boundary are arranged according to the predictive control cycle to form the dynamic executable state envelope, and the control constraint version identifier is configured for the dynamic executable state envelope.

[0078] Preferably, the initial state interval and model parameter interval corresponding to the candidate control command sequence are determined according to the state uncertainty interval and the physical parameter range corresponding to each model parameter in the current digital twin model, respectively.

[0079] The candidate control instruction sequence is used to perform interval forward propagation on the initial state interval and the model parameter interval to form a corresponding prediction state tube;

[0080] The cross-section of the predicted state tube is compared with the envelope of the dynamic executable state on a cycle-by-cycle predictive control basis.

[0081] The candidate control instruction sequences that are all located within the envelope of the dynamic executable state and whose predicted states before and after the transition of the cage operation phase satisfy the allowable operation phase corresponding to the safety interlocking sub-model are determined as valid candidate control instruction sequences.

[0082] Preferably, a candidate control instruction tree consisting of control nodes and candidate branches is established;

[0083] Each control node records the cage operation stage, cage physical operation status, data source validity mask, model version identifier, and control constraint version identifier, respectively; each candidate branch records the control command, prediction state tube, and target operation stage, respectively.

[0084] Establish a branch dependency index for each candidate branch. The branch dependency index records the data source validity mask bit, model parameter node, state constraint dimension and prediction control period on which the corresponding prediction state tube depends.

[0085] When the data source validity mask, the model version identifier, or the control constraint version identifier changes, the candidate branches affected by the changes and their corresponding lower-level candidate branches are set to invalid according to the branch dependency index, while the prediction state of other candidate branches is retained.

[0086] Tracing upwards along the candidate control instruction tree, each invalid candidate branch is identified, and the nearest parent control node whose data source validity mask, model version identifier, and control constraint version identifier are all consistent with the content corresponding to the current control cycle is determined as the starting control node for resimulation. The corresponding candidate branch is then regenerated from the starting control node.

[0087] The regenerated candidate branches are used together with the retained candidate branches to determine the target control instruction sequence.

[0088] Preferably, for the composite source prediction residual, a composite state uncertainty interval is formed based on the measurement uncertainty interval of the state value corresponding to each group of data sources to be judged and the physical parameter range corresponding to each candidate model parameter;

[0089] Based on the current braking capacity range, the elastic elongation range of the lifting rope, and the uncertain range of the combined state, a controlled deceleration stop position range is generated using the verified current digital twin model;

[0090] The available parking area is determined based on the target parking location, the allowable leveling range, the shaft safety boundary, and the over-winding protection boundary.

[0091] When the entire controlled deceleration stop position range is within the available parking range, a controlled deceleration command is sent through the motion control channel, and a safety latching command is sent through the safety control channel.

[0092] When any part of the controlled deceleration stop position range exceeds the available parking range, a drive force cutoff command is sent through the motion control channel, and a safety braking command is sent to the independent safety control circuit through the safety control channel.

[0093] Write the control command sequence number, model version identifier, data source validity mask, and command validity control period into each of the safety rollback commands, and verify the execution receipts returned by the boost drive device, braking device, and independent safety control circuit;

[0094] When the cage is at zero speed, the braking device is closed, the effective data source group covers the cage position, cage speed, current load, hoisting rope tension, cage clearance, drive braking status and safety interlock status, all residual channels obtained by replaying the control cycle data frames during the safety latching period by the current digital twin model are within the corresponding residual allowable range, the current model version identifier is consistent with the model version identifier in the safety rollback instruction, and the control instruction sequence number in each execution receipt is consistent with the control instruction sequence number in the corresponding safety rollback instruction, the current digital twin model is reinitialized with the current physical operating state of the cage, and the safety latching state is released.

[0095] Compared with existing technologies, the above technical solution has the following advantages:

[0096] 1. This invention establishes sensor counterfactual branches and model counterfactual branches, and performs state replacement on the data source group to be judged and perturbation playback on the candidate model parameters at the simulation algorithm level. This breaks through the technical bottleneck of traditional digital twin systems that are difficult to distinguish between data source anomalies, model parameter mismatches and the combined errors of the two, and significantly improves the mapping accuracy and simulation confidence of the digital twin model to the physical entity.

[0097] 2. This invention utilizes historical control cycle data frames to perform same-input playback verification on the shadow digital twin model, establishing a mechanism for online correction and version switching of digital twin model parameters that does not rely on shutdown calibration, ensuring that the simulation prediction state and execution response of the updated model are highly consistent with the physical system.

[0098] 3. This invention uses dynamic executable state envelope constraints and a verified digital twin model to perform forward simulation on candidate control command sequences. It uses model-predicted state tubes to screen effective control commands, thus avoiding the risk of control commands going out of bounds due to model errors or sensor anomalies from the algorithm's underlying layer. Attached Figure Description

[0099] Figure 1 This is a schematic diagram of the overall architecture of the cage electrical control system based on digital twin and multi-sensor fusion of the present invention;

[0100] Figure 2 This is a schematic diagram of the overall process of the cage operation control method based on digital twin and multi-sensor fusion of the present invention;

[0101] Figure 3 This is a schematic diagram illustrating the state propagation relationship and the common-cause topology of the multi-source operational data in the digital twin model of this invention.

[0102] Figure 4This is a schematic diagram of the process for determining the source of prediction residuals based on sensor counterfactual branch and model counterfactual branch in this invention;

[0103] Figure 5 This is a timing diagram illustrating the separation of composite source prediction residuals and the restoration of access to isolated data source groups according to the present invention.

[0104] Figure 6 This is a timeline diagram illustrating the generation, verification, and model version switching process of the shadow digital twin model of the present invention.

[0105] Figure 7 This is a schematic diagram of the forward simulation of the dynamic executable state envelope generation and the prediction state tube of the candidate control instruction sequence of the present invention.

[0106] Figure 8 This is a schematic diagram of the process for generating the candidate control instruction tree, pruning candidate branches, and implementing a safety rollback control in this invention.

[0107] Figure 9 This is a curve comparing the convergence of the prediction residuals under the concurrent conditions of sensor failure and digital twin model parameter mismatch. Detailed Implementation

[0108] It should be noted that although this embodiment uses a cage hoisting system with a rated load of 10,000 kg as an example to illustrate the invention in detail, those skilled in the art should understand that the core technology of this invention is essentially a method involving prediction, verification, and control using system models and simulators. In this embodiment, the cage serves only as a physical carrier of a controlled object containing complex kinematics, dynamics, and multi-sensor information fusion, used to verify the core control mechanisms proposed in this invention, such as "counterfactual branch residual determination," "shadow model playback," and "command forward simulation." This digital twin modeling and simulation control mechanism is also applicable to other large, complex controlled electromechanical systems with similar multi-source physical constraints.

[0109] like Figure 1 and Figure 2 As shown, this specific embodiment uses a cage hoisting system with a rated load of 10,000 kg, a cage weight of 8,500 kg, a maximum hoisting speed of 12 m / s, and an effective hoisting height of 960 m. The cage electrical control system includes a safety-type programmable logic controller, edge computing nodes, a real-time database, a position sensor group, a hoisting rope tension sensor group, a cage clearance sensor group, a load detection unit, a drive and braking status acquisition unit, a safety interlock status acquisition unit, a hoisting drive device, a braking device, a safety control channel, and an independent safety control circuit.

[0110] The safety-oriented programmable logic controller (PLC) is used to perform control cycle data acquisition, data time alignment, control command transmission, execution receipt verification, and safety interlock processing. Edge computing nodes are used to perform cage physical operating state fusion, digital twin model calculation, predictive residual analysis, sensor counterfactual branch playback, model counterfactual branch playback, shadow digital twin model verification, predictive state tube generation, and candidate control command sequence filtering. The real-time database stores control cycle data frames, data source validity masks, predictive residuals, model parameters, model version identifiers, control constraint version identifiers, candidate control command sequences, and execution receipts.

[0111] The independent safety control circuit is independent of the edge computing nodes and the general motion control program. The inputs to the independent safety control circuit include at least the cage zero-speed signal, the braking device closure signal, the hoisting drive force cut-off signal, the safety latch signal, the overwind protection signal, and the slack rope protection signal. The output of the independent safety control circuit connects to the hoisting drive enable circuit, the safety relay, and the braking solenoid valve, and is used to directly cut off the hoisting drive and control the braking device to enter a safe braking state when the general motion control link malfunctions or the safety retraction condition is met.

[0112] This specific implementation method will define the control cycle of the cage electrical control system. The sampling period is set to 50 milliseconds. The position sensor group, hoisting rope tension sensor group, load detection unit, guideway clearance sensor group, and drive braking status acquisition unit collect data with a sampling period of 10 to 20 milliseconds. Each data acquisition unit uses the clock of the safety programmable logic controller as the master clock and writes the sampling timestamp, data source group identifier, data sequence number, and message check value into the acquisition message.

[0113] The control cycle, sampling cycle, anomaly confirmation cycle, maximum expansion level, recovery fusion cycle, candidate parameter combination threshold, interval subdivision level, and reserved safety distance are determined based on the controller's computing power, sensor sampling power, improved drive and braking response test results, and reserved safety margin.

[0114] The safety-oriented programmable logic controller aligns each data source according to the sampling timestamp within each control cycle. For data sources with multiple sample values ​​within the same control cycle, the sample value with the timestamp closest to the center time of the current control cycle is selected. For data sources with two adjacent sampling times located on either side of the center time of the current control cycle, linear interpolation is used to obtain the data value at the corresponding center time of the control cycle. For discrete safety interlock states, no numerical interpolation is performed; instead, the state value that passed the message integrity check most recently before the center time of the control cycle is used.

