Escalator safety monitoring and emergency stop control method and system

Abstract

The application discloses an escalator safety monitoring and emergency stop control method and system, collects mechanical state data, electrical state data and passenger state data under the running state of the escalator, generates an abnormality recognition result through passenger abnormal behavior recognition and multi-dimensional feature fusion extraction of wear-out trend; establishes a risk calibration benchmark according to the abnormality recognition result to track recurrent fault maintenance history, determines a risk grading result in combination with a hidden danger weighted score in a silent period of each channel; collects critical non-triggered events, verifies historical suppressed false positive samples, and establishes a screening benchmark with a missed detection and false positive asymmetric cost as a constraint to generate a graded control instruction through precursor pattern matching and early upgrade; constructs a braking calibration benchmark through long stagnation pre-movement self-checking and quantization of a double-path response hysteresis of a braking circuit, executes anti-falling adaptive deceleration decision in combination with passenger density distribution of the escalator, verifies a stop distance margin, and outputs an emergency stop braking instruction, and the safety guarantee capability of the escalator in the whole cycle is improved.

Description

Technical Field

[0001] This invention relates to the field of special equipment safety control technology, and in particular to a method and system for safety monitoring and emergency stop control of escalators. Background Technology

[0002] Escalators operate frequently and for extended periods in public places. Wear and tear on critical components such as drive chains and bearings typically accumulates gradually before becoming observable. Existing safety monitoring solutions often rely on fixed threshold triggers, using current or vibration signals exceeding preset limits as alarm conditions. These solutions fail to detect gradual wear trends below the threshold. Furthermore, load fluctuations caused by passenger footsteps and abnormalities in drive components are superimposed on the current signal. Current solutions lack methods to quantitatively separate these two factors, causing early wear characteristics to be continuously masked by normal load variations.

[0003] Current risk assessments typically determine the risk level based on a single test result, failing to incorporate historical recurrence patterns of similar components and latent hazards in passageways that have been operating within normal ranges for extended periods. This leads to an underestimation of cumulative risks. Regarding emergency braking control, fixed deceleration parameters neither account for response lag caused by prolonged brake inactivity nor dynamically adjust the deceleration process based on real-time passenger distribution on the stairwell, resulting in a mismatch between braking execution and passenger fall prevention requirements. Summary of the Invention

[0004] This invention discloses a method and system for safety monitoring and emergency stop control of escalators. It collects mechanical, electrical, and passenger status data during operation, analyzes passenger behavior to remove load components, and integrates multi-dimensional features to extract signs of wear in drive components. It constructs a risk grading benchmark by combining recurring fault maintenance history and silent passage hazard assessment. It implements proactive upgrades using asymmetric cost constraints from historical false alarm samples, performs pre-action self-checks to quantify response hysteresis in the braking circuit, and executes anti-fall adaptive emergency stop decisions based on real-time load distribution of the escalator, outputting an emergency stop command that matches the passenger's safety status.

[0005] The first aspect of this invention provides a method for safety monitoring and emergency stop control of escalators, comprising the following steps: Collect mechanical status data, electrical status data and passenger status data during the operation of the escalator, and identify abnormal passenger behavior based on the passenger status data to form passenger behavior data. The passenger behavior data is used to screen for current spikes unrelated to the load from the electrical status data to generate current spike data. The current spike data is combined with the mechanical status data to analyze the wear trend of the drive parts to obtain wear sign data. Based on the wear sign data, trend abnormal signs are identified to generate anomaly identification results. Based on the anomaly identification results, the maintenance history of recurring faults is tracked to establish a risk calibration benchmark. Based on the risk calibration benchmark, hidden dangers during the silent period of each channel are statistically analyzed to generate hidden danger weight data. Based on the hidden danger weight data, a recurrence progressive weighted classification is performed to determine the risk classification result. For the risk classification results, a preliminary triggering identifier is formed by collecting critical non-triggered events. The preliminary triggering identifier is used to verify historical suppressed false alarm samples to establish a false alarm identification benchmark. Based on the false alarm identification benchmark, a precursor pattern matching advanced upgrade is performed to generate a graded control instruction. Based on the graded control command, the braking circuit is subjected to a long-duration pre-action self-check to obtain a redundant braking state. The redundant braking state is used to record the hysteresis of the dual-path braking response to construct a braking verification benchmark. Based on the braking verification benchmark, a full-load anti-fall adaptive emergency stop decision is executed to output an emergency stop braking command.

[0006] A second aspect of this invention provides a safety monitoring and emergency stop control system for escalators, comprising: The data acquisition module is used to collect mechanical status data, electrical status data and passenger status data during the operation of the escalator, and to identify abnormal passenger behavior based on the passenger status data to form passenger behavior data. An anomaly identification module is used to use the passenger behavior data to screen for current spikes unrelated to the load from the electrical status data to generate current spike data, analyze the wear trend of the drive parts by combining the current spike data with the mechanical status data to obtain wear sign data, and identify trend abnormal signs based on the wear sign data to generate anomaly identification results. The risk grading module is used to track the maintenance history of recurring faults based on the anomaly identification results, establish a risk calibration benchmark, statistically analyze the hidden dangers during the silent period of each channel based on the risk calibration benchmark to generate hidden danger weight data, and perform recurrence progressive weighted grading based on the hidden danger weight data to determine the risk grading result. The hierarchical control module is used to collect critical non-triggered events based on the risk classification results to form a pre-triggered identifier, use the pre-triggered identifier to verify historical suppressed false alarm samples to establish a false alarm identification benchmark, and perform precursor pattern matching to generate hierarchical control instructions based on the false alarm identification benchmark. The redundant braking module is used to perform a long-duration pre-action self-check on the braking circuit according to the graded control command to obtain the redundant braking state, use the redundant braking state to record the hysteresis of the dual-path braking response to construct a braking verification benchmark, and execute a full-load anti-fall adaptive emergency stop decision based on the braking verification benchmark to output an emergency stop braking command.

[0007] The beneficial effects of this invention are reflected in the following points: First, by collecting mechanical status data, electrical status data, and passenger status data during operation, abnormal passenger behavior is identified based on passenger status data. Load components are quantitatively extracted from electrical status data using passenger behavior data. Simultaneously, multi-dimensional feature fusion of mechanical status data is combined to extract wear signs of drive components, enabling the continuous extraction of wear burr features of drive components below the conventional alarm threshold. This achieves early detection of the mechanical degradation process, bringing the identifiable abnormal moment forward to before the rapid degradation stage. Second, the abnormal identification results are correlated and calibrated with historical maintenance records of recurring faults. An active excitation detection mechanism is introduced for channels that have not been triggered for a long time to verify potential hazards during the silent period. The remaining life margin is used as a weight to weight and calculate the hazard scores for each channel, achieving a graded and quantified assessment of the cumulative risk of recurring faults. At the same time, long-term silent channels that cannot be detected by traditional threshold triggering mechanisms are included in the risk assessment scope. Finally, by aggregating critical non-triggered events and comparing them with historical suppressed false alarm samples, a discrimination benchmark is established under the constraint of asymmetric costs of missed detection and false alarm, enabling advanced identification and escalation of true alarm precursors; at the emergency stop execution level, a pre-action self-check is performed on the braking circuit under prolonged lag to quantify the response hysteresis of the two paths, and a load adaptive deceleration curve is constructed by combining passenger density zoning of the stairwell and verifying the fall prevention distance margin to ensure that the braking response delay and passenger fall risk are simultaneously constrained during the emergency stop process. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating a method for safety monitoring and emergency stop control of escalators according to the present invention.

[0009] Figure 2 This is a structural block diagram of an escalator safety monitoring and emergency stop control system according to the present invention. Detailed Implementation

[0010] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0011] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0012] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0013] The technical solutions of the embodiments of this application will be described below.

[0014] like Figure 1 As shown, this embodiment of the invention provides a method for safety monitoring and emergency stop control of escalators, including the following steps S101-S105: Step S101: Collect mechanical status data, electrical status data and passenger status data during the operation of the escalator, and identify abnormal passenger behavior based on the passenger status data to form passenger behavior data.

[0015] Specifically, mechanical status data, electrical status data, and passenger status data are collected during the operation of the escalator. Mechanical status data is collected jointly by a triaxial accelerometer on the step base and a chain tension displacement sensor: the triaxial accelerometer continuously collects vertical acceleration at a frequency of 500Hz, organizing the data into a vibration time series by cross-sectional position and sampling time for each step; the chain tension displacement sensor continuously collects chain tension displacement values ​​at a frequency of 10Hz, arranging them into a displacement time series by sampling time. Periods with more than 5% missing consecutive samples are marked with a data loss indicator, and these missing periods are filled in later during the mechanical wear feature extraction stage by interpolation between adjacent segments. Electrical status data is synchronously sampled at a frequency of 1kHz by the three-phase mutual inductors of the main drive motor and voltage sensors at each electrical node, segmented into sections according to the step pitch travel time of 0.64 seconds. The average drive current of each section is used as the basis for subsequent load component removal calculations; a full-cycle resampling is triggered when the sensor clock drift exceeds 50ms, and a clock drift check mark is added when the number of resamplings exceeds two. Passenger status data is continuously acquired at a frequency of 25 frames per second by one image acquisition unit at the entrance, middle and exit sections of the escalator. The image resolution is no less than 1080p, and the acquisition covers the entire 24 steps of the escalator. Each frame of the image is accompanied by a timestamp of the acquisition time and the corresponding step number. When the timestamps of the mechanical status data, electrical status data and passenger status data deviate by more than 80ms, the corresponding frame of passenger status data is marked with a low timeliness mark. Frames marked with low timeliness mark are not included in the collection of the current step instability event set.

[0016] In some embodiments, the step of identifying abnormal passenger behavior based on the passenger status data to form passenger behavior data includes: performing target detection and locating the passenger position based on the passenger status data to generate a passenger posture sequence; screening unstable posture deviations based on the passenger posture sequence to obtain a posture offset sequence; aggregating in-situ unstable avoidance events through the posture offset sequence to generate an unstable event set; and statistically analyzing the single-level avoidance anomaly clustering in the unstable event set to form passenger behavior data.

[0017] Passenger position sequence is generated based on passenger status data through target detection and localization. Target detection is performed on each frame of the passenger status data, extracting bounding boxes and skeletal key points for each passenger level within the image. The key points cover 17 nodes, including the head, shoulders, hips, knees, and ankles. Nodes with a skeletal key point confidence score below 0.5 are completed by interpolation from adjacent frames. If completion fails for three consecutive frames, the corresponding level of the passenger is marked with an occlusion marker. Passengers with occlusion markers are not included in subsequent unstable posture deviation screening. The number of passengers detected at each level and the corresponding frame time are organized into a passenger distribution time series. The passenger distribution time series forms the main matrix of passenger status data with level number as the row and frame time as the column. If an image acquisition unit malfunction results in no valid frames for more than 5 consecutive seconds, a missing image marker is added for that period. The passenger status data for the period with missing image markers is completed by interpolation using the average of the preceding and following normal periods. The interpolation source frame is appended with an interpolation source marker to the passenger posture sequence, and the confidence score for the posture deviation judgment corresponding to the interpolation source marker frame is reduced by 10%. After the skeletal key points are extracted, the ratio of the vertical coordinates of the hip key points to the vertical coordinates of the shoulder key points is used to calculate the trunk tilt index. The trunk tilt indices of each passenger are arranged according to the frame time to form a passenger posture sequence. The posture data of each passenger posture sequence are archived with three fields: ladder number, passenger tracking number and frame time. The passenger tracking number is maintained by the cross-frame target matching algorithm. Tracking interruption events are marked with tracking interruption identifiers in the passenger posture sequence. Passengers with tracking interruption identifiers do not merge events across interruption nodes during the unstable event set collection stage.