[0115] When the difference between the data timestamp and the current control cycle center time exceeds 25 milliseconds, the corresponding data will not participate in the fusion of the cage physical operation status for the current control cycle. If a data source fails to provide valid data for two consecutive control cycles, the data source validity flag of the corresponding data source will be set to invalid, and the communication interruption status will be recorded.

[0116] The current load is directly acquired by the load detection unit. The load detection unit can be a weighing sensor installed below the cage's supporting structure, or a load sensor installed at the connection point of the hoisting rope.

[0117] The control cycle data frame includes the control cycle sequence number, control cycle start timestamp, control cycle center timestamp, cage position, cage speed, cage acceleration, current load, tension of each hoisting rope, cage clearance, cage lateral movement status, drive current, drive torque, braking pressure, brake device open / closed status, safety interlock status, executed control commands from the previous control cycle, execution receipt, data source validity mask, current model version identifier, and current control constraint version identifier.

[0118] The lateral movement state of the cage is determined based on the changes in the left and right cage clearances and the clearance between adjacent control cycles, collected by the cage clearance sensor group.

[0119] The field structure of the control period data frame can be set according to Table 1.

[0120] Table 1. Control Cycle Data Frame Field Structure Table

[0121] Control cycle number unsigned integers Dimensionless Safety-oriented programmable logic controller 50ms Control cycle center timestamp 64-bit integer μs Master clock 50ms Cage location floating-point numbers m Fusion value of position sensor group 50ms Cage speed floating-point numbers m / s Encoder differential and model correction values 50ms Cage acceleration floating-point numbers m / s² Output values ​​of velocity differential and inertial measurement unit 50ms Current load floating-point numbers kg Load detection unit 50ms Increase rope tension floating-point array kN Lifting rope tension sensor group 50ms Tank passage clearance floating-point array mm Tank Gap Sensor Group 50ms Drive current floating-point numbers A Improve drive feedback 50ms Drive torque floating-point numbers N·m Improve drive feedback 50ms Braking pressure floating-point numbers MPa Brake pressure sensor 50ms Safety interlock status Bitmap Dimensionless Safety interlock status acquisition unit 50ms Control commands have been executed. Structure Consistent with the corresponding instruction Control instruction queue 50ms Execution receipt Structure Dimensionless Lifting drive device and braking device 50ms Data source validity mask Bitmap Dimensionless Data validity assessment results 50ms Model version identifier unsigned integers Dimensionless Version Control Unit Update during model switching Control constraint version identifier unsigned integers Dimensionless Dynamic executable state envelope generation unit Update during envelope update

[0122] In the Within each control cycle, the physical operating status of the cage is represented as follows:

[0123]

[0124] Among them, the physical operating status of the cage Indicates the first The physical operating status of the cage during each control cycle; cage position. The unit is meters; cage speed The unit is meters per second; cage acceleration The unit is meters per second squared; current load mass The unit is kilogram; Root lifting rope tension The unit is kilonewton; number of lifting ropes Dimensionless integer; clearance of the left-side tank passage Gap with the right side of the tank passage The unit is millimeters; lateral displacement of the cage The unit is millimeters; driving current The unit is ampere; braking pressure The unit is megapascal; safety interlock status coding It is a dimensionless discrete variable.

[0125] Safety interlock status coding The system is stored in bitmap format, with different bits representing the wellhead door status, tank door status, overwind protection status, slack rope protection status, brake pressure protection status, hoisting drive device fault status, communication status, and emergency stop status, respectively. The safety interlock sub-model only outputs the corresponding permitted operating phase when all safety interlock bits involved in the current operating phase are in the permitted state.

[0126] The data source validity mask is stored using a bitmap structure. The data source validity mask for each control cycle is represented as follows:

[0127]

[0128] Among them, the total number of data sources This indicates the total number of data sources participating in the fusion of the physical operation status of the cage; data source validity identifier. Indicates the first The data source in the first The validity indicator of the control cycle. When the first... When a data source is valid, When the first When a data source is invalid .

[0129] Data source validity assessment includes time validity verification, message integrity verification, physical range verification, rate of change verification, redundancy consistency verification, and common cause failure verification. Only data sources that pass all four verifications simultaneously are designated as valid.

[0130] The time validity check determines whether the difference between the sampling timestamp and the center time of the control cycle does not exceed 25 milliseconds. The message integrity check determines whether the message length, data sequence number, and cyclic redundancy check value are correct. The physical range check determines whether the measured value is within the sensor's rated measurement range and the physical range of the cage equipment. The rate of change check determines whether the change in measured value between adjacent control cycles exceeds the rate of change limit determined by the maximum acceleration of the cage, the maximum rate of change of the hoisting rope tension, the maximum rate of change of the drive current, or the maximum settling rate of the braking pressure.

[0131] Taking cage position data as an example, when the position change in adjacent control cycles satisfies:

[0132]

[0133] At that time, the location change rate is checked. The location data source is... In the Measurement values ​​per control cycle The measured value of the previous control cycle All units are meters; maximum lifting speed of the cage. The unit is meters per second; the maximum permissible acceleration of the cage. The unit is meters per second squared; the overall uncertainty of position measurement The unit is meters.

[0134] The multi-source sensor configuration in this specific embodiment is shown in Table 2.

[0135] Table 2. Configuration of Multi-Source Sensors in the Cage and Measurement Uncertainty Intervals

[0136] Cage location Location data source group A Hoist shaft encoder 0～1000m 10ms ±0.018m Cage location Location data source group B Wellbore magnetic mark locator 0～1000m 20ms ±0.035m Cage speed Speed ​​data source group A Encoder differential calculation value -12~12m / s 10ms ±0.025m / s Cage speed Speed ​​data source group B Integral value of inertial measurement unit -12~12m / s 10ms ±0.060m / s Current load Load data source group A Weighing sensor 0~12000kg 20ms ±45kg Increase rope tension Tension data source group A Piezomagnetic tension sensor 0~400kN 10ms ±4.5kN Increase rope tension Tension data source group B Drive torque conversion value 0~400kN 20ms ±7.0kN Tank passage clearance Intermittent data source group A Eddy current gap sensor 0~30mm 20ms ±0.40mm Drive current Drive state data source group A Inverter current feedback 0～1000A 10ms ±3.0A Braking pressure Braking status data source group A pressure transmitter 0~16MPa 10ms ±0.08MPa Safety interlock status Secure data source group A Safe input module Binary state 10ms One control cycle

[0137] For multiple valid data sources characterizing the same state component, a weighted fusion method based on measurement uncertainty intervals is used to obtain the physical operating state of the cage. Taking the cage position as an example, the fused cage position value is calculated according to the following formula:

[0138]

[0139] Among them, the number of valid location data sources Indicates the first Number of valid location data sources participating in location fusion per control cycle; measured location Indicates the first The valid location data source is in the first... Measured position for each control cycle; position fusion weight Indicates the first The valid location data source is in the first... Position fusion weights for each control cycle.

[0140] Location fusion weights are determined according to the reciprocal of the square of the half-width of the corresponding measurement uncertainty interval:

[0141]

[0142] Among them, the half-width of the uncertain interval for position measurement The unit is meters.

[0143] For example, the hoist shaft encoder gives a cage position of 412.368 meters, corresponding to a measurement uncertainty interval of ±0.018 meters; the shaft magnetic marker locator gives a cage position of 412.401 meters, corresponding to a measurement uncertainty interval of ±0.035 meters. The position fusion weight of the hoist shaft encoder is... The position fusion weight of the wellbore magnetic marker locator is After substituting the two location data into the cage location fusion formula, the cage location fusion value is approximately 412.375 meters.

[0144] When there is only one valid data source representing the same state component, the measurement value of the corresponding valid data source is directly used as the fused state center value, and the uncertainty interval of the corresponding measurement is used as the uncertainty interval of the corresponding state component. When all data sources representing the state components necessary for control are invalid, no normal operation control command is generated. Instead, the current digital twin model predicts the state and the state of the last valid control cycle are used together to form an extended state uncertainty interval, and the system switches to controlled deceleration or safe backoff judgment.

[0145] The current digital twin model includes a cage kinematics sub-model, a hoisting rope dynamics sub-model, a drive and braking sub-model, a shaft boundary sub-model, and a safety interlocking sub-model. Each sub-model is based on a control cycle. The step size is used for discrete calculation.

[0146] The cage kinematics sub-model calculates the predicted position and velocity for the next control cycle based on the cage's position, velocity, and acceleration.

[0147]

[0148]

[0149] Among them, the predicted location The unit is meters; predicted speed The unit is meters per second.

[0150] The predicted acceleration of the cage is calculated based on the lifting driving force, braking force, total mass of the cage and load, and equivalent resistance:

[0151]

[0152] Among them, predicting the driving force Predictive braking force and predicted equivalent resistance All units are Newtons; equivalent kinematic mass The unit is kilogram. The equivalent kinematic mass consists of the cage's own weight, the current load, the equivalent mass of the hoisting rope involved in the motion, and the reduced mass of the rotating components.

[0153] The hoisting rope dynamics sub-model is used to calculate the elastic elongation, tension, and tension difference of the hoisting rope. The hoisting rope is divided along its length into... One lifting rope micro-element, the first The elastic elongation of the lifting rope for each control cycle is calculated using the following formula:

[0154]

[0155] Among them, the number of rope micro-elements is increased. It is a dimensionless integer; the first... The lifting rope micro-element in the first Axial tension in each control cycle The unit is cattle; The unstretched length of a lifting rope element The unit is meters; The elastic modulus of a lifting rope element The unit is Pascal; The equivalent bearing cross-sectional area of ​​the lifting rope micro-element The unit is square meters; the elastic elongation of the lifting rope. The unit is meters.

[0156] The tension difference of the lifting ropes is determined according to the maximum deviation between the tension of each lifting rope and the average tension of the lifting ropes:

[0157]

[0158]

[0159] Among them, the maximum lifting rope tension difference and average increase in rope tension The units are all kilonewtons.

[0160] The drive and brake sub-model uses discrete first-order response relationships to calculate the predicted drive torque and predicted braking torque. The predicted drive torque is calculated according to the following formula:

[0161]

[0162] Among them, the predicted driving torque and The unit is Newton-meter; drive response time constant The unit is seconds; torque current coefficient The unit is Newton-meter per ampere.

[0163] The predicted braking torque is calculated using the following formula:

[0164]

[0165] Among them, the predicted braking torque and The unit is Newton-meter; braking response time constant The unit is seconds; braking pressure torque coefficient The unit is Newton-meter per megapascal.

[0166] The shaft boundary sub-model indexes the shaft boundary database according to the cage's location. The shaft boundary database stores available clearances, local deviations, structural constraints, and docking positions for the cage at intervals of 0.5 to 2 meters of shaft height. When the cage's location is between two adjacent shaft boundary records, linear interpolation is used to obtain the available clearances and local deviations for the current location.

[0167] The safety interlock sub-model establishes a safety status table according to the cage operation stages. The acceleration stage requires the wellhead door and cage door to be closed, the brakes to be released, the overwind protection not to be triggered, and the hoisting drive to be fault-free. The constant speed stage requires the aforementioned states to remain effective. The deceleration stage allows the brake pressure to begin building, but does not allow the overwind protection or slack rope protection to be triggered. The crawling and leveling stage requires the target docking position to be valid and the cage speed to be below the preset crawling speed limit. The braking stage requires the hoisting drive torque to decrease and the brakes to close within a specified response time.

[0168] The parameter configurations for the digital twin model are shown in Table 3.

[0169] Table 3. Digital Twin Model and Model Parameters

[0170] Cage motion student model Equivalent motion mass 14,500–19,000 kg 17000kg 250kg Lifting rope dynamics sub-model Equivalent elastic modulus 78~102GPa 90GPa 2GPa Lifting rope dynamics sub-model Equivalent damping coefficient 2.0~7.5kN·s / m 4.5 kN·s / m 0.25 kN·s / m Drive brake model Torque Current Coefficient 8.6~10.4 N·m / A 9.5 N·m / A 0.10 N·m / A Drive brake model Braking pressure torque coefficient 3.8~5.6kN·m / MPa 4.7 kN·m / MPa 0.10 kN·m / MPa Drive brake model Braking response time constant 120~380ms 180ms 20ms Wellbore boundary sub-model Local deviation of the guideway 0~6.0mm Location marking 0.25mm Safety interlock sub-model Interlocking response delay 10~100ms 40ms 10ms

[0171] No. After inputting the physical operating status of the cage in the current control cycle and the executed control commands from the previous control cycle into the current digital twin model, the current digital twin model outputs the [number]th [control cycle]. The predicted state and predicted execution response for each control cycle.

[0172] A corresponding state residual channel is established for each data source group, and execution response residual channels are established for the lifting drive device and braking device respectively. The state residual channel is established based on the difference between the measured state and the predicted state, and the execution response residual channel is established based on the difference between the measured execution response and the predicted execution response. The residual channel in the first The prediction residual for each control cycle is calculated using the following formula:

[0173]

[0174] Among them, the predicted residual Indicates the first The residual channel in the first Predicted residuals for each control cycle; measured values Indicates the first Measured values ​​of each observed object; predicted values This represents the output of the current digital twin model. The predicted value of each observed object.

[0175] The state residual channels include position residual channels, velocity residual channels, acceleration residual channels, hoisting rope tension residual channels, guideway clearance residual channels, and drive current residual channels. The execution response residual channels include hoisting drive torque response residual channels, braking pressure response residual channels, braking torque response residual channels, and braking response time residual channels.

[0176] The allowable residual range is determined jointly based on fault-free stable operation data, sensor measurement uncertainty range, and digital twin model calibration error:

[0177]

[0178] Among them, the residual allowable interval Indicates the first The residual allowable interval for each residual channel; residual mean. and residual standard deviation Calculated based on data from no fewer than 100 trouble-free operation cycles; residual interval coefficient For dimensionless parameters, this specific implementation takes 3; the overall measurement uncertainty is... It has the same units as the corresponding residual channel.

[0179] Fault-free operating data establishes residual benchmarks for no-load, medium-load, and heavy-load conditions. When the current load is between 0% and 20% of the rated load, the no-load residual benchmark is used; when it is between 20% and 70% of the rated load, the medium-load residual benchmark is used; and when it is between 70% and 100% of the rated load, the heavy-load residual benchmark is used. When the current load is near the boundary of an adjacent load interval, linear interpolation is performed on two adjacent residual benchmarks.

[0180] When it is necessary to compare predicted residuals across residual channels, convert the predicted residuals into dimensionless normalized residuals:

[0181]

[0182] Among them, normalized residuals The values ​​are dimensionless. Whether a single residual channel exceeds the allowable residual range is determined by the predicted residual with corresponding physical units; the sorting, summation, and maximum residual calculation of residuals between different residual channels are performed using normalized residuals.

[0183] An abnormal residual channel is determined to be formed when any state residual channel or execution response residual channel continuously reaches the preset abnormal confirmation period and exceeds the corresponding residual allowable range. The abnormal confirmation period for position residual, speed residual, drive current residual, and braking pressure residual is set to 3 control periods; the abnormal confirmation period for hoisting rope tension residual is set to 4 control periods; and the abnormal confirmation period for braking response time residual is set to 2 control periods.

[0184] like Figure 3 As shown, the model state propagation graph consists of input state nodes, output state nodes, model parameter nodes, and directed edges between the nodes. Each directed edge records the source model node, the target model node, the name of the propagated state, the minimum propagation delay, and the maximum propagation delay.

[0185] The model state propagation graph is established according to the following process: First, an input state node is established for each state component in the physical operation state of the cage; second, an output state node is established for each predicted state and predicted execution response output by the current digital twin model; third, a model parameter node is established for each adjustable model parameter in Table 3; finally, directed edges are established according to the input-output dependencies of each sub-model.

[0186] The state propagation delay interval for directed edges was determined through model calibration experiments. During model calibration, under conditions of safe cage shutdown or controller-in-the-loop simulation, a step change of a specified magnitude was applied to the input state or model parameters, and the control period during which the target output state began to show a identifiable change and the control period during which the output state reached a stable direction of change were recorded. The control period during which a identifiable change began corresponds to the minimum state propagation delay, and the control period during which the stable direction of change was reached corresponds to the maximum state propagation delay.

[0187] The threshold for identifiable change is set to 10% of the half-width of the allowable interval for the corresponding residual, and is not less than the single-measurement resolution of the corresponding data source. For example, if the change in the brake execution response residual caused by the change in the brake response time constant exceeds 6 milliseconds, it is determined that an identifiable change has begun to occur in the brake execution response residual.

[0188] When multiple anomalous residual channels occur, the model propagation graph is traced backward from the output state node corresponding to each anomalous residual channel to the input state node and model parameter node, forming a candidate residual propagation path. For adjacent anomalous residual channels on the candidate residual propagation path, the time difference for the first time exceeding the allowable residual interval is calculated.

[0189]

[0190] Among them, the first abnormal control cycle number Second abnormal control cycle number All are dimensionless integers; abnormal residual time difference The unit is seconds.

[0191] The cumulative state propagation delay intervals for multiple directed edges along the candidate residual propagation path are calculated using interval addition:

[0192]

[0193] Among them, the cumulative state propagation delay interval of the candidate residual propagation path The unit is seconds; the directed edge state propagation delay interval Indicates the first candidate residual propagation path The state propagation delay interval of a directed edge; the number of path edges. Dimensionless integers; interval addition symbol This means that the lower limits of each interval are added together and the upper limits of each interval are added together.

[0194] When abnormal residual time difference If the time difference of an abnormal residual is within the cumulative state propagation delay interval of the corresponding candidate residual propagation path, the corresponding candidate residual propagation path is retained; if the time difference of an abnormal residual is not within the cumulative state propagation delay interval, the corresponding candidate residual propagation path is deleted.

[0195] In addition to the model state propagation graph, a data source common cause topology graph is also established. This graph includes sensor nodes, power supply branch nodes, communication link nodes, data acquisition module nodes, and data source group nodes. Each dependency edge records the dependency type, upstream node, downstream node, minimum fault propagation delay, and maximum fault propagation delay.

[0196] For example, location data source group A and tension data source group A are powered by a 24V DC power supply branch P1 and transmitted via an industrial Ethernet switch SW1; location data source group B is powered by an independent safety power supply branch P2 and transmitted via a safety bus link B. The fault propagation delay from power supply branch P1 to location data source group A is 20 milliseconds to 70 milliseconds, and the fault propagation delay from power supply branch P1 to tension data source group A is 30 milliseconds to 90 milliseconds.

[0197] When residual channels corresponding to multiple data source groups become abnormal, the power supply branch node, communication link node, and data acquisition module node are traced upstream from the corresponding data source group node. If multiple abnormal data source groups share the same upstream node, and the timing of the abnormality matches the corresponding cumulative fault propagation delay interval, the multiple abnormal data sources are combined into a single data source group to be judged. If the upstream node sets of multiple abnormal data source groups are mutually exclusive, the multiple abnormal data source groups are determined to be independent data source groups.