[0018] An attitude deviation sequence is obtained by screening unstable attitude deviations based on passenger attitude sequences. The trunk tilt index reference for each passenger tracking number during elevator operation is determined by the average value of the first consecutive 5-second stable segment after the passenger boards the elevator. The stable segment identification condition is that the range of trunk tilt indices within 5 seconds does not exceed 0.04. If the stable segment condition is not met, the median tilt index of all passengers on the same step during the same period is used as the input benchmark. The passenger from which the input benchmark is obtained is marked with an input benchmark identifier in the attitude deviation sequence, and the confidence level of the passenger with the input benchmark identifier is lowered. During the screening phase, the passenger attitude sequence is traversed by step number and passenger tracking number. The tilt index at each frame is compared frame by frame with the individual benchmark. A deviation exceeding 0.06 but not exceeding 0.18 is considered a minor attitude deviation, and a deviation exceeding 0.18 is considered a strong deviation. The deviation magnitude identifier is used to distinguish the deviations, and the deviation index, along with the step number, passenger tracking number, and frame time, is written into the attitude deviation sequence. The lower limit for judging slight passenger offsets using the baseline identifier was tightened from 0.06 to 0.08. Since the accuracy of the baseline identifier is lower than individual measurements, the attitude offset sequence now includes an additional baseline uncertainty identifier for the offset sourced from the baseline. The confidence levels of passenger offsets originating from occlusion and image loss identifiers in the passenger attitude sequence are lowered. This reduction in offset confidence levels leads to a corresponding reduction in the weight of the corresponding instability event set collection stage. When the product of the total number of effective offsets and the passenger distribution density under each level number in the attitude offset sequence exceeds 1.5 times the median value of the entire set, a high-frequency offset candidate identifier is marked. The scanning window for the high-frequency offset candidate identifier level is automatically narrowed during the instability event set collection stage.

[0019] An instability event set is generated by aggregating in-situ instability avoidance events through attitude offset sequences. When the same passenger on the same step exhibits more than two minor attitude offsets within a 0.8-second scan window, and the interval between adjacent offset frames does not exceed 400ms, this offset group is aggregated into a single in-situ instability avoidance event. The event's start time is taken as the time of the first offset frame, and its duration is the difference between the first and last offset frame times. Each event in the instability event set is annotated with its corresponding step number and trigger time for downstream retrieval. The high-frequency offset candidate identifier step scanning window for the attitude offset sequence is narrowed from 0.8 seconds to 0.5 seconds. The frequency of this type of step offset is approximately 1.8 times higher than the overall step average. The 0.8-second window merges adjacent independent events into a single event, artificially increasing the duration of a single event in the instability event set by approximately 30%. After narrowing, the instability event set adds a window narrowing identifier to high-frequency source events. The lower limit for the number of passenger instability triggers in the attitude deviation sequence, substituted with the baseline identifier, has been increased from 2 to 3. The uncertainty of the baseline identifier caused a misclassification rate of approximately 25% for events with the lower limit of 2, which decreased to approximately 9% after the increase to 3. An increased frequency identifier is added to the instability event set for events from this source. The passenger instability aggregation window for the attitude deviation sequence baseline uncertainty identifier remains unchanged at 0.8 seconds. An uncertain baseline source identifier is added to the instability event set for events from this source, and the weight of events with the uncertain baseline source identifier is reduced to 0.9 times during the passenger behavior data statistics phase. Instability events in adjacent escalators (number difference ≤ 2) with a start time difference not exceeding 1 second are merged into related instability event pairs in the instability event set. The weight of related pair identifier events is increased to 1.3 times during the passenger behavior data statistics phase, reflecting the higher structural risk of multi-escalator linked instability. When the total number of events in each escalator of the instability event set exceeds twice the median of the entire escalator, a high-aggregation warning identifier is marked. The escalator with the high-aggregation warning identifier triggers a 30-minute sliding window instability rate maximum value calculation during the passenger behavior data generation phase, capturing the peak value rather than diluting it with the overall mean.

[0020] Passenger behavior data is generated by statistically analyzing the abnormal clustering of single-level avoidance instability event sets. The instability rate per 100 passengers per level is obtained by dividing the number of events in each level of the instability event set by the passenger flow statistics for the corresponding time period. Passenger flow is calculated by dividing the cumulative number of passengers in each frame of the passenger distribution time series for the corresponding time period by the frame rate. Levels with an instability rate exceeding 2.5 times per 100 passengers are marked with a high instability density indicator in the passenger behavior data. For levels with high clustering warning indicators in the instability event set, the maximum instability rate within a 30-minute sliding window is used in the passenger behavior data calculation. When the maximum window value exceeds 4.0 times, an extremely high clustering indicator is added to the passenger behavior data. The extremely high clustering indicator, together with the subsequent high-risk layer stratification indicator, triggers a low-threshold glitch scan in the electrical status data. The instability event set association assigns a 1.3x weight to the marked events and a 0.9x weight to the baseline uncertain source marked events, which are then used in the instability rate calculation for the relevant levels. When both types of weights exist simultaneously in the same level, they are multiplied and superimposed to obtain a comprehensive correction coefficient. The passenger behavior data records this comprehensive correction coefficient for use in setting the stratification parameters for subsequent electrical status data screening. Passenger behavior data identifies the top 10% of elevators with the highest instability rates as key monitoring elevators. When the difference between the average instability rate of key monitoring elevators and the average instability rate of non-key monitoring elevators exceeds 1.5 times, a high-risk layer label is added to the passenger behavior data. This layer labeling triggers a threshold layering setting during the electrical status data screening phase. When the proportion of high-risk layer labeled elevators exceeds 20% of the total number of elevators, a high-risk batch label is added. The difference in current glitch scanning frequency band density between high-risk batches and low-risk batches (comprising less than 5%) is approximately three times.

[0021] Step S102: Use passenger behavior data to screen for current spikes unrelated to load from electrical status data to generate current spike data. Combine the current spike data with mechanical status data to analyze the wear trend of the drive parts and obtain wear sign data. Based on the wear sign data, identify trend abnormal signs and generate anomaly identification results.

[0022] In some embodiments, the step of using passenger behavior data to screen for load-independent current spikes from electrical state data to generate current spike data includes: parsing the current component corresponding to the load carried by the passenger behavior data to generate a load current component; performing segment-by-segment removal of load components from the electrical state data based on the load current component to obtain a load-independent residual; screening subthreshold clustered spike peaks through the load-independent residual to obtain a spike peak sequence; and statistically calculating the subthreshold spike density per unit stroke for the spike peak sequence to form current spike data.

[0023] The load current component is generated by analyzing the current component corresponding to the load carried by passenger behavior data. The current increment of 0.08A / person for a single person stepping on the ground is determined by joint calibration of the equipment's factory rated parameters and historical operating data. The passenger flow statistics of each 0.64-second segment of passenger behavior data are multiplied by 0.08A / person to obtain the static load benchmark for that segment. After the static load benchmark is formed into a time sequence according to the segments, it is aligned with the average time sequence of the electrical status data segments to form the main body of the load current component. The center of gravity shift impact during the duration of each event in the passenger behavior data instability event set causes the dynamic fluctuation of the current in the corresponding segment to be about 4% to 8% of the static benchmark. The load current component superimposes the dynamic impact of the instability event period onto the static benchmark. After superposition, the time domain shape of the load current component is a step baseline plus short peak envelope structure. The number of dynamic superpositions of the load current component corresponding to the high instability density tier of passenger behavior data is about 2.1 times higher than that of ordinary periods. The load current component is marked with a high uncertainty for such periods. The judgment threshold for the high uncertainty marked periods is relaxed by 15% in the load-independent residual stage to avoid the residual load components generated by modeling uncertainty being misjudged as spikes. When calculating passenger flow using a tiered statistical method for passenger behavior data, the comprehensive correction coefficient is multiplied by the baseline value. After correction, the residual between the load current component and the mean value of the electrical state data slice narrows from approximately 0.12A to approximately 0.06A. For the high-risk and extremely high-aggregation tiers of passenger behavior data, a 0.10A low-threshold spike pre-scan is performed simultaneously on the load current component segments during the load component elimination phase. The pre-scan results are incorporated into the spike peak sequence of that tier after the corresponding load-independent residual is determined. Segments with an effective instability event coverage rate of less than 70% for the load current component are marked with a low coverage indicator. The residual load component modeled for low-coverage indicator segments is approximately 1.8 times that of standard segments. During the load-independent residual phase, an extended elimination window is applied to low-coverage indicator segments to compress this residual amount.

[0024] Load-independent residuals are obtained by segmentally removing load components from electrical state data based on load current components. The segment-level DC residual is obtained by subtracting the segment-level static baseline corresponding to the load current component from the mean value of each segment of electrical state data. The point-level residual sequence is obtained by subtracting the instantaneous value of the load current component from the simultaneously dynamically superimposed value of each sampling point's instantaneous value. This point-level residual sequence constitutes the main body of the load-independent residuals. When the segment-level DC residual exceeds ±0.30A, the segment is marked with a high residual indicator, suggesting underfitting of the load current component model. The threshold for judging high point-level residuals during periods of high uncertainty in the load current component is relaxed to ±0.43A. The modeling uncertainty of approximately 0.12A is equivalent to this relaxation of 0.13A, ensuring that the high residual indicator is not falsely triggered by modeling noise. The threshold for judging high segment-level DC residuals during periods of low coverage in the load current component is relaxed to ±0.50A. Simultaneously, a 3-point moving median filter is applied to the point-level residuals to compress low-frequency fluctuations introduced by the residual load current component. After filtering, the load-independent residuals are marked with an additional filtering processing label for segments originating from low coverage. Segments with a standard deviation exceeding 0.08A in the load-independent residual point-level residual sequence are marked as high-noise segments. During the spike / peak sequence screening phase, the subthreshold lower limit for these high-noise segments is increased by 0.05A to prevent random fluctuations in noise from being counted as spikes, thus suppressing the effect of noise on increasing the false spike detection rate. Segments with less than 85% of effective sampling points in the load-independent residual are marked as sparse segments. Sparse segments do not participate in density statistics during the spike / peak sequence screening phase; they only participate in peak waveform feature extraction. When the number of segments marked as having high load-independent residuals exceeds 15% of the total number of segments on that day, an additional load modeling deviation warning is issued. After the warning is triggered, the load current component modeling parameters are recalibrated based on the electrical status data and passenger behavior data from the past 30 days. The modeling is considered to have returned to normal only when the proportion of deviation segments drops below 5% after calibration.

[0025] The spike peak sequence is obtained by screening subthreshold clustered spike peaks using load-independent residuals. A spike with a point-level residual amplitude exceeding 0.15A but not exceeding the normal alarm threshold of 0.80A is defined as a subthreshold spike. If there is no second spike in the same direction within 5ms before and after the spike, it is considered an isolated impulse noise and is not included in the spike peak sequence. Two or more spikes with amplitudes exceeding 0.15A within a 30ms window are considered clustered spike events, and these events are included in the spike peak sequence. The start time of the event is taken as the first spike moment, and the duration is the difference between the first and last spike moments. The subthreshold lower limit for high-noise-floor marker segments in load-independent residuals is increased from 0.15A to 0.20A. With a noise floor standard deviation of approximately 0.08A, the 0.15A lower limit increases the false detection rate of noise-floor spikes by about 18%. After the increase, the false detection rate drops to below 6%. A noise source marker is added to the spike peak sequence for high-noise-floor-source spikes. The amplitude of spikes in the load-independent residual filtering segment is compressed by approximately 10% by a 3-point median filter. The spike sequence amplitude from the filtered source is multiplied by a restoration factor of 1.11 before being included in density statistics, ensuring that the systematic amplitude underestimation introduced by the filter does not affect wear trend determination. For spikes within the load-independent residual sparse segment, only the full width at half maximum (FWHM) and amplitude waveform features are extracted; these are not included in the spike sequence density statistics. These two waveform features are used in the frequency matching stage of wear symptom data. When the number of daily clustered spike events in each stage of the spike sequence exceeds three times the median of the entire stage, a high-density stage is marked. The high-density stage marker reduces the triggering statistical cycle from 30 minutes to 10 minutes during the current spike data density statistics stage, and the density peak response time is shortened from approximately 18 minutes to approximately 6 minutes.