[0198] Both the data source group to be judged and the independent data source group are input into the sensor counterfactual branch. The sensor counterfactual branch is based on... Figure 4 The process shown is running.

[0199] The following example, using the case where the location residual corresponding to location data source group A exceeds the allowable residual range, illustrates the sensor counterfactual branch. First, the validity flag of location data source group A in the data source validity mask is set to 0, while the validity flags of other data sources remain unchanged. Second, the first candidate state interval is determined based on other valid location data sources and their corresponding measurement uncertainty intervals.

[0200] The cage position given by the wellbore magnetic marker is 412.401 meters, with a measurement uncertainty interval of ±0.035 meters. Therefore, the first candidate state interval is:

[0201]

[0202] The current digital twin model predicts the cage position at 412.382 meters under the same control cycle, with an uncertainty range of ±0.028 meters. Therefore, the second candidate state interval is:

[0203]

[0204] The uncertainty interval of the model prediction is determined based on the prediction error range of the current digital twin model in fault-free calibration data.

[0205] Projecting the dynamic executable state envelope onto the cage position dimension yields the state constraint interval:

[0206]

[0207] The common interval of the three intervals is:

[0208]

[0209] Based on the aforementioned data, the common interval is from 412.366 meters to 412.410 meters. The cage position in the previous control cycle was 412.352 meters. Therefore, the state value with the smallest absolute value of the difference between the common interval and the cage position in the previous control cycle is selected as the constraint reconfiguration state, that is, 412.366 meters is determined as the constraint reconfiguration position.

[0210] For any continuous state component The constraint reconstruction state within the common interval that is closest to the state component corresponding to the previous control cycle is determined according to the following formula:

[0211]

[0212] Among them, the constraint reconstruction state and the state of the previous control cycle It has the same physical unit as the corresponding state component; state common region This represents the common interval of the corresponding state components.

[0213] When the three intervals have no common part, the data source group to be judged is kept invalid, and the intersection of the union of the first candidate state interval and the second candidate state interval with the state constraint interval is calculated. When the corresponding intersection is empty, it is determined that the state reconstruction condition is not met, and a safety rollback request is immediately generated; when the corresponding intersection is not empty, the corresponding intersection is set as an extended state uncertainty interval, and no normal operation control command is generated, only controlled deceleration candidate control command or safety braking candidate control command is allowed to be generated.

[0214] After replacing the corresponding state of the data source group to be judged with the constrained reconstruction state, keep the model parameters and executed control instructions of the current digital twin model unchanged, and recalculate each residual channel. Record the control cycle number of each abnormal residual channel entering the corresponding residual allowable interval, whether each normal residual channel remains within the corresponding residual allowable interval, and whether the executed response residual channel enters the corresponding residual allowable interval.

[0215] The counterfactual branch of the model determines the upstream adjustable model parameters of the abnormal residual channel according to the model state propagation diagram. Taking the position residual and braking execution response residual simultaneously exceeding the corresponding residual allowable range as an example, the candidate model parameters include equivalent moving mass, braking pressure torque coefficient, and braking response time constant.

[0216] Candidate model parameters The positive and negative parameter perturbation values ​​are as follows:

[0217]

[0218]

[0219] Wherein, the current parameter value Positive parameter perturbation value Negative parameter perturbation value and parameter perturbation step size All have the same characteristics as the first The candidate models have the same physical units as the parameters.

[0220] When the difference between the current parameter value and the upper limit of the physical parameter range is less than one parameter perturbation step, the positive parameter perturbation step is adjusted to the difference between the current parameter value and the upper limit of the physical parameter range; when the difference between the current parameter value and the lower limit of the physical parameter range is less than one parameter perturbation step, the negative parameter perturbation step is adjusted to the difference between the current parameter value and the lower limit of the physical parameter range. The adjusted parameter perturbation value must not exceed the corresponding physical parameter range.

[0221] The model's counterfactual branch, while maintaining the control cycle data frames, data source validity mask, cage physical operating state, and executed control commands unchanged, replays the data using the current parameter values, positive parameter perturbation values, and negative parameter perturbation values, respectively. Each replay begins at least 10 control cycles before the first occurrence of the abnormal residual and continues for at least 20 control cycles after the first occurrence of the abnormal residual.

[0222] For each candidate model parameter, record the affected residual channels, the direction of change of the predicted residual, the control period during which the predicted residual first shows an identifiable change, and the consistency change between the predicted execution response and the measured execution response, forming a record of the parameter residual influence relationship.

[0223] The parameter residual impact relationship record should include at least the candidate model parameter name, current parameter value, parameter disturbance direction, parameter disturbance value, set of affected residual channels, residual change direction, first change control period, corresponding cumulative state propagation delay interval, execution response consistency change, and normal residual channel status.

[0224] For example, after the braking response time constant is increased from 180 milliseconds to 200 milliseconds, the braking execution response residual begins to decrease in the third control cycle after the disturbance, and the speed residual begins to decrease in the fifth control cycle after the disturbance. The cumulative state propagation delay interval from the braking response time constant to the braking execution response residual is 100 milliseconds to 200 milliseconds, and the cumulative state propagation delay interval to the speed residual is 200 milliseconds to 350 milliseconds. The third control cycle corresponds to 150 milliseconds, and the fifth control cycle corresponds to 250 milliseconds, both of which are within the corresponding cumulative state propagation delay intervals. Therefore, the braking response time constant is retained as a candidate model parameter.

[0225] The sensor source prediction residual, model source prediction residual, and composite source prediction residual are determined according to the conditions shown in Table 4.

[0226] Table 4. Criteria for Determining the Source of Predicted Residuals

[0227] Determine the category Sensor Counterfactual Branch Model counterfactual branch Normal residual channel Execution response residual channel Sensor source prediction residual All abnormal residual channels enter the corresponding residual allowable range. Not a necessary condition All remain within the corresponding residual allowable range Enter the corresponding residual allowable interval Model source prediction residuals At least one abnormal residual channel still exceeds the corresponding residual allowable range All abnormal residual channels enter the corresponding residual allowable range. All remain within the corresponding residual allowable range Enter the corresponding residual allowable interval Composite source prediction residual The first set of abnormal residual channels enters the corresponding residual allowable range. The second set of abnormal residual channels enters the corresponding residual allowable interval. All remain within the corresponding residual allowable range Enter the residual allowable range according to the corresponding anomaly source.

[0228] When determining the composite source prediction residual, the first abnormal residual channel set and the second abnormal residual channel set are both non-empty proper subsets of the entire abnormal residual channel set, and the union of the first abnormal residual channel set and the second abnormal residual channel set is equal to the entire abnormal residual channel set.

[0229] When the residual is determined to be a sensor source prediction, the corresponding data source group to be judged is set to invalid, and the state uncertainty interval is determined based on other valid data sources, the measurement uncertainty interval, and the current digital twin model prediction interval. When the residual is determined to be a model source prediction, the process of determining the minimum model parameter set and verifying the shadow digital twin model begins. When the residual is determined to be a composite source prediction, the process proceeds according to... Figure 5 The process shown is used to separate the prediction residuals of the composite source.

[0230] No. The composite source prediction residual vector for each control cycle is represented as:

[0231]

[0232] Among them, the number of residual channels is a dimensionless integer. The vector components in the composite source prediction residual vector are arranged in a uniform residual channel order, and the physical units of the corresponding residual channels are retained respectively.

[0233] The data source groups whose corresponding residual channels changed from within the residual allowable range to outside the residual allowable range between adjacent control cycles are sequentially set to invalid. The difference in predicted residuals before and after the data source group is set to invalid is used as the sensor source residual component.

[0234]

[0235] Among them, the sensor source residual component Predicted residual vector before failure and the predicted residual vector after failure All are arranged in the same residual channel order, and vector subtraction is performed channel by channel.

[0236] Subtract the sensor source residual components from the composite source prediction residual vector to obtain the remaining prediction residual vector:

[0237]

[0238] The remaining predicted residual vector is input into the counterfactual branch of the model, and the source residual components of the model are obtained based on the influence relationship of the parameter residuals. The sensor source residual components and the model source residual components are combined to form the reconstructed residual vector:

[0239]

[0240] For the For each residual channel, calculate the difference between the reconstructed residual and the composite source prediction residual:

[0241]

[0242] Among them, reconstruction error With the first Each residual channel uses the same physical unit. When all reconstruction errors are within the allowable residual range of the corresponding residual channel, the separation of the composite source prediction residuals is considered complete.

[0243] If any residual channels still do not meet the reconstruction closure conditions, the system expands upstream by one level along both the model state propagation graph and the data source common cause topology graph, adding newly discovered data source groups and model parameters to the scope of the pending judgment. During expansion, only data source groups and model parameters that have a directed path or common upstream relationship with the unclosed residual channels are added. The maximum expansion level is 3 levels; if separation is still not completed after reaching 3 levels, the expansion of the candidate model parameter set and the scope of the pending data source groups stops, and a safe rollback instruction is generated.

[0244] Before the isolated data source group is restored to access, the current valid data source group is merged to form a first fusion state, and the current valid data source group and the data source group to be restored are merged together to form a second fusion state. Forward simulation is performed on the first fusion state and the second fusion state using the same current digital twin model and the same candidate control command sequence, respectively, to obtain the first predictive state tube and the second predictive state tube.