[0026] Current glitch data is generated by statistically analyzing the sub-threshold glitch density per unit travel distance in the glitch peak sequence. With an escalator operating speed of 0.5 m / s and a step pitch of 0.32 m, a 100 m travel distance corresponds to approximately 200 seconds of travel time. The glitch density per 100 meters in each 30-minute period of the glitch peak sequence is calculated using the following formula: D = (N_burst / S_t) × 100, where N_burst is the total number of clustered glitch events in that period, S_t is the corresponding travel distance (m), and D is the glitch density per 100 meters (times / 100 meters). The density values ​​are arranged along the time axis to form the main temporal sequence of the current glitch data. The statistical period for high-density step markers in the glitch peak sequence is narrowed to 10 minutes. High-density source markers are added to the current glitch data for high-density source periods. The density values ​​for high-density source marker periods have a 1.2-fold increased weight in the wear trend analysis stage, and the contribution of density surge events to trend slope estimation is approximately 20% higher than that of ordinary periods. When the noise source of the burr spike sequence is included in the density statistics, its weight is reduced to 0.8 times. After the weighting reduction, the noise mixing ratio of the current burr data decreases from about 12% to about 5%. The amplitude restoration coefficient of the filtered source peak of the burr spike sequence has been multiplied. The current burr data is marked with an amplitude restoration label for the filtered source period. During the frequency matching stage of the wear sign data, the original waveform features are retrieved first, rather than the filtered amplitude, for the restoration label period. When the 30-day rolling density average of each current burr stage exceeds 4.0 times / 100 meters, it is marked with an above-average density label. When it is below 0.5 times / 100 meters, it is marked with a low-density label. The above-average density label indicates that the burr density of the stage is rising too fast, indicating that the wear of the drive component is entering an accelerated period. This triggers the narrowing of the observation window during the subsequent wear sign data trend slope calculation stage.

[0027] Wear symptom data are obtained by analyzing the wear trend of the drive components using current burr data and mechanical condition data. The characteristic frequency of chain wear is determined by the ratio of the running speed to the sprocket circumference. At a running speed of 0.5 m / s, the characteristic frequency is approximately 0.4 Hz, while the bearing characteristic frequency is approximately 2 to 4 Hz, with a frequency difference of approximately 5 to 10 times. The frequency components of each burr peak in the current burr data are extracted using short-time Fourier transform. Combined with the chain tension displacement trend in the mechanical condition data, burrs whose frequencies fall within ±15% of the chain frequency band are classified as chain wear candidates. Combined with the vibration spectrum characteristics in the mechanical condition data, burrs falling within ±15% of the bearing frequency band are classified as bearing wear candidates. Independent density trend time series are established for the two types of candidates based on the wear symptom data. When the slopes of both types of candidate trends are simultaneously positive and exceed their respective trend thresholds, the stage is marked with a composite wear indicator. When calculating the trend slope of wear symptom data, the density of current spike data exceeding the mean is used to simultaneously examine the chain displacement acceleration in mechanical condition data. The observation window is narrowed from 30 days to 15 days, and the response delay of trend change points is compressed from 18 days to approximately 9 days. The density value of the high-density source period of current spike data is weighted 1.2 times higher during the trend regression of wear symptom data. The high-density period corresponds to the concentrated deterioration of the contact state of the drive components. After the weighting is increased, the sensitivity of the trend slope to density surge events is improved by approximately 20%. Zero-spiking periods in the low-density identifier of current spike data do not participate in the linear regression of the wear symptom data trend slope. When the zero-spiking period accounts for more than 30% of the total observation window days, the wear symptom data of this identifier is labeled as sparse. The confidence level of the trend slope of the sparse identifier is reduced to low confidence. The judgment threshold for the low-confidence trend slope is tightened by 20% when determining the anomaly identification result level to compensate for the risk of missed detection introduced by insufficient confidence.

[0028] Anomaly identification results are generated based on the identification of trend anomalies in wear sign data. When the slope of the wear sign data trend exceeds 0.02 times / 100m·day, the density increment over 30 days reaches 0.6 times / 100m, corresponding to a cumulative chain pitch error of approximately 0.15mm, exceeding 50% of the sprocket meshing tolerance of 0.10mm; the anomaly identification result is classified as a trend anomaly. When the slope is below 0.005 times / 100m·day, the density increment over 30 days is only 0.15 times / 100m, falling within the natural fluctuation range; the anomaly identification result is classified as steady state. Anomaly identification results between these two thresholds enter the observation level, triggering an extended evaluation window from 30 days to 45 days. The threshold for judging the trend slope of the low-confidence indicator of wear sign data is tightened from 0.02 times / 100m·day to 0.016 times / 100m·day. Under low-confidence conditions, the standard error of slope estimation increases by approximately 20%. Tightening the threshold ensures that a trend anomaly level is still triggered even when the actual slope is 0.018, avoiding missed detections due to data sparsity. The base level of the anomaly identification result for composite wear indicator data is raised one level above the slope judgment result. A steady-state rise indicates observation, an observation rise indicates trend anomaly, and a trend anomaly remains unchanged without further rise. Composite wear source information is simultaneously added to the anomaly identification result for risk calibration benchmark reference. If the slope of the wear indicator data still falls within the observation range after the 45-day extended assessment window, a long-term observation mark is added to the anomaly identification result. The long-term observation mark triggers an extension of the maintenance history tracing range from the standard 24 months to 48 months. For tiers with sparse wear indicator data and trend anomalies, a sparse data anomaly mark is added to the anomaly identification result metadata. Tiers with sparse data anomalies have higher priority for manual verification during the maintenance history tracing phase than tiers without marks, ensuring that trend anomalies under low confidence are not downgraded due to insufficient data. When a batch of trend anomaly tiers accounts for more than 30% of the total number of tiers, a wide-area wear warning is added to the anomaly identification result, triggering batch maintenance history tracing.

[0029] Step S103: Based on the anomaly identification results, track the maintenance history of recurring faults to establish a risk calibration benchmark. Based on the risk calibration benchmark, statistically analyze the hidden dangers during the silent period of each channel to generate hidden danger weight data. Based on the hidden danger weight data, perform recurrence progressive weighted grading to determine the risk grading result.

[0030] Specifically, a risk calibration benchmark is established by tracing the maintenance history of recurring faults based on anomaly identification results. A recurring fault is defined as one where the same component type is triggered at least twice within a 24-month tracing window. The recurrence weight coefficient increases by 0.25 for every 6-month decrease in the interval between adjacent triggers. The recurrence weight is calculated tier by tier for each trending anomaly level in the anomaly identification results, and this recurrence weight constitutes the core value of the recurrence weight field in the risk calibration benchmark. The tracing window for the long-term observation marker level of the anomaly identification results is extended from 24 months to 48 months. Recurring events with a latency period exceeding 24 months are not missed due to insufficient window size, thus ensuring that the risk calibration benchmark's statistics on the number of recurrences from long-term observation level cover the entire degradation cycle. When a wide-area wear warning is triggered by the anomaly identification results, the risk calibration benchmark initiates batch maintenance history tracing for all trending anomaly levels. The tracing period is limited to 4 hours. For levels exceeding this time, the recurrence weight is conservatively set at 1.2 times the historical average of the equipment model, with an additional conservative valuation label. Levels with the conservative valuation label do not trigger downgrade optimization. The composite wear indicator of the anomaly identification result is recorded independently in the risk calibration benchmark, triggering a forced upward shift during the risk grading result level mapping stage. The risk calibration benchmark reserves an overdue hazard field for each channel. This field is filled in according to the remaining life margin during the subsequent silent period analysis stage. The weight coefficient of the overdue channel is 0.4 to 0.8 higher than that of the non-overdue channel. The risk calibration benchmark version number is refreshed after each batch of traceability is completed. The two types of correction items, conservative estimate indicator and overdue hazard field, are maintained independently in the risk calibration benchmark and together determine the weight starting point of the hazard weight data score for each tier.

[0031] In some embodiments, the step of generating hazard weight data for each channel's silent period based on the risk calibration benchmark includes: determining the silent duration of each channel based on the risk calibration benchmark to obtain a silent duration distribution; identifying overdue non-triggered components based on the silent duration distribution to generate an overdue silent list; verifying the failure range of similar components through the overdue silent list to determine the remaining life margin; and weighting the silent hazards according to the remaining life margin to form hazard weight data.

[0032] The silence duration distribution for each channel was obtained by measuring the silence duration of each channel against the risk calibration benchmark. The silence duration for each monitoring channel was taken as the number of calendar days from the last alarm trigger to the current time. The risk calibration benchmark retrieved the last trigger time within the traceability window for each channel. When no results were found, the silence duration was taken as the upper limit of the traceability window and marked with a no-trigger-record identifier. Channels with no-trigger-record identifiers had their weight increased by 1.15 times during the overdue judgment stage to compensate for the underestimation bias introduced by the lack of historical information. The upper limit of the tiered traceability window for long-term observation of the risk calibration benchmark was 1460 days. The silence duration distribution was stored in groups for traceability window sources of 24 months and 48 months. The overdue threshold for each group was determined by the median within the group. When calculated in combination, the extreme silence duration of the 48-month group raised the arithmetic mean by about 25%, resulting in a systematically inflated judgment threshold for overdue channels in the 24-month group. Channels with a recurrence weighting coefficient exceeding 1.5 in the risk calibration benchmark are marked as high-recurrence channels in the silent duration distribution. This high-recurrence channel marker is tightened to 0.85 times the median within the group during subsequent overdue threshold calculations, ensuring that even high-recurrence channels with silent durations slightly exceeding the median trigger overdue identification. The conservative valuation markers for the risk calibration benchmark correspond to a conservative silent duration of 1.1 times the upper limit of the traceability window. The silent duration distribution uses the conservative valuation markers for channels from which conservative valuations are derived. These marked channels enter the manual verification priority queue during the overdue identification phase and do not participate in automatic incentive scheduling. When the difference between the 75th percentile and the 25th percentile of the silent duration distribution exceeds 180 days, a high-dispersion warning is added. The overdue threshold for high-dispersion warning batches is changed to the 50th percentile. Under a high-dispersion distribution, the arithmetic mean is increased by approximately 15% due to the right-tail extreme value. After changing to the median, the missed detection rate for overdue channels decreases from approximately 22% to approximately 8%.

[0033] For example, the step of identifying overdue untriggered components and generating an overdue silent list based on the silent duration distribution includes: screening for above-average silent channels based on the silent duration distribution to obtain a set of long silent channels; performing active stimulation and detecting responses based on the long silent channel set to obtain stimulation response records; identifying failure channels with missing responses and regular anomalies through the stimulation response records to determine a failure channel list; and compiling an overdue silent list by assembling overdue untriggered components from the failure channel list.

[0034] Based on the distribution of silent duration, channels with excessively long silent durations were screened to obtain a set of long silent channels. Monitoring channels such as escalator drive chain tension sensors and spindle bearing vibration sensors exhibit a zero-trigger state when the components are normal because the signal amplitude is consistently below the alarm threshold. However, sensitivity degradation caused by sensor aging and intermittent open circuits caused by terminal oxidation also manifest as zero triggering. These two types of causes cannot be distinguished in the threshold triggering system. The longer the zero-trigger duration, the higher the prior probability of sensor failure. Therefore, channels with excessively long silent durations need to be systematically screened and included in the active verification process. The arithmetic mean of each silent duration distribution multiplied by 1.3 is used as the initial candidate inclusion threshold, and multiplied by 1.5 is used as the direct inclusion threshold. Channels exceeding multiplied by 1.5 are directly included in the long silent channel set to determine channels. Channels in the range of multiplied by 1.3 to 1.5 are included in the long silent channel set as candidate channels to be stimulated for verification. The two-level partitioning ensures that the channels with the highest risk are prioritized when stimulation verification resources are limited. The screening benchmark for high-dispersion early warning batches in the silent duration distribution was simultaneously changed to the 50th percentile instead of the arithmetic mean. After changing to the median, the number of candidate channels in the long silent channel set increased by approximately 12%, with the increase concentrated in channels whose silent duration falls between median × 1.3 and mean × 1.3. The inclusion threshold for high-recurrence channel identification in the silent duration distribution was tightened to mean × 1.0. The acceleration factor for the failure risk of high-recurrence channels with increasing silent duration is approximately 1.8. The relaxed threshold resulted in a high-recurrence boundary channel miss rate of approximately 31%, which was reduced to approximately 9% after tightening. High-recurrence screening labels were added to channels with high-recurrence sources in the long silent channel set. When channels with conservative valuation labels in the silent duration distribution were included in the long silent channel set, conservative valuation source labels were added. Channels with conservative valuation sources did not participate in the automatic incentive scheduling and could only enter the incentive execution queue after manual verification. After all confirmed and candidate channels in the long silent channel set are classified, a high-proportion overdue warning is added when the proportion of confirmed channels to all monitored channels exceeds 25%. The execution cycle of the high-proportion overdue warning trigger incentive test is reduced from 7 days to 3 days.

[0035] Active excitation and response detection are performed based on the long-silent channel set to obtain excitation response records. Each channel in the long-silent channel set is excited according to its physical type: vibration channels are injected with a calibration sinusoidal signal with a frequency equal to ±5% of their characteristic frequency and an amplitude of 0.03g for 2 seconds; current monitoring channels are injected with a calibration pulse with an amplitude of 0.2A for 50ms. Response waveforms are acquired within 100ms after excitation. The excitation response records summarize the response acquisition results of each channel number and excitation batch. The excitation amplitude of the high-recurrence screening identification channel in the long-silent channel set is increased to 0.05g for vibration channels and 0.30A for current channels. The sensitivity of high-recurrence channels may decrease; the lower signal-to-noise ratio under standard amplitude conditions increases the identification error by approximately 25%. After the amplitude is increased, the signal-to-noise ratio of the high-recurrence source channel in the excitation response records returns to the standard channel level. Channels identified by conservatively estimated sources in the long-silent channel set are not included in the excitation schedule. The excitation response records are marked with a "pending manual verification" mark for the conservatively estimated source location. Entries marked with "pending manual verification" are not included in the automatic identification of the failed channel list. When a high proportion of overdue warnings exist, the stimulus test is executed in batches, with each batch not exceeding 30% of all channels under test. The batch interval is no less than 15 minutes (approximately one tiered cycle) to prevent crosstalk between dense stimulus signals. The stimulus response record adds a batch number and execution time to each batch. When the response missing rate within a batch exceeds 40%, the batch is marked as an abnormal batch. The abnormal batch mark triggers a re-stimulation of the channels in that batch once, and the re-stimulation result overwrites the corresponding position in the stimulus response record. The ratio of the response amplitude to the injected amplitude of each channel in the stimulus response record is defined as the response gain. A gain below 0.6 or above 1.8 is judged as an abnormal gain. A channel with an abnormal gain is included in the desensitization warning if it triggers once, and is included in the list of failed channels only if it triggers three consecutive times. If two out of three responses are normal, the desensitization warning is revoked.

[0036] Failed channels are identified by recording stimulus response data to determine their failure list. Channels with missing or recurring anomalies are identified as having missing responses within a 100ms response window. Channels with missing responses or recurring gain anomalies are identified as having recurring anomalies. Channels meeting either condition are added to the failed channel list. The threshold for identifying missing responses in high-recurrence screening channels has been increased from 10% to 15% of the injection amplitude. The stimulus amplitude for high-recurrence channels has been increased by approximately 67%. Using the 10% absolute threshold would easily lead to residual noise being mistaken for missing responses at high signal-to-noise ratios; increasing it to 15% suppresses this misjudgment. High-recurrence source entries are marked with a high-recurrence source identifier in the failed channel list. For abnormal batches in the stimulus response data, channels within a batch must undergo failure determination after being overwritten by re-stimulation results. Original results before re-stimulation are not considered in the determination. Abnormal batch source channels are marked with a batch abnormal source identifier in the failed channel list. The confidence level of failure conclusions for abnormal batch source channels is downgraded during the generation of the overdue silent list. Items marked as pending manual verification in the stimulus response record are included in the failure channel list identification after being overwritten by the manual verification conclusion. When the manual verification conclusion is failure, the item is directly added to the failure channel list and a manual confirmation mark is attached. When the conclusion is normal, the item is removed from the long silent channel set candidate and a manual exclusion mark is marked in the stimulus response record. When the number of abnormal source items in the failure channel list exceeds 30% of the total number of items, an additional confidence warning is issued. The confidence warning triggers an additional round of independent stimulus verification for all abnormal source channels in all batches. Channels whose independent verification results are consistent with the original judgment retain their place in the failure channel list. Channels whose results are inconsistent are moved to the manual verification queue. When the independent verification pass rate is less than 60%, the confidence of the failure channel list is downgraded and a full batch stimulus retest is triggered.

[0037] An overdue silent list is generated for components that have not been triggered within the specified timeframe after the failure channel list is compiled. The component-channel correspondence is maintained according to equipment files, with each component corresponding to 1 to 3 monitoring channels. For each channel in the failure channel list, the corresponding component code is retrieved from the equipment file. If at least one channel under the same component code is determined to be failed, that component is added to the overdue silent list. If all associated channels are failed, a full-channel failure marker is added to the overdue silent list. Components corresponding to channels with high recurrence source markers in the failure channel list are marked with a high recurrence source marker in the overdue silent list. The reduction factor for components with high recurrence source markers is adjusted from 1.0 to 0.85 during the remaining life margin verification stage. Components corresponding to channels with batch anomaly source markers in the failure channel list are marked with a low confidence marker in the overdue silent list. The remaining life margin verification results for components with low confidence markers must be manually confirmed a second time before they can participate in the hazard weighting data scoring. During the waiting period, a "pending confirmation" marker is added to the corresponding position in the overdue silent list. For manually confirmed failure channels, the corresponding components are marked with a manual confirmation source identifier in the overdue silent list. The remaining life margin verification scheduling of manually confirmed source components has a higher priority than automatically determined source components, ensuring that manual intervention conclusions are not affected by scheduling delays, thus ensuring the timeliness of hazard weighting data scoring. When the number of failure-marked components in all channels of the overdue silent list exceeds 20% of the total number of components in the overdue silent list, a multi-channel failure cluster warning is added. This cluster warning triggers a comprehensive safety inspection of the escalator batch. Before the inspection is completed, all components corresponding to the overdue silent list are conservatively treated at the highest level during the risk classification result mapping stage, ensuring that multi-component simultaneous failure scenarios are not missed due to incomplete weighting calculations.

[0038] The remaining life margin is determined by verifying the failure range of similar components using an overdue silent list. The failure range for similar components is the difference between the first failure time and the last maintenance time for the same model and component code. When the sample size is not less than 8, the 10th percentile (B10 life) is used as the representative value of the failure range. The initial value of the remaining life margin for each component in the overdue silent list is calculated using the following formula: M_life = T_B10 - T_silent, where T_B10 is the 10th percentile failure duration (days) for the similar component, T_silent is the current channel's silent duration (days), and M_life is the initial value of the remaining life margin (days). A negative M_life indicates that the component has exceeded its lifespan limit. For components in the overdue silent list whose corresponding channels lack trigger record identifiers and therefore lack local trigger interval data, the remaining life margin is substituted with the statistical average of the B10 life of similar components. After substitution, the uncertainty of the remaining life margin is approximately 2.3 times that of components with historical data. An uncertainty identifier is added to the remaining life margin for this type of component. For components on the overdue silent list awaiting confirmation, the remaining life margin is not included in the hazard weighting data scoring until manual verification is completed. After the verification conclusion is confirmed, the remaining life margin is recalculated according to the normal process, and the recalculated result is added to the main sequence of remaining life margin. When the sample size of the same type of component is less than 8, the B10 life is replaced by the lower limit of the industry standard life. The industry standard value is usually conservative by about 15% to 20% compared with the measured B10 life. The remaining life margin is marked with a conservative substitution label for the source components of the industry standard substitution. The weight of the conservative substitution label components is increased by 0.1 in the hazard weighting data scoring stage. The remaining life margin of components with high recurrence sources on the overdue silent list is multiplied by a reduction factor of 0.85 based on the normal calculation result. The failure mode of high recurrence components shows accelerated deterioration characteristics, and the actual usable life is about 85% of the estimated B10 value. After reduction, the remaining life margin is marked with a recurrence reduction label for high recurrence sources. The recurrence reduction label components are placed in the highest weight level in the hazard weighting data scoring stage.

[0039] The remaining lifetime margin is used to weight silent hazards to form hazard weight data. A negative remaining lifetime margin (lifetime exceeded) corresponds to a base silent hazard score of 2.0; a margin of 0-20% corresponds to 1.5; 20-50% corresponds to 1.0; and above 50% corresponds to 0.5. These four base scores are directly mapped from the remaining lifetime margin. After mapping, a correction coefficient is added to each component to obtain the final hazard weight data score. For components with a recurrence reduction label in the remaining lifetime margin, an additional 0.3 is added to the four-level mapping results. After recurrence reduction, the margin generally falls into the 0-20% range, corresponding to a base score of 1.5. After adding 0.3, the hazard weight data score for this type of component reaches 1.8, approximately 20% higher than components in the same range without a recurrence label. For components with uncertainty labels, the remaining lifetime margin is substituted into the uncertainty label hazard weight data base score, which is multiplied by a correction coefficient of 1.15 based on the mapping results. The margin estimation deviation for uncertainty label components is approximately ±20%. The 1.15 correction coefficient ensures that components in scenarios with underestimated margins are not misclassified to a lower level due to deviation. The remaining life margin is conservatively substituted into the base score of the identified components, which is then increased by 0.1 on top of the mapping result. This conservative substitution systematically underestimates the margin by approximately 15% to 20%, and the 0.1 increase compensates for the weighting bias introduced by the underestimation. A conservative source field is added to the conservative source components in the hazard weighting data for traceability and verification of the risk classification results. Components with null remaining life margins are not included in the hazard weighting data scoring. A missing score marker is added to the corresponding position in the hazard weighting data. For components with missing scores, the score of the nearest-neighbor already scored component of the same type is conservatively substituted during the risk classification result mapping stage, and the substitution source is recorded in the risk classification result metadata. When the average score of all components in each hazard weighting level exceeds 1.6, a high-hazard warning mark is added to the entire machine. This high-hazard warning is used to mark tiers with simultaneous degradation of multiple components, allowing for tightening of the level threshold during the risk classification result mapping stage, preventing such tiers from falling into lower levels due to the boundary effect of single-item scores.

[0040] Risk grading results are determined by a progressive weighted grading system based on recurrence weight data. The risk grading level is determined by mapping the average score of all components across each tier of the hazard weight data to four threshold levels: Level 1 corresponds to a score below 1.5, Level 2 to 1.5-2.5, Level 3 to 2.5-3.5, and Level 4 to above 3.5. The boundaries of these four levels are jointly determined by the proportion of components exceeding their lifespan limits and the distribution of recurrence weights. The mapping threshold for the Level 1 high-hazard warning tier of the hazard weight data is tightened from 1.5 to 1.3 to mitigate the lower-than-expected level caused by the boundary effect of single-item scores in scenarios of simultaneous degradation of multiple components. After tightening, when superimposed with the composite wear indicator, tiers that would originally fall into Level 2 can be pushed into Level 3. The composite wear indicator tier of the anomaly identification results is forcibly raised one level based on the risk grading result of the hazard weight data mapping: Level 1 rises to Level 2, Level 2 rises to Level 3, Level 3 rises to Level 4, and Level 4 remains unchanged. The risk grading result records the source field of the rise to distinguish between algorithm-determined and forcibly corrected level sources. For hazard weighting data lacking scoring identifiers, the risk grading results conservatively use the scores of the nearest-neighbor, already scored, similar components as substitutes, with the substitute source recorded in the risk grading result metadata. The comprehensive weighted score for each hazard weighting level, along with the version number of the recurrence weight field, is locked into the risk grading result entry to ensure traceability and alignment between the grade determination result and the weight calculation batch. When the proportion of Level 4 hazard in the risk grading results exceeds 10% of the total, a high-proportion Level 4 warning is added. The product of the high-proportion Level 4 warning and the number of high-hazard warning tiers in the hazard weighting data constitutes the two core indicators for the risk concentration assessment of this batch. The confidence level of the conservatively estimated risk grading result is recorded in an independent field. The confidence level field and the grade field together constitute the complete output entry of the risk grading result.

[0041] Step S104: Based on the risk classification results, a preliminary triggering flag is formed for the critical non-triggered events. The preliminary triggering flag is used to verify the historical suppressed false alarm samples to establish a false alarm identification benchmark. Based on the false alarm identification benchmark, the precursor pattern matching is executed to generate a graded control command for advance upgrade.