[0245] The distance between the predicted state tube and the dynamic executable state envelope is calculated using normalized state coordinates. For state components... The normalized state coordinates are represented as:

[0246]

[0247] Among them, normalized state coordinates Dimensionless numerical values; the dynamic executable state envelope in the state components Midpoint It has the same unit as the corresponding state component; the dynamic executable state envelope is in the state component upper half width Greater than 0.

[0248] The distance to the first safety boundary is determined according to the following formula:

[0249]

[0250] Among them, the number of predictive control cycles A dimensionless integer; the cross-section of the tube in the first predicted state. and dynamic executable state envelope boundary All are represented using normalized state coordinates; distance function This represents the minimum Euclidean distance from the cross section of the predicted state tube to the boundary of the dynamic executable state envelope.

[0251] Second safety boundary distance The second predictive state tube calculates the same result. The data source group to be restored is set to valid only when both the first and second predictive state tubes are within the dynamic executable state envelope, the first control command determined by the two forward simulations is the same, the second safety boundary distance is not less than the first safety boundary distance, and the set of residual propagation paths formed after the restoration of access is consistent with the set of residual propagation paths formed before the restoration of access.

[0252] Once the data source group to be restored is set to active, the fusion weight does not immediately revert to the target fusion weight, but instead increases from 0 in each control cycle.

[0253]

[0254] Among them, restoring fusion weights Integration weights with target All are dimensionless weights; restore weight increments This represents the dimensionless weight that is added in each control cycle.

[0255] In this specific implementation, the recovery fusion weight is increased from 0 to the target fusion weight over 20 control cycles, with a recovery duration of 1 second. Each time the recovery fusion weight is increased, the first and second predicted state transistors are re-compared. If the first control command determined by the two forward simulations differs, the second safety boundary distance is less than the first safety boundary distance, or a new abnormal residual propagation path is formed after recovery, the data source group to be recovered is reset to invalid, and the fusion weight is set to 0.

[0256] like Figure 6 As shown, after determining the source prediction residuals of the model, the minimum set of model parameters is determined based on the influence relationship of the parameter residuals.

[0257] First, for each candidate model parameter, the sets of abnormal residual channels and normal residual channels that can be affected by parameter perturbation are determined. Only candidate model parameters whose normal residual channels are all within the corresponding residual allowable intervals after parameter perturbation are retained. Subsequently, candidate parameter combinations are generated layer by layer, starting from 1, according to the number of candidate model parameters.

[0258] For each candidate parameter combination, verify the following conditions in sequence: the union of the abnormal residual channels covered by the candidate parameter combination covers all abnormal residual channels; the direction of residual change caused by each parameter disturbance is consistent with the direction of the residual propagation path; the control period in which the first identifiable change occurs in each residual channel is within the corresponding cumulative state propagation delay interval; and all normal residual channels are within the corresponding residual allowable interval.

[0259] The first candidate parameter combination level that meets the aforementioned conditions corresponds to the minimum number of model parameters. For multiple candidate parameter combinations in the corresponding candidate parameter combination level, the sum of the normalized values ​​of the outlier residuals is calculated:

[0260]

[0261] Among them, the parameter combination evaluation value Dimensionless numerical values; candidate parameter combinations This represents the set of model parameters currently being evaluated; and the set of abnormal residual channels. Represents all abnormal residual channels; parameter combination normalized residuals Indicates the use of candidate parameter combinations After replay Normalized residuals of each abnormal residual channel.

[0262] The candidate parameter combination with the fewest model parameters and the smallest parameter combination evaluation value is determined as the minimum model parameter set.

[0263] For example, abnormal residual channels include position residuals, velocity residuals, and braking response residuals. Candidate model parameters include equivalent moving mass, braking pressure torque coefficient, braking response time constant, and torque current coefficient. Updating only the braking pressure torque coefficient can reduce the velocity and braking response residuals, but cannot bring the position residual into its corresponding allowable range. Simultaneously updating the braking pressure torque coefficient and braking response time constant can cover all abnormal residual channels, and the normal residual channels remain within their corresponding allowable ranges. After adding the equivalent moving mass, the tension residual exceeds its corresponding allowable range. Therefore, the braking pressure torque coefficient and braking response time constant are determined as the minimum set of model parameters.

[0264] Candidate parameter update combinations are formed within the physical range of each model parameter in the minimum set of model parameters. For each model parameter, centered on the current parameter value, the current parameter value, two positive candidate values, and two negative candidate values ​​are selected according to the single perturbation step size. Candidate values ​​outside the physical parameter range are not included in the combination.

[0265] When the number of candidate parameter update combinations does not exceed 625, all candidate parameter update combinations are replayed. When the number of candidate parameter update combinations exceeds 625, coarse-grid replay is first performed at twice the single perturbation step size, and then fine-grid replay is performed with the parameter combination with the smallest evaluation value in the coarse-grid as the center, according to the single perturbation step size.

[0266] Each candidate parameter update combination generates a candidate shadow digital twin model. The candidate shadow digital twin model has the same model structure as the current digital twin model, only the model parameters are different. The candidate shadow digital twin model must not generate control commands to be directly sent to the lifting drive device or braking device before verification is completed.

[0267] The historical playback data segments cover the acceleration, constant speed, deceleration, crawling, leveling, and braking phases of the cage. At least three data segments with different load levels are selected for each operating phase. The load range for the unloaded data segment is 0% to 15% of the rated load; the load range for the medium-load data segment is 40% to 60% of the rated load; and the load range for the heavy-load data segment is 85% to 100% of the rated load. Each data segment includes data from at least 10 control cycles before the start of the corresponding operating phase and data from at least 10 control cycles after the end of the operating phase.

[0268] The current digital twin model and the candidate shadow digital twin model use the same initial cage physical operating state, data source validity mask, and executed control commands for replay. Each replay generates a predicted state tube, as well as residual channels for each state and execution response residual channels.

[0269] A candidate shadow digital twin model is determined to be activated only if it meets the following conditions simultaneously: the prediction state tubes corresponding to all replay data segments are all within the dynamic executable state envelope; the absolute value of the replay residual of all abnormal residual channels is less than the absolute value of the replay residual corresponding to the current digital twin model; and all normal residual channels are within the corresponding residual allowable range.

[0270] When multiple shadow digital twin models exist to be activated, calculate the maximum normalized outlier residual for each shadow digital twin model to be activated:

[0271]

[0272] Among them, the maximum normalized outlier residual Indicates the first The maximum normalized outlier residual corresponding to each shadow digital twin model to be activated; shadow model normalized residual Indicates the first The first unactivated shadow digital twin model in the first... The normalized residuals in each of the anomalous residual channels are used to identify the shadow digital twin model to be activated, which is then identified as the shadow digital twin model.

[0273] The version management unit configures the current model version identifier for the current digital twin model and the pending model version identifier for the shadow digital twin model. The model version identifier uses an incrementing unsigned integer. The currently running version area, the pending model version area, and the rollback model version area are located in memory with power-loss retention capability.

[0274] Each model version area stores the model version identifier, model structure validation value, model parameter table, parameter table validation value, version generation time, applicable data source validity mask, applicable control constraint version identifier, and version status. Version status includes currently running, pending submission, rolled back, and frozen.

[0275] The shadow digital twin model does not generate target control commands or update the dynamic executable state envelope when in the pending activation state. The safety interlock sub-model outputs the allowed operating phase transition state based on the cage operation stage, safety interlock state, and actuator state.

[0276] Permissible transition boundaries during operation include the boundary between the acceleration phase and the constant speed phase, the boundary between the constant speed phase and the deceleration phase, the boundary between the deceleration phase and the crawling phase, and the boundary between the crawling phase and the leveling phase. Model version switching is not allowed during rapid brake pressure build-up, during changes in drive torque ramp, during changes in safety interlock status, and during periods when execution receipts are not completed.

[0277] When both the lifting drive and braking devices return a confirmation message indicating completion of the previous control command, and the safety interlock sub-model outputs a state indicating a transition to the operational phase, the version management unit writes the version identifier of the model to be activated and the corresponding model parameters into the version area of ​​the model to be submitted. After writing, the model parameter table and model structure are verified; if the verification passes, the status of the model version to be submitted is set to switchable.

[0278] At the start of the next control cycle, the shadow digital twin model in the pending model version area is switched to the current digital twin model, and the previous current digital twin model is saved as the rollback model version. The model version switch and control instruction queue update are performed in the same indivisible update operation. If either operation fails, the original current digital twin model and the original control instruction queue remain unchanged.

[0279] After the model version is switched, all candidate control instruction sequences that carry the identifier of the model version before the switch and are in the pending execution state will be set to invalid, and the candidate control instruction sequences will be regenerated using the current digital twin model after the switch.

[0280] The switching verification period begins at the moment of model version switching and continues until the execution response of the first control command after both the lifting drive and braking devices have completed the switching. When the response time of the lifting drive is 180 milliseconds and the response time of the braking device is 320 milliseconds, the switching verification period is set to 400 milliseconds.

[0281] If abnormal prediction residuals are generated during the switching verification cycle, any normal residual channel exceeds the corresponding residual allowable range, or the number of target control command sequences is zero, the rollback model version will be restored, and the corresponding model version to be activated will be set to a frozen state. The frozen model version shall not be allowed to re-enter the pending model version area until the model parameter diagnosis and all historical data segment replay verification are completed again.

[0282] like Figure 7 As shown, the dynamic executable state envelope is generated in predictive control cycles based on the current braking capacity of the cage, the elastic elongation of the hoisting rope, the remaining stopping distance, the cage clearance, the tension difference of the hoisting rope, the drive current, and the safety interlock status.