[0042] Specifically, pre-trigger flags are generated for critical non-triggered events collected based on risk grading results. The risk grading results have three critical zones corresponding to scores of 2.975 to 3.500 (15% below the upper limit of 3.5), two critical zones corresponding to 2.125 to 2.500, and one critical zone corresponding to 1.275 to 1.500. The width of each critical zone is 15% of the upper limit score of the corresponding level. A pre-trigger flag is generated when a risk grading result falls into any of these critical zones. The urgency of the pre-trigger flag is calculated as a percentage of the difference between the current score and the lower limit of the critical zone, divided by the width of the critical zone. A higher urgency indicates that the score is closer to the upper limit of the level. The conservative valuation flag for the risk grading results extends 5% outward from the lower limit of the tiered critical zone. This conservative valuation introduces approximately 5% systematic underestimation, causing the actual score to be higher than the stored value. Without expansion, the actual critical state tier is missed because the stored value falls outside the critical zone. After expansion, the pre-trigger flag adds an underestimation compensation flag to the tier from which the conservative valuation originates. This underestimation compensation flag is adjusted upward by 5% during the false alarm sample set tracing phase. The risk grading results are corrected by multiplying the critical urgency of the pre-triggering marker for the high-risk warning level by 1.1. Under high-risk conditions, simultaneous deterioration of multiple components causes the score to underestimate the actual risk by approximately 10%. After correction, the deviation between the pre-triggering marker urgency and the actual risk narrows from approximately 12% to approximately 5%. Levels with a pre-triggering marker critical urgency exceeding 95% are marked with a high-urgency marker. The historical sample traceability window for high-urgency marker levels has been extended from 36 months to 48 months, covering long-term false alarm history with a latency period exceeding 3 years. Level 4 risk grading results (scores exceeding 3.5) do not enter the pre-triggering marker process and are directly transferred to the braking circuit self-inspection. The pre-triggering marker metadata records the number of Level 4 direct trigger levels in the current batch. If this number exceeds 10% of the entire system, it will be scheduled according to the high-proportion Level 4 warning triggering self-inspection priority queue based on the risk grading results.

[0043] In some embodiments, the step of establishing a false alarm identification benchmark by verifying historical suppressed false alarm samples using the pre-trigger identifier includes: collecting historical suppressed false alarm samples using the pre-trigger identifier to obtain a false alarm sample set; extracting easily confused false alarms and real alarms based on the false alarm sample set to construct a ledger of easily confused situations; verifying the critical missed detection boundary of real alarms through the ledger of easily confused situations to determine the identification protection boundary; and establishing a false alarm identification benchmark based on the identification protection boundary with the asymmetric cost of missed detection and false alarms as a constraint.

[0044] A false alarm sample set is obtained by collecting historical suppressed false alarm samples using the pre-triggered flag. The vibration and impact caused by dense passenger trampling overlap in spectral morphology with the abnormal vibration caused by early wear of drive components. Maintenance personnel cannot distinguish between the two based on a single alarm waveform and may manually suppress some alarms. However, suppressed alarms may contain real early signs of degradation, requiring a systematic retrospective analysis of historical suppressed samples to identify the true signals. Historical suppressed samples are taken from alarm records manually suppressed by maintenance personnel within the past 36 months. Suppression operations must be completed within 30 minutes of alarm triggering to be considered effective suppression; suppression exceeding this timeframe is considered a response delay and is not included in the false alarm sample set. When the overlap between the critical urgency level of the pre-triggered flag and the risk classification score range corresponding to the historical suppressed sample is not less than 70%, the historical sample is added to the candidate pool. Samples in the candidate pool that do not receive a secondary alarm confirmation within 48 hours of triggering are formally included in the false alarm sample set. When the pre-triggered flag underestimates the compensation flag and matches the historical sample score comparison benchmark, the benchmark is increased by 5%. After compensation, the false alarm sample set is marked with a compensation comparison flag for samples from this source. The feature weight of the compensation comparison flag samples is increased by 0.1 in the clustering stage of the easily confused situation ledger. The pre-triggered flag and the high urgency flag tiered traceability window are extended to 48 months. The false alarm sample set is marked with an extended traceability flag for samples from this window. The clustering weight of the extended traceability flag samples is reduced to 0.9 times. The representativeness of early samples is about 10% lower than that of recent samples. The weight reduction reflects the decay of timeliness. When the number of effective samples in the false alarm sample set is less than 15, a sample quantity insufficient flag is marked and the traceability window is extended to 60 months. If it is still insufficient, cross-device aggregated samples of the same model are used. Cross-device samples are marked with a cross-device source flag and the clustering weight is reduced to 0.8 times. The maximum number of cross-device samples introduced cannot exceed twice the number of effective samples in the local machine.

[0045] Based on the false alarm sample set, a ledger of easily confused false alarms and real alarms was constructed. For each sample in the false alarm sample set, the rate of change in current spike data density, the deviation factor of mechanical vibration characteristics, and the percentile of passenger flow were extracted within the two hours prior to the trigger time and concatenated into a 3D feature vector. K-means clustering was performed, with the k-value determined by maximizing the silhouette coefficient within the range of 3 to 5. When the Euclidean distance between the cluster center and the feature vector of the confirmed real alarm sample did not exceed 1.5 times the mean of the intra-cluster variance, an easily confused type was marked. The ledger of easily confused types was organized with the cluster number as the primary key, along with the nearest neighbor distance of the real alarm. Samples with cross-device source identifiers in the false alarm sample set were weighted down to 0.8 times before participating in clustering. After weighting down, the contribution of cross-device samples to the bias of the cluster center decreased by approximately 20%. The ledger of easily confused types added cross-device cluster identifiers to clusters containing more than 30% cross-device samples. The identification area of ​​cross-device cluster identifier entries was tightened by 5% during the identification and protection boundary stage. The weight of the false alarm sample set extended traceability identifier sample is reduced to 0.9 times. After clustering, the easily confused case ledger adds a low-timeliness identifier to clusters where the proportion of extended traceability samples exceeds 50%. The identification boundary of the low-timeliness identifier item is reduced by 5% to prevent the cluster centers caused by early samples from deviating from the current equipment status distribution. The feature weight of the false alarm sample set compensation comparison identifier sample is increased to 1.1 times to participate in clustering. After the increase, the cluster centers within the compensation adjustment range are tightened. The nearest neighbor distance of the corresponding item in the easily confused case ledger is reduced from the mean of about 2.3 to about 1.9, and the identification accuracy is improved by about 17%. The clustering k value of the batch with insufficient sample size in the false alarm sample set is fixed at 3. The easily confused case ledger adds a low-confidence identifier to the items in this batch. The identification boundary of the low-confidence identifier item is further tightened by 8%. When the number of effective items is less than 60% of the total number of cluster centers, an additional ledger sparse warning is added. The global judgment threshold for triggering the ledger sparse warning is tightened by 10%.

[0046] The identification and protection boundaries are determined by verifying the critical missed detection boundary of real alarms through the easily confused situation log. The identification area of ​​each cluster in the easily confused situation log is determined by ±1.5 times the intra-class standard deviation of the cluster center. The minimum feature distance of the confirmed real alarm samples within the identification area is the reference value of the critical missed detection boundary of that item. The boundary value of each item of the identification and protection boundary is determined by subtracting a safety margin of 0.1 times the intra-class standard deviation from the outer edge of the identification area. The safety margin is used to reserve boundary fluctuation space for real alarm samples. After the boundary is shrunken, the missed detection rate is reduced from about 15% to about 8%. The identification area of ​​the cross-device cluster identification item in the easily confused situation log is tightened from ±1.5 times to ±1.3 times the intra-class standard deviation. The cross-device sample dispersion is about 1.4 times that of the local device. The loose identification area leads to a higher false alarm filtering rate of about 15% for the identification and protection boundary. After tightening, the missed detection protection margin is restored from about 0.25 times to about 0.40 times the standard deviation. The identification area for entries with low timeliness in the easily confused situations log has been tightened by 5%. Early samples introduced a cluster center bias of approximately 0.08 times the within-class standard deviation; after tightening, this bias significantly reduced its impact on the location of entries at the identification protection boundary. The identification area for low-confidence entries in the easily confused situations log has been further tightened to ±1.0 times the within-class standard deviation. Under conditions of sparse samples, the actual alarm false negative rate in the ±1.5 times identification area was approximately 32%, which decreased to approximately 12% after tightening to ±1.0 times. Tightened protection labels are added to entries from low-confidence sources at the identification protection boundary. Each entry at the identification protection boundary is organized and stored in the database using a dual-field structure of cluster number and equipment operating condition range. Entries with tightened protection labels and ordinary entries in the same cluster form a double-layer identification area structure: the inner layer covers sparse areas of low-confidence samples, and the outer layer covers high-confidence, high-density areas. The ratio of the widths of the two layers is recorded in the identification protection boundary metadata. When the total number of clusters in the ledger for identifying easily confused situations where the effective entries for the protection boundary coverage are less than 80%, an additional coverage insufficiency warning is added. This warning triggers a global adjustment of the judgment parameters towards a more conservative approach during the false alarm identification benchmark stage. Sensitivity parameters are set separately for each confidence level when calibrating the false alarm identification benchmark threshold.

[0047] A false alarm identification benchmark is established based on the identification and protection boundary, constrained by the asymmetric cost of missed detections and false alarms. The optimal judgment threshold θ for each item of the identification and protection boundary is determined by minimizing the asymmetric cost function L. The missed detection weight α is set to 0.85, and the false alarm weight is set to 0.15, corresponding to a missed detection cost of approximately 5.7 times the false alarm cost: L = α × r_miss + (1-α) × r_false, where r_miss is the missed detection rate (the proportion of real alarms judged as false alarms) under the current threshold, and r_false is the corresponding false alarm rate (the proportion of false alarms being allowed to become real alarms). θ is taken as the feature distance boundary value corresponding to the minimum of L. When θ falls within the coverage area of ​​the identification and protection boundary, it is directly adopted; when it exceeds the range, it is contracted to the nearest neighbor boundary value of the identification and protection boundary. When the warning of insufficient coverage of the identification and protection boundary is triggered, the global false alarm identification benchmark α is increased from 0.85 to 0.88. The increase of α drives θ to shift in a conservative direction. After the shift, the missed detection rate decreases by approximately 4%, and the false alarm rate increases by approximately 6%. This trade-off is acceptable in the security monitoring scenario. The local α of the false alarm identification benchmark for low-confidence sources in the protection boundary is increased to 0.90. The risk of missed detection for low-confidence items is higher locally than globally; α=0.90 corresponds to a missed detection cost approximately nine times the false alarm cost, ensuring that high-risk states in sparse sample areas are not misjudged as false alarms. The θ of cross-device clustering sources in the protection boundary is shifted conservatively by an additional 0.05 times the intra-class standard deviation on top of the optimal L-value, compensating for the shift in judgment position introduced by cross-device sample distribution bias. The false alarm identification benchmark adds an offset adjustment flag to cross-device source items. After determining the local θ of each item in the false alarm identification benchmark, it must cover all valid items in the easily confused situation ledger. Missing items are supplemented with global θ. When the supplementation ratio exceeds 40%, an insufficient coverage flag is added to the false alarm identification benchmark. The insufficient coverage flag triggers a tiered control instruction to proactively escalate the judgment threshold, tightening it by 8% overall. When a sparse ledger warning exists, the global θ of the false alarm identification benchmark is reduced by 10% overall. After this reduction, the missed detection rate under sparse ledger conditions decreases from approximately 25% to approximately 14%.

[0048] Based on the false alarm identification benchmark, the system performs advance escalation of control commands by matching early warning patterns. When the drive components transition from steady-state wear to accelerated degradation, the current spike density and vibration deviation multiple rise rapidly within a few days. If the response is initiated only after the risk score reaches the level boundary, the execution time required for braking circuit self-check and deceleration strategy adjustment may not cover the remaining window of the accelerated degradation period. Therefore, it is necessary to determine the true alarm trend and escalate the control level in advance based on early warning pattern matching while the risk score is still in the critical range, so that the braking circuit self-check can obtain sufficient lead time. At the current moment, the 3D feature vectors of each level are compared one by one with the local θ of each item of the false alarm identification benchmark. When the feature vector falls within the θ identification area, the item is hit. When multiple items are hit, the precursor matching score P_match is calculated by the following formula: P_match=Σ(w_k×m_k) / Σ(w_k), where m_k is the hit indicator of the kth false alarm identification benchmark item (1 for hit, 0 for miss), w_k is the weight of the corresponding item (0.8 for sparse early warning source items in the ledger, 0.9 for low confidence source items, 0.85 for cross-device cluster source items, and 1.0 for other items). When P_match exceeds 0.75 and the critical urgency of the pre-trigger indicator exceeds 85%, it is determined to be a real alarm precursor, and the hierarchical control command is executed to upgrade in advance. When the false alarm identification benchmark coverage is insufficient, the P_match judgment threshold is tightened from 0.75 to 0.69. Insufficient coverage will cause some real alarm precursors to fall into the matching blind zone. After tightening the threshold, the missed detection of precursors at the edge of the blind zone is significantly reduced. The pre-trigger indicator underestimation compensation indicator tiered precursor matching start threshold is reduced from 85% of the critical urgency to 80%. After underestimation compensation, the urgency benchmark value is conservative by about 5%, and it is simultaneously reduced by 5% to ensure that real critical states are not missed into the escalation blind zone. The tiered control command advance escalation source tier level is raised one level above the original level of the risk classification result. The original four-level tier level will no longer be raised. The tiered control command metadata records the precursor advance indicator and P_match value and other traceability fields for braking circuit priority queuing.

[0049] Step S105: Based on the hierarchical control command, perform a long-duration pre-action self-check on the braking circuit to obtain the redundant braking state. Use the redundant braking state to record the hysteresis of the dual-path braking response to construct a braking verification benchmark. Based on the braking verification benchmark, execute the full-load anti-fall adaptive emergency stop decision and output the emergency stop braking command.

[0050] In some embodiments, the step of performing a long-duration pre-action self-test on the braking circuit according to the graded control command to obtain a redundant braking state includes: determining the inactive duration of the braking circuit according to the graded control command to generate an inactive duration record; determining the circuit to be practiced that has been inactive for the longest time based on the inactive duration record; performing a reverse micro-motion test before self-test on the circuit to be practiced to obtain a pre-action response result; and verifying the stopping consistency at the divergence of the braking circuit through the pre-action response result to obtain a redundant braking state.

[0051] Based on the hierarchical control commands, the inactivity duration of the braking circuit is measured to generate an inactivity duration record. The last action time of the braking circuit is recorded to the second by the controller action log. When the hierarchical control command triggers a self-check, the number of consecutive inactivity days for both circuits A and B is obtained by subtracting the last action times of each circuit from the current time. The two circuits are calculated independently without averaging. The inactivity duration record stores two fields: the circuit number and the log retrieval status, with the circuit number as the primary key. The hierarchical control command priority queue has a tiered log retrieval time limit of 2 minutes, and the batch queue has a tiered time limit of 5 minutes. If the retrieval timeout occurs, the corresponding circuit in the inactivity duration record is conservatively set to 90 days and a log timeout flag is added. Circuits with log timeout flags are forcibly placed at the top of the training queue during the circuit determination phase, regardless of the number of days. When the difference in the number of days between circuits A and B in the inactivity duration record exceeds 15 days, a dual-circuit imbalance flag is added. During the redundant braking status verification phase, the stop consistency judgment window for the unbalanced circuit group is tightened by 15% to prevent the sticky difference introduced by the large difference in the number of inactivity days from being misjudged as normal. If any loop in the inactivity record exceeds 75 days, a high hysteresis indicator is set. During the reverse micro-motion test, the torque of the high hysteresis-marked loop is increased from 5 N·m to 7 N·m, with the increase covering the 95th percentile estimate of the viscous force increment over 75 days. The exercise is considered valid only if the spring preload recovers to more than 95% of its rated value. If both inactivity records exceed 60 days and the difference in days between the two tracks does not exceed 5 days, a double high hysteresis indicator is added. During the redundancy braking state divergence level mapping phase, the slight divergence threshold for the double high hysteresis indicator is narrowed from 15% to 10% to prevent the uniform background noise introduced by the dual-track synchronous viscosity from masking the true divergence characteristics.

[0052] Based on the inactivity duration record, the circuit with the longest inactivity period is identified for testing. The dual-path electromagnetic brakes of the escalator are rarely triggered during daily operation. The brake spring friction pads remain stationary, pressed against the brake disc surface for extended periods. Due to the condensation of trace amounts of moisture and metal oxidation, a rusty, sticky layer gradually forms at the contact interface. Simultaneously, the grease inside the spring cavity gradually solidifies and shrinks under temperature cycling, significantly increasing the resistance at the beginning of the spring release stroke. When an emergency braking signal arrives, the sticky layer and solidified grease together delay the spring release process, causing the actual brake response time to deviate from the factory calibration value. The longer the inactivity period, the greater the deviation. Therefore, during the self-inspection phase, the circuit with the longest inactivity period should be prioritized for testing to eliminate grease buildup. The circuit with the highest recorded inactivity duration has the highest grease risk and is identified as the first circuit to be tested. If the number of days is the same, circuit A is selected. After the first circuit is tested, the inactivity duration record is updated to show the activation time of that circuit. If the difference in days between the two circuits after the update does not exceed 5 days, it is considered to be in a balanced state. In this balanced state, only the first circuit is tested during this self-inspection. Circuits with inactive duration log timeout flags are not subject to day ordering constraints and are forcibly placed as the first circuit to be tested in the current batch. These circuits have the highest uncertainty regarding log timeout stickiness, and their risk of delayed testing is higher than that of known high-duration circuits. If the difference in days between two circuits exceeds 5 days, the second circuit to be tested will be included in this self-test plan. The interval between the two circuits in the same batch must be no less than 8 seconds (one brake release-closure cycle) to prevent incomplete armature reset from affecting the test results of the second circuit. Circuits with high inactive duration flags, if not having the longest number of days, will still be placed in the testing queue immediately after the first circuit to be tested has completed its test, preventing high-duration circuits from being obscured by normal circuits with similar number of days.

[0053] Pre-action response results were obtained by performing a reverse micro-motion test on the circuit to be tested before self-testing. The reverse micro-motion test applied a 5 N·m torque pulse to the brake in the opposite direction to normal braking, lasting 50 ms before being fully released. The pulse broke the viscous layer of the spring friction plate while simultaneously recording the acceleration sequence throughout the release process. The pre-action response results, categorized by test batch and circuit number, included two core components: peak torque response and acceleration sequence during the release phase. In the circuit to be tested, the micro-motion torque of the high-hysteresis-marked circuit was increased to 7 N·m. Under the 5 N·m condition, the probability of incomplete viscous layer breaking in the high-hysteresis circuit was approximately 35%, decreasing to approximately 8% after increasing to 7 N·m. The pre-action response results added an upward torque indicator to the high-hysteresis source circuit, and the acceleration judgment threshold for the release phase was simultaneously increased by 10%. In the training loop, the micro-motion test of the dual-path imbalance identification loop group must be completed within the same self-check cycle. If the time interval between the dual-path tests of the pre-action response results exceeds 8 seconds, an over-limit time interval label will be added. The error correction amount for the response timing comparison of the over-limit labeled loop group during the stop consistency judgment stage will be expanded from ±2ms to ±5ms. If the average acceleration timing of the release segment of the pre-action response results is less than 0.08m / s² in the first 50ms, a response hysteresis label will be added. The judgment threshold for the hysteresis labeled loop during the stop consistency verification stage will be tightened from a response time difference of no more than 30ms to 20ms to prevent the hysteresis state from masking the real dual-path divergence. Loops with a peak torque response of the pre-action response results that is less than 70% of the applied torque will be labeled with an insufficient response label. Loops with an insufficient response label will be forcibly downgraded to low confidence during the redundant braking state level mapping stage. The allowable deceleration limit for the low confidence redundant braking state will be further reduced by 0.05m / s² in the corresponding channel of the braking verification benchmark.

[0054] The redundant braking state is obtained by verifying the consistency of stop selection when the braking circuit diverges through the pre-action response results. When any single circuit of the escalator's dual-circuit brake fails, the other circuit must independently complete braking. The acceleration timing sequence of the dual-circuit release segment in the pre-action response results is subtracted moment by moment after alignment along a common time axis. When the absolute value of the difference sequence exceeds 0.04 m / s², and the proportion of moments exceeding 20% ​​of the total test duration, it is determined as a dual-circuit divergence. The divergence level of the redundant braking state is determined by a linear mapping of the divergence proportion. Before comparing the difference sequence of the pre-action response result time interval exceeding the limit identifier circuit group, ±5ms time shift compensation is performed. After compensation, the exceeding proportion can be reduced from approximately 28% to approximately 15%. A time shift compensation identifier is added to the time shift compensation source of the redundant braking state. When assigning the time shift compensation identifier status to the braking verification benchmark hysteresis field, the original Δt_AB before compensation is used instead of the value after compensation, ensuring accurate recording of physical delay. The judgment window for the pre-action response result response hysteresis identifier circuit group is tightened to 20ms. A divergence is determined when the proportion of difference sequence exceeding the limit exceeds 15%. A hysteresis divergence identifier is added to the hysteresis source divergence of the redundant braking state. Redundant braking status divergence levels are categorized into consistent (less than 5%), slight divergence (5-15%), significant divergence (15-30%), and severe divergence (more than 30%). Severe divergence triggers a temporary halt in the operation of the escalator in that batch until the dual-path brakes are calibrated on-site. The brake verification benchmark does not accept the hysteresis benchmark value of severe divergence status for storage. The threshold for judging slight divergence in the double-high-delay indicator of inactive duration is narrowed to 10%. Due to the homogenization of divergence characteristics caused by dual-path synchronous viscosity, a loose threshold can easily mask potential significant divergences. Narrowing the threshold suppresses the omission of such synchronous viscosity.

[0055] A braking verification benchmark is constructed by recording the hysteresis of dual-path braking responses under redundant braking conditions. The hysteresis rate R_brake is obtained by normalizing the measured Δt_AB (absolute difference in activation times between the two paths, in milliseconds) of each stage under redundant braking conditions to the factory rated benchmark value t_ref. The calculation formula is as follows: R_brake = Δt_AB / t_ref × 100%, where t_ref is the dual-path calibration response time difference (in milliseconds) recorded during factory acceptance. When R_brake is below 50%, the braking verification benchmark is considered normal hysteresis; 50% to 100% is considered slight degradation; and above 100% is considered severe degradation. The allowable deceleration limit for the corresponding channel in severe degradation is conservatively reduced by 0.08 m / s² from the rated value. The allowable deceleration limit for the corresponding channel in the braking verification benchmark for the stage with hysteresis branching under redundant braking conditions is further reduced by 0.03 m / s² from the R_brake classification result. The response delay uncertainty introduced by hysteresis branching is approximately 1.4 times that of the normal channel. The redundant braking state time shift compensation flag uses the original Δt_AB before compensation to calculate R_brake in the tiered braking verification benchmark hysteresis field. After compensation, the value will underestimate the time delay by about 4ms, corresponding to a stop distance compensation shortfall of about 0.002m. When accumulated to the design margin boundary, the risk of falling increases by about 3%. The redundant braking state insufficient response flag corresponding to the tiered braking verification benchmark has its allowable deceleration limit further reduced by 0.05m / s² based on the R_brake classification result. The maximum reduction after the two reductions are combined for severely degraded and insufficient response tiers is about 0.13m / s². Tiers with a braking verification benchmark R_brake exceeding 120% are marked with an over-severe degradation flag. The safety margin threshold for emergency stop braking command stop distance verification of tiers with over-severe degradation flags is increased by 10% from the standard value to cover the risk of braking distance deviation introduced by severe hysteresis degradation. After the fields of each level of the brake calibration benchmark are confirmed, the R_brake quantile statistics of the whole batch are performed. When the 75th percentile exceeds 80%, a full batch degradation warning is added. The warning triggers the maintenance system to send a comprehensive brake overhaul work order. The brake calibration benchmark metadata records the warning trigger time and the R_brake quantile distribution. When the full batch degradation warning and the graded control command high proportion of level 4 warning exist at the same time, the brake maintenance priority is raised to emergency.

[0056] In some embodiments, the step of executing a full-load anti-fall adaptive emergency stop decision and outputting an emergency stop command based on the braking verification benchmark includes: calculating the real-time load distribution based on the braking verification benchmark to form a load distribution state; analyzing the full-load trampling and fall risk based on the load distribution state to determine the fall risk level; performing load adaptive deceleration adjustment to generate a deceleration adjustment curve based on the fall risk level; and verifying the required stopping distance margin for anti-fall based on the deceleration adjustment curve and outputting an emergency stop command.