[0283] The current braking capacity range is determined based on the measured braking deceleration of the most recent effective braking process and the predicted braking deceleration output by the drive braking sub-model:

[0284]

[0285] Among them, the current braking capacity range The unit is meters per second squared; measured braking deceleration Calculate and predict braking deceleration based on the speed change during the most recent braking process. Output from the driving brake sub-model; Comprehensive uncertainty of braking deceleration Determined based on speed measurement uncertainty and braking model calibration error.

[0286] The measured braking deceleration is calculated based on the velocity change after the braking effect is established:

[0287]

[0288] Among them, the control cycle number Indicates the initial control cycle after braking action is established; control cycle number. Indicates the end of the braking evaluation control cycle; cage speed. and The units are all meters per second.

[0289] For example, if the measured braking deceleration is 1.18 m / s², the predicted braking deceleration is 1.24 m / s², and the overall uncertainty of braking deceleration is 0.08 m / s², then the current braking capacity range is from 1.10 m / s² to 1.32 m / s².

[0290] In this specific embodiment, the 960-meter hoisting rope is divided into 48 hoisting rope micro-elements, each 20 meters in length. The elastic modulus of the hoisting rope is propagated in the range of 78 GPa to 102 GPa, and the tension of the hoisting rope is propagated according to the measured tension and the corresponding measurement uncertainty range. Thus, the elastic elongation range of the hoisting rope during the heavy load deceleration stage is obtained as 0.612 meters to 0.748 meters.

[0291] The joint boundary of position and velocity for each predictive control cycle is determined by the following conditions:

[0292]

[0293] Among them, the prediction speed The unit is meters per second; lower limit of braking capacity The unit is meters per second squared; the upper limit of the elastic elongation of the rope. The unit is meters; maximum braking setup delay The unit is seconds; parking safety margin The unit is meters; remaining available parking distance The unit is meters.

[0294] For example, if the current speed of the cage is 5.2 meters per second, the lower limit of the current braking capacity range is 1.10 meters per square second, the upper limit of the elastic elongation range of the hoisting rope is 0.748 meters, the maximum brake settling delay is 0.32 seconds, and the stopping safety margin is 0.50 meters, then the conservative stopping distance is:

[0295]

[0296] Among them, conservative parking distance The unit is meters.

[0297] The lateral displacement boundary is determined by subtracting measurement uncertainty, installation deviation, and dynamic oscillation margin from the available tank clearance:

[0298]

[0299] Among them, the upper limit of lateral displacement Available tank clearance Uncertainty of gap measurement Installation deviation and dynamic oscillation margin All units are millimeters. The lateral displacement boundary is set as follows:

[0300]

[0301] Among them, the lateral displacement boundary Indicates the first The allowable lateral displacement range of the cage during each predictive control cycle.

[0302] The hoisting rope tension difference boundary is determined based on the permissible tension imbalance rate provided by the hoisting rope manufacturer and the current average hoisting rope tension. The drive current boundary is determined based on the continuous permissible current, short-time permissible current, and current thermal state of the hoisting drive unit. The safety interlock state boundary is determined based on the permissible operating phase output by the safety interlock sub-model.

[0303] The position and velocity joint boundary, lateral displacement boundary, hoisting rope tension difference boundary, drive current boundary, and safety interlock state boundary are arranged according to the predictive control cycle to form a dynamic executable state envelope. When any boundary of the dynamic executable state envelope changes, a new control constraint version identifier is generated for the updated dynamic executable state envelope.

[0304] The initial state interval and model parameter interval are determined based on the state uncertainty interval and the physical parameter ranges of each model parameter in the current digital twin model. The model parameter interval is represented as follows: .

[0305] No. Forward propagation of the interval corresponding to each candidate control command sequence is performed according to the following formula:

[0306]

[0307] Among them, the predicted state interval The control commands are represented by the upper and lower limits of each state component. This includes drive torque commands, braking pressure commands, and the number of continuous control cycles; interval state transition mapping. Determined by the current digital twin model; predicted state interval Indicates execution of the first The state interval of the next predictive control cycle is formed after the control command of the predictive control cycle.

[0308] For model relationships with definite monotonicity within the state interval and model parameter interval, the upper and lower bounds of the predicted state are calculated by combining the endpoints of the input interval and the model parameter interval. For nonlinear model relationships with uncertain monotonicity, the input state interval and the model parameter interval are each divided into two equal parts, forward propagation is performed on each sub-interval, and the union of the outputs of all sub-intervals is taken.

[0309] After two consecutive interval subdivisions, subdivision stops when the change in the width of the predicted state interval is less than 10% of the width of the corresponding state measurement uncertainty interval, or when the interval subdivision level reaches 4 levels. The aforementioned subdivision rules are used to limit the amount of online computation and ensure that the forward simulation of candidate control commands is completed within each control cycle.

[0310] The predicted state intervals arranged according to the predictive control cycle form a predictive state tube. Each cross section of the predictive state tube is located within the dynamic executable state envelope of the corresponding predictive control cycle, and when the predicted states before and after the transition of the operation phase both meet the allowable operation phase specified by the safety interlock sub-model, the corresponding candidate control instruction sequence is determined as a valid candidate control instruction sequence.

[0311] like Figure 8 As shown, the candidate control instruction tree consists of control nodes and candidate branches. The root control node records the current operating stage, the physical operating status of the cage, the data source validity mask, the model version identifier, and the control constraint version identifier. Each candidate branch records the control instruction, the duration of the control instruction, the predicted state tube, and the target operating stage.

[0312] Candidate control commands are generated discretely based on the current operating phase. During the acceleration and constant speed phases, the drive torque command is generated at 90%, 95%, 100%, 105%, and 110% of the current drive torque; during the deceleration phase, the deceleration command is generated at 0.6 m / s², 0.8 m / s², 1.0 m / s², and 1.2 m / s²; during the crawling and leveling phases, the speed command is generated at 0.2 m / s, 0.3 m / s, and 0.4 m / s; and during the braking phase, the braking pressure command is generated by increasing the current braking pressure by 0.05 MPa each time.

[0313] Each candidate control command lasts for 1 to 5 control cycles. Candidate control commands that exceed the rated range of the lifting drive device, exceed the rated range of the braking device, or do not meet the safety interlock conditions are not written into the candidate control command tree.

[0314] The branch dependency index records the data source validity mask bits, model parameter nodes, control constraint dimensions, and prediction control cycles that the corresponding prediction state tube depends on. For example, for a certain deceleration candidate branch, the data source validity mask bits, braking response time constant, position and velocity joint boundary, and the first to eighth prediction control cycles correspond to the location data source group A.

[0315] When the data source validity mask, model version identifier, or control constraint version identifier changes, the candidate branches affected by the change and their corresponding lower-level candidate branches are set to invalid according to the branch dependency index, while the prediction state of unaffected candidate branches is retained.

[0316] For invalid candidate branches, trace upwards along the candidate control instruction tree and determine the nearest parent control node whose data source validity mask, model version identifier, and control constraint version identifier are all consistent with the current control cycle as the starting control node for resimulation. The affected candidate branches are regenerated from the starting control node for resimulation and participate in the selection of the target control instruction sequence together with the retained candidate branches.

[0317] Before retaining a candidate branch to participate in control instruction selection, a boundary check is performed on the corresponding predicted state tube. The retention safety distance for the position dimension is set to 0.30 meters, the retention safety distance for the velocity dimension is set to 0.08 meters per second, and the retention safety distance for the lateral displacement dimension is set to 0.60 millimeters. If the minimum distance between the predicted state tube and the updated dynamic executable state envelope is less than any of the corresponding retention safety distances, the corresponding retained candidate branch is re-set to invalid.

[0318] Among all valid candidate control command sequences, the sequence with the largest minimum distance from the predicted state tube to the boundary of the dynamically executable state envelope, the smallest target docking position error, and the smallest change in control command is selected first. After determining the target control command sequence, only the first control command in the target control command sequence is sent to the lifting drive device or braking device. In the next control cycle, multi-source operating data is reacquired and residual judgment and forward simulation are re-executed.

[0319] When the number of target control command sequences is zero, or when the composite source prediction residual has reached the preset maximum expansion level but separation has not been completed, a composite state uncertainty interval is formed based on the measurement uncertainty interval of the corresponding state value of the data source group to be judged and the physical parameter range of the candidate model parameters.

[0320] Let the initial position interval along the lifting direction be... The controlled deceleration displacement range is The controlled deceleration stopping position range is:

[0321]

[0322] Among them, the controlled deceleration stop position range and initial position interval The units are all meters; controlled deceleration displacement range The unit is meters; interval addition symbol This indicates that interval addition is performed according to the direction of cage movement.

[0323] The lower limit of the controlled deceleration displacement range is calculated using the lower limit of the speed range, the upper limit of the braking capacity range, the lower limit of the lifting rope elastic elongation range, and the lower limit of the controlled brake establishment delay range; the upper limit of the controlled deceleration displacement range is calculated using the upper limit of the speed range, the lower limit of the braking capacity range, the upper limit of the lifting rope elastic elongation range, and the upper limit of the controlled brake establishment delay range. The braking capacity range and the brake establishment delay range are jointly determined by the most recent effective braking test data and the drive brake sub-model.

[0324] The available parking area is determined based on the target parking location, the allowable leveling range, the shaft safety boundary, and the over-winding protection boundary. The available parking area is formed by intersecting the allowable leveling range corresponding to the target parking location with the shaft safety boundary range. For example, if the target parking location is 930.000 meters, the allowable leveling range is ±0.800 meters, and the shaft safety boundary does not further reduce the corresponding allowable leveling range, the available parking area is from 929.200 meters to 930.800 meters.