[0057] The load distribution status is formed by extrapolating the real-time load distribution based on the braking verification benchmark. During emergency braking of the escalator, the braking force is uniformly applied to all steps. However, passengers at the entrance section have not yet established their balance, passengers at the exit section have their center of gravity shifting forward in anticipation of arrival, and passengers in the middle section have the most stable posture. Passengers in different spatial positions experience significantly different fall risks when subjected to the same deceleration. Therefore, emergency stop decisions must be based on the real-time load rate of each step rather than the average load of the entire escalator to formulate a deceleration strategy. The portion of the average current exceeding the rated no-load current at the time the braking verification benchmark is established is divided by the single-person stepping current increment of 0.08A / person to obtain the passenger flow estimate. Multiplying the passenger flow estimate by the average weight of a single person (70kg) yields the total load capacity. The ratio of the total load capacity of each step to the fully loaded rated load capacity (1200kg) constitutes the main field of the load rate in the load distribution status. The confidence level of the load extrapolation for steps with severe degradation is lowered, and a low-confidence load indicator is added to the steps with severe degradation sources in the load distribution status. The braking verification benchmark maps the R_brake degradation level and the allowable deceleration limit of each stage to the load distribution status. The deceleration limit of high-load stages narrows with load rate based on the allowable value of the braking verification benchmark. After narrowing, the deceleration limit is recorded in the load verification field and output to the fall risk level determination stage. Stages with a load rate exceeding 0.90 in the load distribution status are marked with a high-load indicator. When the number of high-load indicators exceeds 30% of the total number of stages, an overall high-load warning is added. The overall high-load warning triggers an emergency stop braking command and the global stopping distance margin threshold is increased. When the 90th percentile load rate in the load distribution status exceeds 0.95, an extremely high load percentile warning is added. The extremely high load percentile warning triggers an emergency stop braking command and tightens the allowable maximum impact rate limit during the impact rate shaping stage.

[0058] The fall risk level is determined by analyzing the risk of trampling and falls under full load conditions based on the load distribution. With a standing center of gravity height of approximately 1.0m, when the deceleration exceeds 0.5m / s² during a sudden stop, the forward tilting moment exceeds the frictional support moment. Under full load conditions (load rate ≥ 0.90), the mutual support effect among passengers reduces the critical deceleration from 0.5m / s² to approximately 0.42m / s². The critical deceleration for fall risk is calculated as follows: 0.42m / s² when the load rate exceeds 0.90, 0.48m / s² when it is between 0.60 and 0.90, and 0.55m / s² when it is below 0.60. These three critical deceleration levels correspond to high, medium, and low fall risk levels, respectively. For load distribution status, the fall risk level of the low-confidence load indicator is shifted one level towards a more conservative direction. Under low-confidence conditions, the actual load may be about 6% higher than the estimate. The single-level upward adjustment covers the underestimation of fall risk introduced by this deviation. The fall risk level adds a conservative upward adjustment indicator to the low-confidence source load. When the overall high load warning exists in the load distribution status, the proportion of high-risk loads in the entire batch must be verified before the deceleration adjustment curve is generated. When the proportion of high-risk loads exceeds 40%, a batch high-risk indicator is added to the fall risk level. The batch high-risk indicator triggers an emergency stop braking command, and the upper limit of the allowable impact rate is tightened simultaneously during the impact rate shaping stage. For load distribution status, the critical deceleration of the fall risk level of the load verification field for which the allowable deceleration upper limit has been lowered is taken as the smaller of the lowered value after verification and the three standard critical values. The fall risk level adds a deceleration constraint source indicator to this type of load. The deceleration constraint source indicator is directly used as the deceleration upper limit constraint boundary input during the deceleration adjustment curve generation stage and is not compared again. When both the extremely high load distribution warning and the batch high-risk indicator exist simultaneously, the critical deceleration of each level of the fall risk level for the entire batch is reduced by 0.02 m / s². After the superposition, the critical deceleration of the high-risk level drops to 0.40 m / s², and the corresponding minimum stopping distance increases from about 0.298 m to 0.313 m. The difficulty of passing the stopping distance margin verification is correspondingly increased.

[0059] For example, the step of generating a deceleration adjustment curve by performing load adaptive deceleration adjustment based on the fall risk level includes: dividing the stairwell into congestion density zones based on the fall risk level; determining the upper limit of deceleration for each zone based on the congestion density zone; performing impact rate shaping within an advance response window using the upper limit of deceleration for each zone to obtain an impact rate shaped value; and constructing a deceleration adjustment curve with a steep initial drop and a gradual final drop based on the impact rate shaped value.

[0060] Congestion density zones for escalators are defined based on fall risk levels. A single escalator typically has approximately 24 steps. Passengers have the lowest standing stability on the first 8 steps of the entrance section, while on the last 8 steps of the exit section, passengers anticipate their arrival and actively adjust their center of gravity. The standing stability is highest on steps 8 to 16 of the middle section. The load rate of each step for each fall risk level is averaged across these three spatial zones, and the combined results form the density profiles of the three congestion density zones. Zones with a mean value exceeding 0.85 are marked as high-density zones. The maximum deceleration allowed for high-density zones is reduced by an additional 0.03 m / s² from the global critical deceleration. For steps with a conservative upward adjustment marking for fall risk levels, the zone assignment is determined by the original step location. This conservative upward adjustment only affects the deceleration constraint value and does not affect the spatial density calculation. The congestion density zones also add a low-confidence density marking to the sections containing the conservatively upward marked steps. The maximum deceleration allowed for low-confidence density zones is reduced by an additional 0.02 m / s². When all three high-density markers in the congestion density zone are triggered, a full-line high-density warning is added. The duration of the initial segment of the deceleration adjustment curve triggered by the full-line high-density warning is uniformly extended to the high-risk level of 0.65 seconds, and the stopping distance increases by approximately 0.016m. The calculated curve braking stopping distance must be updated synchronously during the stopping distance margin verification phase. If the deceleration constraint source marker tier for the fall risk level overlaps with the high-density marker segment in the congestion density zone, the smaller of the two downward adjustment values ​​(more conservative) is taken as the final allowable deceleration limit for that segment. If the two downward adjustment values ​​are the same, a double-constraint marker is added to the corresponding segment in the congestion density zone. The base value of the impact rate shaping value for the double-constraint marker segment is increased by 10%. When the difference in the mean density of adjacent segments in the congestion density zone exceeds 0.15, the boundary markers simultaneously participate in the calculation of both constraint segments, and the more conservative result is taken. The boundary marker with the more conservative result takes priority over single-segment constraints during the deceleration adjustment curve generation phase.

[0061] The deceleration limits for each zone are determined based on congestion density. Passenger standing stability at the entrance is approximately 15% lower than in the middle zone, with the middle zone exhibiting the highest stability. The exit zone falls between the two. The permissible deceleration limits for these three zones are calculated as global critical deceleration × 0.88, × 0.95, and × 0.92, respectively. The segmentation coefficients are derived from actual measured passenger stability data for each segment. The basic permissible deceleration limit for each congestion density zone is determined by the product of the global critical deceleration and the segmentation coefficient. The permissible deceleration limit for the high-density zone is further reduced by 0.03 m / s² from the basic value, and for the low-confidence density zone, it is further reduced by 0.02 m / s². A 6% deviation in the low-confidence density passenger flow estimation corresponds to a deceleration critical deviation of approximately 0.025 m / s². The 0.02 m / s² reduction covers 80% of this deviation, with the remaining 20% ​​absorbed by the impact rate shaping stage safety margin. For congestion density zones with dual constraints, the smaller of the two adjusted values ​​is used. Simultaneously, the base value of the impact rate shaping value is increased by 10% and recorded in the shaping parameter field. The shaping parameter field is directly read during the impact rate shaping stage without recalculation. The final allowable deceleration limit for each congestion density zone is recorded in the zone deceleration limit field, which is directly accessed during the impact rate shaping stage. When a high-density warning for the entire road congestion density zone is in effect, the allowable deceleration limit for all three zones is the smaller of their respective adjusted values ​​and 0.35 m / s². 0.35 m / s² is the absolute lower limit of safety regulations under full-load high-density conditions. Below 0.35 m / s², the emergency braking distance margin will be systematically negative.

[0062] The impact rate shaping value is obtained by performing impact rate shaping within the pre-reaction window using the zone deceleration upper limit. The pre-reaction window is the delay time from the issuance of the emergency stop command to the start of brake action. The standard brake response delay is approximately 80ms. The corresponding initial impact rate is obtained by dividing the zone deceleration upper limit by the pre-reaction window of 0.08 seconds. If the initial impact rate exceeds 1.5m / s³, shaping and compression must be performed within the 0.08-second window, with a compression coefficient of 1.5 / initial value. The impact rate shaping value is based on the impact rate after shaping for each zone. The corresponding initial duration is calculated by dividing the zone deceleration upper limit by the impact rate after shaping. At the end of the initial stage, the deceleration exactly reaches the zone deceleration upper limit. The impact rate after shaping, the initial duration, and the compression coefficient together constitute the impact rate shaping value for each zone. When the high-risk fall risk level batch is present, the upper limit of the allowable impact rate is tightened from 1.5 m / s³ to 1.2 m / s³. For zones exceeding this limit, the compression coefficient is correspondingly tightened, and the deceleration rate rise slope after compression becomes more gradual. The impact rate shaping value is then associated with the batch compression indicator for the source zone of the batch tightening. For the congestion density zone with dual-constraint indicators, the pre-shaping time window is extended from 0.08 seconds to 0.088 seconds. After this extension, the initial impact rate decreases by approximately 10%, and the shaping compression coefficient is relaxed. The impact rate shaping value is then associated with the time window extension indicator for the source zone of the dual-constraint indicators. When the congestion density zone has a high-density warning across the entire line, the impact rate shaping values ​​for all three zones are uniformly taken from the most stringent parameter at the entrance section. The stringent parameter at the entrance section covers the middle and exit sections, meaning that the overall deceleration strategy is aligned with the most vulnerable space section to ensure the lowest possible fall risk across the entire line. The physiological perception threshold of impact rate for the human body is approximately 1.2 to 1.5 m / s³. Tightening the impact rate to 1.2 m / s³ for high-load zones corresponds to the lower limit of the safety margin for lower limb muscle strength for elderly passengers and passengers carrying heavy loads.

[0063] A deceleration adjustment curve is generated by constructing a steep descent curve at the beginning and a gradual deceleration curve at the end based on the impact rate shaping value. The impact rate shaping value for each zone has recorded the shaped impact rate and the corresponding duration of the preceding phase. The deceleration at the beginning rises continuously with the shaped impact rate as the slope until the end of the preceding phase duration. At the end, the deceleration reaches the upper limit value of each zone. The parameters of the deceleration adjustment curve at the beginning are directly determined by calling the corresponding entries of the impact rate shaping value before entering the gradual deceleration design at the end. The gradual deceleration design at the end is based on the physiological response time of approximately 0.2 seconds for the passenger's center of gravity to tilt forward due to inertia at the moment the escalator stops. The deceleration at the end of each zone of the impact rate shaping value smoothly decreases from the peak value at the end of the preceding phase to a low value, then decelerates uniformly until the speed reaches zero. The transition from high to low value at the end lasts approximately 0.1 seconds, and the uniform deceleration continues until the speed reaches zero. The total duration of the deceleration adjustment curve at the end is approximately 0.2 to 0.35 seconds. The impact rate shaping value batch compression indicator zone's final stage reduction is appropriately narrowed, and the final stage deceleration from peak to stop is more gradual, matching the overall batch high-density conservative strategy. The deceleration adjustment curve adds a final stage adjustment indicator to the batch compression source zone. The impact rate shaping value time window expansion indicator zone's initial stage duration has been extended due to the shaping time window expansion, while the final stage duration maintains the standard value and does not follow suit, avoiding excessive stress reactions from passengers due to an excessively long total stopping time. The deceleration adjustment curve records the ratio of the initial and final stage durations in the curve parameter field. The distribution of the initial and final stage durations reflects the balance between the rapid force-building phase and the center of gravity stabilization phase during braking. If the initial stage duration is too short, the braking force is built up too quickly, resulting in a greater impact on the passenger's lower limb joints; if the initial stage duration is too long, the escalator's inertial sliding distance increases before the braking force is fully built up. The final stage deceleration convergence rate matches the passenger's ankle joint active correction time constant of approximately 0.15 to 0.20 seconds, ensuring that the passenger's center of gravity tilt does not exceed the single-leg support stability range at the moment the escalator stops.