[0325] When the controlled deceleration stop position range is entirely within the available parking area, a controlled deceleration command is sent to the lifting drive device via the motion control channel, and a safety latch command is sent via the safety control channel. The safety latch command causes the safety latch unit to enter the latching state, but does not immediately trigger the safety brake.

[0326] When any part of the controlled deceleration stop position range exceeds the available parking range, a lift drive force cut-off command is sent through the motion control channel, and a safety braking command is sent to the independent safety control circuit through the safety control channel. The independent safety control circuit disconnects the lift drive enable and drives the braking device into the safety braking state.

[0327] Each safety rollback instruction includes a control instruction sequence number, model version identifier, data source validity mask, control constraint version identifier, instruction generation control cycle, and instruction validity control cycle. Execution receipts returned by the lifting drive device, braking device, and independent safety control circuit all include the control instruction sequence number, reception timestamp, start execution timestamp, execution completion timestamp, and execution result.

[0328] The safety-type programmable logic controller (PLC) checks the control instruction sequence number in the safety rollback instruction and execution receipt one by one. If any execution receipt times out, the control instruction sequence number is inconsistent, or the execution result is abnormal, the system maintains the safety latch state and outputs a safety rollback exception record.

[0329] The safety latching state can only be released when the following conditions are met simultaneously: the cage is at zero speed; the braking device is in the closed state; the effective data source group covers the cage position, cage speed, current load, hoisting rope tension, cage clearance, drive braking status, and safety interlock status; all residual channels obtained by replaying the control cycle data frames during the safety latching period from the current digital twin model are within the corresponding residual allowable range; the current model version identifier is consistent with the model version identifier in the safety rollback instruction; and the control instruction sequence numbers returned by the hoisting drive device, braking device, and independent safety control circuit are consistent with the control instruction sequence numbers in the corresponding safety rollback instruction.

[0330] Zero speed state refers to the absolute value of the cage speed not exceeding 0.02 meters per second and maintained continuously for no less than 10 control cycles. Braking device closed state refers to the brake switch feedback being closed, the braking pressure reaching the lower limit of the closing pressure and maintained continuously for no less than 5 control cycles.

[0331] After the safety latch release condition is met, the current digital twin model is reinitialized with the latest physical operating state of the cage, the candidate control instruction sequence generated before the safety latch is cleared, the dynamic executable state envelope and candidate control instruction tree are regenerated, and the safety latch state is released after confirmation by the safety programmable logic controller.

[0332] To verify this method, a controller-in-the-loop (CIL) simulation platform was used. The simulation platform includes a real-time cage model with the same control cycle as the safety-type programmable logic controller (PLC), a sensor data injection interface, a drive and braking response model, a shaft boundary model, and a safety control interface. The simulation platform's control cycle was set to 50 milliseconds, and the prediction time domain was set to 3 seconds, corresponding to 60 predictive control cycles.

[0333] Three types of identification tests were conducted: sensor source prediction residual, model source prediction residual, and composite source prediction residual, each with 200 runs. Each type of test was evenly distributed across no-load, medium-load, heavy-load, and acceleration, constant speed, deceleration, crawling, and leveling operation phases. The identification accuracy rate was the percentage of correctly identified results out of the total number of tests for that category.

[0334] Comparative Example 1 eliminates the sensor counterfactual branch and the model counterfactual branch, isolating the corresponding data source only when the prediction residual exceeds a fixed threshold. Comparative Example 2 retains other processing conditions, only eliminating the model version switching permission verification mechanism, which consists of the runtime transition boundary and the execution receipt of the previous control instruction.

[0335] The allowable range and control parameters for each residual channel are shown in Table 5.

[0336] Table 5. Allowable Range and Control Parameters for Residual Channel

[0337] Position residual channel ±0.065m 3 3.0s 400ms Speed ​​residual channel ±0.090m / s 3 3.0s 400ms Tension Residual Channel ±12.0kN 4 3.0s 400ms Drive current residual channel ±10.5A 3 2.0s 300ms Braking pressure residual channel ±0.22MPa 3 3.0s 400ms Braking Execution Response Residual Channel ±60ms 2 3.0s 400ms

[0338] The position encoder zero-point drift is continuously injected at a rate of 0.36 m / s for 0.5 seconds, resulting in a position offset of 0.18 m. Braking response time constant mismatch is achieved by adjusting the braking response time constant from 180 ms to 280 ms at a control cycle boundary. Power supply branch anomaly is achieved by reducing the supply voltage of the corresponding data source group to 75% of the rated voltage for 80 ms. Composite source anomaly is achieved by simultaneously injecting a position offset of 0.12 m and a change in the braking response time constant. Wellbore boundary change is achieved by reducing the available guideway clearance at a specified location by 3.5 mm.

[0339] The results of fault injection and prediction residual tracing are shown in Table 6.

[0340] Table 6. Results of Fault Injection and Predicted Residual Origin Tracing

[0341] Test conditions Injection failure Comparative Example 1 Judgment Result The judgment result of this specific implementation method Source separation time Trigger a safety rollback? Operating Condition 1 The position encoder zero drift is 0.18m. Sensor malfunction Sensor source prediction residual 0.35s no Operating Condition 2 The braking response time constant increased from 180ms to 280ms Mistakenly diagnosed as speed data source anomaly Model source prediction residuals 0.55s no Operating Condition 3 The voltage drop in power supply branch P1 was 80ms Two independent data sources are abnormal. Single common cause data source group 0.30s no Operating Condition 4 The position encoder offset was 0.12m, accompanied by an increase in the braking response time constant. Repeatedly isolate multiple data sources Composite source prediction residual 0.80s yes Operating Condition 5 The usable clearance in the tank passage is reduced by 3.5mm in some areas. Unidentified wellbore boundary changes Model source prediction residuals 0.65s no

[0342] The comprehensive simulation results of different control methods are shown in Table 7.

[0343] Table 7. Comprehensive Simulation Results of Different Control Methods

[0344] Sensor source prediction residual identification accuracy 82.50% 85.00% 97.50% Model source prediction residual identification accuracy 61.00% 88.00% 96.00% Accuracy of composite source prediction residual identification 38.00% 65.00% 92.00% Number of times a normal data source error is isolated during 500 trouble-free runs 17 times 8 times 1 time Number of times unverified models entered control during 60 model switching operations 0 times 11 times 0 times Maximum acceleration abrupt change during 60 model switching operations 0.46m / s² 0.39m / s² 0.11m / s² Number of times the command is executed after the state tube goes out of bounds in 300 constraint changes 9 times 5 times 0 times Number of times the stopping position exceeded the available parking zone in 200 safe parking verifications 3 times 2 times 0 times

[0345] Simulation results show that, by adopting sensor counterfactual branching and model counterfactual branching, the source of predicted residuals can be determined based on the changes in residual recovery direction, recovery order, propagation delay, and execution response caused by constraint reconstruction state replacement and model parameter disturbances; by adopting shadow digital twin model with input playback, normal residual channel protection, and operation phase transition boundary switching, unverified model versions can be restricted from entering the control process; by adopting dynamic executable state envelope, predicted state tube, candidate control instruction tree, and safety backoff processing, candidate control instructions whose predicted states exceed the current safety constraints can be prevented from entering the execution link.

[0346] It should be noted that the embodiments of the present invention have better implementability and are not intended to limit the present invention in any way. Any person skilled in the art may use the above-disclosed technical content to change or modify it into equivalent effective embodiments. However, any modifications or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A cage operation control method based on digital twin and multi-sensor fusion, characterized in that, Performed by the cage's electrical control system, including: Collect cage position, hoisting rope tension, cage clearance, drive braking and safety interlock status, form control cycle data frames, generate data source validity mask and fuse to obtain the physical operating status of the cage; Input the physical operating status of the cage and the executed control commands into the current digital twin model. Based on the predicted status, predicted execution response, measured status and measured execution response, establish residual channels and residual allowable intervals, and determine abnormal residual channels. Based on the data source relationship and model propagation relationship corresponding to the abnormal residual channel, determine the data source group to be judged and the candidate model parameters. Replace the state of the data source group to be judged with the constraint reconstruction state to establish the sensor counterfactual branch. Replace the model parameter with the model parameter perturbation value to establish the model counterfactual branch. Determine the sensor source prediction residual, model source prediction residual or composite source prediction residual based on the branch residual recovery set, cumulative state propagation delay and execution response residual change. Isolate sensor source prediction residual data source group and form state uncertainty interval, determine minimum parameter set based on model source prediction residual and generate shadow digital twin model, use historical data to perform same input playback verification, and switch model version by conversion boundary during operation; Based on the braking capacity, the elastic elongation of the hoisting rope, and the wellbore boundary, a dynamic executable state envelope is formed. A verified digital twin model is used to perform forward simulation on the candidate control command sequence. The first control command in the target control command sequence whose predicted state tube is located within the dynamic executable state envelope is executed. If there is no target control command sequence or the composite source prediction residual separation fails, a safe backoff command is generated and the system enters a safe latching state.

2. The cage operation control method based on digital twin and multi-sensor fusion according to claim 1, characterized in that, The current digital twin model includes a cage kinematics sub-model, a hoisting rope dynamics sub-model, a drive and braking sub-model, a shaft boundary sub-model, and a safety interlocking sub-model; The input state, output state, and adjustable model parameters of each sub-model are used as model nodes, and the state propagation relationship between each model node within a control cycle is used as directed edges to form a model state propagation graph. Each directed edge records the source model node, the target model node, the propagation state, and the state propagation delay interval, respectively. The output state node corresponding to the abnormal residual channel is traced along the reverse directed edge of the model state propagation graph to form a candidate residual propagation path; For adjacent abnormal residual channels on the same candidate residual propagation path, the timing of the occurrence of abnormal residuals is determined based on the control cycle difference that the adjacent abnormal residual channels first exceed the corresponding residual allowable interval, and the candidate residual propagation path that covers the control cycle difference in the cumulative state transmission delay interval is determined as the residual propagation path.

3. The cage operation control method based on digital twin and multi-sensor fusion according to claim 2, characterized in that, The multi-source operating data characterizing the same state component in the physical operating state of the cage are divided into at least two data source groups, and a common cause topology graph of the data sources is established. The data source common cause topology graph includes sensor nodes, power supply branch nodes, communication link nodes and data source group nodes. Each data source group node is connected to the corresponding sensor node, power supply branch node and communication link node through dependency edges. Each dependency edge records the dependency type and fault propagation delay interval. When abnormal prediction residuals occur in the residual channels corresponding to multiple data source groups, trace the common upstream node of each data source group node along the common cause topology graph of the data source. Data sources that share the same common upstream node and whose abnormal residual occurrence timing matches the cumulative fault propagation delay interval from the common upstream node to each data source group node are grouped into the same data source group to be judged. Each set of upstream nodes that do not intersect with each other is identified as an independent data source group, and the data source group to be judged and the independent data source group are respectively input into the sensor counterfactual branch.

4. The cage operation control method based on digital twin and multi-sensor fusion according to claim 3, characterized in that, The sensor counterfactual branch is established in the following manner: The validity identifier of the data source group to be judged in the data source validity mask is set to invalid, and the first candidate state interval is determined according to other valid data source groups representing the same state component and the corresponding measurement uncertainty interval. The second candidate state interval is determined based on the predicted state of the current digital twin model within the same control cycle; The dynamic executable state envelope is projected onto the state dimension corresponding to the state component to obtain the state constraint interval; Determine the common interval of the first candidate state interval, the second candidate state interval, and the state constraint interval, and determine the state value with the smallest absolute value of the difference between the corresponding state component and the physical operation state of the cage in the previous control cycle within the common interval as the constraint reconstruction state; Under the condition that the model parameters of the current digital twin model and the executed control instructions remain unchanged, the state value corresponding to the data source group to be judged is replaced with the constraint reconstruction state, and the prediction residual of each residual channel is obtained again.

5. The cage operation control method based on digital twin and multi-sensor fusion according to claim 4, characterized in that, Restore access to the isolated data source group, including: The current valid data source group is merged to form a first fusion state, and the current valid data source group and the data source group to be restored are merged together to form a second fusion state; Using the same current digital twin model and the same candidate control instruction sequence, forward simulations are performed on the first fusion state and the second fusion state respectively to obtain the first prediction state tube and the second prediction state tube; The minimum distance from each cross section of the first and second predicted state tubes to the boundary corresponding to the dynamic executable state envelope is determined, and the minimum value among the minimum distances corresponding to the first predicted state tube is determined as the first safety boundary distance, and the minimum value among the minimum distances corresponding to the second predicted state tube is determined as the second safety boundary distance. When both the first and second predictive state tubes are located within the dynamic executable state envelope, the first control command determined by the two forward simulations is the same, the second safety boundary distance is not less than the first safety boundary distance, and the set of residual propagation paths formed after the recovery of access is consistent with the set of residual propagation paths before the recovery of access, the data source group to be recovered is set to be valid. The fusion weight of the data source group to be restored is increased from zero in each control cycle until the target fusion weight is determined according to the corresponding measurement uncertainty interval. When the first control command determined by the two forward simulations is different or the second safety boundary distance is less than the first safety boundary distance, the validity flag of the data source group to be restored is set to invalid and the corresponding fusion weight is set to zero.

6. The cage operation control method based on digital twin and multi-sensor fusion according to claim 4, characterized in that, The counterfactual branch of the model is established in the following manner: Based on the residual propagation path, determine the upstream adjustable model parameter node of the output state node corresponding to the abnormal residual channel, and form a candidate model parameter set; Within the range of physical parameters corresponding to each candidate model parameter, positive parameter perturbation and negative parameter perturbation are applied to each candidate model parameter respectively; While keeping the control cycle data frame, the data source validity mask, the cage physical operating state, and the executed control commands unchanged, the current digital twin models before and after parameter perturbation are used for playback. Record the residual channels affected by parameter perturbation of each candidate model parameter, the direction of prediction residual change, the control period in which the prediction residual first changes from the parameter perturbation input control period, and the consistency change between the prediction execution response and the measured execution response, to form the parameter residual influence relationship; The control period in which the first predicted residual change occurs is matched with the cumulative state propagation delay interval corresponding to the residual propagation path, and the candidate model parameters corresponding to the matching result are retained.

7. The cage operation control method based on digital twin and multi-sensor fusion according to claim 6, characterized in that, The sensor source prediction residual, the model source prediction residual, or the composite source prediction residual are determined in the following manner: When the sensor counterfactual branch causes the predicted residuals of all abnormal residual channels to enter the corresponding residual allowable range, the predicted residuals of each normal residual channel to remain within the corresponding residual allowable range, and the predicted residuals of the execution response residual channel to enter the corresponding residual allowable range, the sensor source predicted residual is determined. When the model counterfactual branch causes the predicted residuals of all abnormal residual channels to enter the corresponding residual allowable range, the predicted residuals of each normal residual channel to remain within the corresponding residual allowable range, the predicted residuals of the execution response residual channel to enter the corresponding residual allowable range, and after the sensor counterfactual branch processing, at least one abnormal residual channel still has a predicted residual exceeding the corresponding residual allowable range, the model source predicted residual is determined. When the sensor counterfactual branch causes the first abnormal residual channel set to enter the corresponding residual allowable interval, and the model counterfactual branch causes the second abnormal residual channel set to enter the corresponding residual allowable interval, and both the first abnormal residual channel set and the second abnormal residual channel set are non-empty proper subsets of the entire abnormal residual channel set, and the union of the first abnormal residual channel set and the second abnormal residual channel set is equal to the entire abnormal residual channel set, the composite source prediction residual is determined.

8. The cage operation control method based on digital twin and multi-sensor fusion according to claim 7, characterized in that, Separating the predicted residuals of the composite source includes: Sequentially invalidate the data source groups whose corresponding residual channels change from within the residual allowable range to outside the residual allowable range between adjacent control cycles, and re-obtain the physical operating status of the cage and the predicted residuals of each residual channel. The difference in the predicted residual value of the corresponding residual channel before and after each time the data source group is set to invalid is determined as the sensor source residual component of the corresponding data source group. The sensor source residual component is subtracted from the composite source prediction residual channel by channel, and the remaining prediction residual is input into the model counterfactual branch. The model source residual component is determined according to the parameter residual influence relationship. The sensor source residual component and the model source residual component are combined channel by channel to form the reconstructed residual; When the difference between the reconstructed residual and the composite source prediction residual are both within the corresponding residual allowable interval, it is determined that the separation of the composite source prediction residual is complete. When the difference corresponding to at least one residual channel exceeds the corresponding residual allowable range, the range of the candidate model parameter set and the data source group to be judged is expanded along the model state propagation graph and the data source common cause topology graph, and the separation of the composite source prediction residual is performed again. If separation is not completed after reaching the preset maximum expansion level, the expansion of the candidate model parameter set and the range of the data source group to be judged is stopped, and a safe rollback instruction is generated.

9. The cage operation control method based on digital twin and multi-sensor fusion according to claim 6, characterized in that, The minimum set of model parameters is determined in the following manner: Based on the parameter residual influence relationship, determine the abnormal residual channel set and normal residual channel set covered by each candidate model parameter respectively; Candidate model parameters whose predicted residuals for all normal residual channels after parameter perturbation are located within the corresponding residual allowable interval; The candidate parameter combination is determined from the retained candidate model parameters. The union of the abnormal residual channels covers all abnormal residual channels, the parameter perturbation propagation direction is consistent with the residual propagation path, and the control period of the first occurrence of predicted residual change is located within the corresponding cumulative state propagation delay interval. The candidate parameter combination with the fewest number of candidate model parameters is determined as the minimum model parameter set; When there are multiple candidate parameter combinations containing the same number of candidate model parameters, the candidate parameter combination with the smallest sum of normalized residuals of all abnormal residual channels after parameter perturbation is determined as the minimum model parameter set.

10. The cage operation control method based on digital twin and multi-sensor fusion according to claim 9, characterized in that, Multiple candidate parameter update combinations are formed within the physical parameter range of each candidate model parameter in the minimum model parameter set, and candidate shadow digital twin models are generated respectively. Select playback data segments covering the acceleration, constant speed, deceleration, crawling, leveling and braking phases of the cage from the historical control cycle data frames. The initial physical operating status of the cage, the data source validity mask, and the executed control commands corresponding to each playback data segment are respectively input into the current digital twin model and each candidate shadow digital twin model; Candidate shadow digital twin models are defined as those where all predicted state tubes are within the envelope of the dynamic executable state, the absolute value of the playback residual of each abnormal residual channel is less than the absolute value of the playback residual corresponding to the current digital twin model, and the playback residual of each normal residual channel is within the corresponding residual allowable range. When multiple shadow digital twin models exist to be activated, the shadow digital twin model with the smallest maximum normalized outlier residual is determined as the shadow digital twin model.

Images