[0064] The system verifies the required stop distance margin for fall prevention based on the deceleration adjustment curve and outputs an emergency stop command. The deceleration adjustment curve has arranged the deceleration process of each step into a complete time-domain sequence consisting of a steep descent at the beginning, a gentle descent at the end, and a smooth section at the boundary of the zone. The stop distance verification directly uses the curve as the integration object: the speed time history of the beginning, end, and smooth sections is integrated, and the areas of the three sections are summed to obtain the stop distance of the current step's curve. The time difference of the dual-path response recorded in the braking verification benchmark is converted into the additional distance for the escalator to continuously slide at 0.5 m / s before the braking takes effect, and must be added together. The allowable stop distance of the facility calculated based on the current step load in the braking verification benchmark is then subtracted from the curve braking stop distance and the additional sliding distance to obtain the stop distance margin for fall prevention of this step. When the margin is not less than 0.024 m, the curve is deemed to meet the fall prevention requirements, and an emergency stop command is output. The lower limit for each level of margin judgment is adjusted upwards according to its marking: the braking distance uncertainty of the level marked by severe degradation in braking verification benchmark is approximately 0.012m, and the threshold is raised to 0.036m; the braking distance of the level marked by batch compression of deceleration adjustment curve increases accordingly after the curve is extended, and the threshold is raised to 0.030m; the threshold of the level marked by conservative upward adjustment of fall risk level is raised by 0.008m; the allowable stopping distance of the level marked by deceleration constraint of deceleration adjustment curve is further reduced by 5% before verification to prevent the conservative deceleration parameters from being artificially inflated in the margin verification process after being passed through layers. When the margin is lower than the corresponding lower limit, the output is rejected, and the deceleration adjustment curve is sent back to be regenerated: the duration of the first segment is extended by 10% to reduce the deceleration slope and reduce the impact of the curve on passengers, and the duration of the final slightly gentle segment is extended by 15% to lengthen the buffer zone for passengers to stabilize their center of gravity. After the extension, the curve is re-integrated segment by segment and the margin verification is performed again. If the threshold is not met after more than two cumulative regenerations, an emergency stop command is forcibly output and an insufficient margin alarm is added. Simultaneously, the escalator is decelerated to a 0.3m / s operating mode, which compensates for the minimum safety margin requirement when the curve cannot converge by compressing the initial kinetic energy of the escalator.

[0065] To implement the above-described method embodiments, a method for escalator safety monitoring and emergency stop control is provided to achieve the corresponding functions and technical effects. See also... Figure 2 , Figure 2 This diagram illustrates a structural block diagram of an escalator safety monitoring and emergency stop control system 200 according to an embodiment of this application. For ease of explanation, only the parts relevant to this embodiment are shown. The escalator safety monitoring and emergency stop control system 200 provided in this embodiment includes: Data acquisition module 201 is used to collect mechanical status data, electrical status data and passenger status data during the operation of the escalator, and to identify abnormal passenger behavior based on the passenger status data to form passenger behavior data. Anomaly identification module 202 is used to use the passenger behavior data to screen for current spikes unrelated to the load from the electrical status data to generate current spike data, analyze the wear trend of the drive part by combining the current spike data with the mechanical status data to obtain wear sign data, and identify trend abnormal signs based on the wear sign data to generate anomaly identification results. Risk classification module 203 is used to track the maintenance history of recurring faults based on the anomaly identification results to establish a risk calibration benchmark, to collect hidden dangers during the silent period of each channel based on the risk calibration benchmark to generate hidden danger weight data, and to perform recurrence progressive weighted classification based on the hidden danger weight data to determine the risk classification result. The hierarchical control module 204 is used to collect critical non-triggered events based on the risk classification results to form a pre-triggering identifier, use the pre-triggering identifier to verify historical suppressed false alarm samples to establish a false alarm identification benchmark, and perform precursor pattern matching to generate hierarchical control instructions based on the false alarm identification benchmark. The redundant braking module 205 is used to perform a long-duration pre-action self-check on the braking circuit according to the graded control command to obtain the redundant braking state, use the redundant braking state to record the hysteresis of the dual-path braking response to construct a braking verification benchmark, and execute a full-load anti-fall adaptive emergency stop decision based on the braking verification benchmark to output an emergency stop braking command.

[0066] The aforementioned escalator safety monitoring and emergency stop control system 200 can implement an escalator safety monitoring and emergency stop control method according to the above method embodiments. The options in the above method embodiments are also applicable to this embodiment, and will not be detailed here. The remaining content of this application embodiment can be referred to the content of the above method embodiments, and will not be repeated in this embodiment.

[0067] The above embodiments are not an exhaustive list based on the present invention, and there may be many other embodiments not listed. Any substitutions and improvements made without departing from the concept of the present invention are within the protection scope of the present invention.

Claims

1. A method for safety monitoring and emergency stop control of escalators, characterized in that, include: Collect mechanical status data, electrical status data and passenger status data during the operation of the escalator, and identify abnormal passenger behavior based on the passenger status data to form passenger behavior data. The passenger behavior data is used to screen for current spikes unrelated to the load from the electrical status data to generate current spike data. The current spike data is combined with the mechanical status data to analyze the wear trend of the drive parts to obtain wear sign data. Based on the wear sign data, trend abnormal signs are identified to generate anomaly identification results. Based on the anomaly identification results, the maintenance history of recurring faults is tracked to establish a risk calibration benchmark. Based on the risk calibration benchmark, hidden dangers during the silent period of each channel are statistically analyzed to generate hidden danger weight data. Based on the hidden danger weight data, a recurrence progressive weighted classification is performed to determine the risk classification result. For the risk classification results, a preliminary triggering identifier is formed by collecting critical non-triggered events. The preliminary triggering identifier is used to verify historical suppressed false alarm samples to establish a false alarm identification benchmark. Based on the false alarm identification benchmark, a precursor pattern matching advanced upgrade is performed to generate a graded control instruction. Based on the graded control command, the braking circuit is subjected to a long-duration pre-action self-check to obtain a redundant braking state. The redundant braking state is used to record the hysteresis of the dual-path braking response to construct a braking verification benchmark. Based on the braking verification benchmark, a full-load anti-fall adaptive emergency stop decision is executed to output an emergency stop braking command.

2. The method according to claim 1, characterized in that, The process of identifying abnormal passenger behavior based on the passenger status data to form passenger behavior data includes: Based on the passenger status data, target detection and localization of passenger positions are performed to generate passenger posture sequences. An attitude offset sequence is obtained by screening unstable attitude deviations based on the passenger attitude sequence; The instability event set is generated by aggregating the same-position instability avoidance events through the attitude offset sequence; Passenger behavior data is generated by statistically analyzing the clustering of single-level avoidance anomalies in the aforementioned set of instability events.

3. The method according to claim 1, characterized in that, The step of using the passenger behavior data to screen for load-independent current spikes from the electrical status data to generate current spike data includes: The load current component is generated by analyzing the current component corresponding to the load carried by the passenger behavior data. Based on the load current component, load components are systematically removed from the electrical state data to obtain load-independent residuals; The spike peak sequence is obtained by screening subthreshold clustered spike peaks using the load-independent residual screening method. The current glitch data is generated by statistically analyzing the subthreshold glitch density per unit stroke of the glitch peak sequence.

4. The method according to claim 1, characterized in that, The process of generating hazard weight data for each channel during the quiet period based on the risk calibration benchmark includes: The silence duration distribution of each channel was obtained by measuring the silence duration against the aforementioned risk calibration benchmark. Based on the distribution of silent duration, identify overdue untriggered components and generate an overdue silent list; The remaining life margin is determined by verifying the failure range of similar components using the overdue silent list. Based on the remaining lifetime margin, a weighted score for silent hazards is generated to form hazard weight data.

5. The method according to claim 1, characterized in that, The step of establishing a false alarm discrimination benchmark by verifying the suppressed false alarm samples in the history using the pre-triggered identifier includes: The false alarm sample set is obtained by using the pre-trigger identifier to collect historical suppressed false alarm samples; Based on the false alarm sample set, extract easily confused false alarms and real alarms to construct a ledger of easily confused situations; The identification and protection boundaries are determined by verifying the actual alarm critical missed detection boundary through the ledger of the easily confused situations. Based on the aforementioned screening and protection boundary, a false alarm screening benchmark is established with the asymmetric cost of missed detection and false alarm as a constraint.

6. The method according to claim 1, characterized in that, The step of performing a prolonged pre-action self-check on the braking circuit based on the graded control command to obtain a redundant braking state includes: Based on the graded control command, the duration of inactivity of the braking circuit is determined and a duration of inactivity is recorded. The loop to be practiced is determined based on the recorded inaction time. A pre-motion response result is obtained by performing a reverse micro-motion test on the circuit to be tested before self-testing. The redundant braking state is obtained by verifying the stopping consistency when the braking circuit diverges through the pre-action response results.

7. The method according to claim 1, characterized in that, The step of executing a full-load anti-fall adaptive emergency stop decision and outputting an emergency stop command based on the braking verification benchmark includes: Based on the braking verification benchmark, the real-time load distribution is calculated to form the load distribution state; Based on the load distribution status analysis, the risk of trampling and falling under full load is determined to establish the fall risk level; The load adaptive deceleration adjustment is performed based on the fall risk level to generate a deceleration adjustment curve; Based on the deceleration adjustment curve, verify the required stopping distance margin for fall prevention and output an emergency stop braking command.

8. The method according to claim 4, characterized in that, The step of identifying overdue, untriggered components based on the distribution of silence duration and generating an overdue silence list includes: Based on the distribution of silence duration, a set of long silent channels is obtained by screening out channels with super-mean silence duration. Active stimulation is performed based on the long silent channel set, and the stimulation response is detected to obtain the stimulation response record; The failure path list is determined by identifying failure paths with missing responses and regular anomalies through the stimulus response records. The list of failed channels is used to compile a list of expired silent components that have not been triggered within the specified time.

9. The method according to claim 7, characterized in that, The step of generating a deceleration adjustment curve by performing load adaptive deceleration adjustment based on the fall risk level includes: Based on the aforementioned fall risk level, the stairwell is divided into congestion density zones; The upper limit for deceleration in a given zone is determined based on the congestion density zone. The impact rate is shaped by performing impact rate shaping within the pre-reaction time window using the aforementioned partition deceleration upper limit; A deceleration adjustment curve is generated by constructing a steep descent curve at the beginning and a gradual deceleration curve at the end based on the impact rate shaping value.

10. A safety monitoring and emergency stop control system for escalators, characterized in that, include: The data acquisition module is used to collect mechanical status data, electrical status data and passenger status data during the operation of the escalator, and to identify abnormal passenger behavior based on the passenger status data to form passenger behavior data. An anomaly identification module is used to use the passenger behavior data to screen for current spikes unrelated to the load from the electrical status data to generate current spike data, analyze the wear trend of the drive parts by combining the current spike data with the mechanical status data to obtain wear sign data, and identify trend abnormal signs based on the wear sign data to generate anomaly identification results. The risk grading module is used to track the maintenance history of recurring faults based on the anomaly identification results, establish a risk calibration benchmark, statistically analyze the hidden dangers during the silent period of each channel based on the risk calibration benchmark to generate hidden danger weight data, and perform recurrence progressive weighted grading based on the hidden danger weight data to determine the risk grading result. The hierarchical control module is used to collect critical non-triggered events based on the risk classification results to form a pre-triggered identifier, use the pre-triggered identifier to verify historical suppressed false alarm samples to establish a false alarm identification benchmark, and perform precursor pattern matching to generate hierarchical control instructions based on the false alarm identification benchmark. The redundant braking module is used to perform a long-duration pre-action self-check on the braking circuit according to the graded control command to obtain the redundant braking state, use the redundant braking state to record the hysteresis of the dual-path braking response to construct a braking verification benchmark, and execute a full-load anti-fall adaptive emergency stop decision based on the braking verification benchmark to output an emergency stop braking command.

Images