A robot battery safety cooperative protection system and electronic equipment

Abstract

The application provides a robot battery safety cooperative protection system and electronic equipment, and solves the technical problems of coexistence of false protection and missed protection caused by solidification of a protection threshold of an existing robot battery, easy robot instability and overturn caused by single hard power-off, aggravation of fault deterioration caused by mutual separation of battery monitoring and motion control, missing posture interlocking protection mechanism, and interruption of protection caused by single communication link failure, and realizes full-process safety cooperative protection of cross-linking and grading determination of electrical parameters of a battery of a robot and body posture data of the robot, gradient constraint of robot motion in a fault, continuous protection function without interruption in a communication anomaly, and automatic release of protection after recovery of a fault parameter.

Description

Technical Field

[0001] This application relates to the field of robot safety control technology, and in particular to a robot battery safety collaborative protection system and electronic device. Background Technology

[0002] Existing robot battery protection technologies and overall safety systems are based on traditional equipment designs that are stable, low-dynamic, and have stable postures. They are not adapted to the high-dynamic, unstable, and impact-prone operating characteristics of quadruped or humanoid robots. The overcurrent, low-voltage, low-charge, and over-temperature protection thresholds of existing battery management systems are all factory-fixed parameters, which cannot adapt to the dynamic impact conditions of legged robots. This can easily lead to false protection shutdowns or leakage protection that damages the battery cells. Furthermore, the system only has a single undervoltage power-off protection without gradient motion restrictions or posture fallback logic. When the charge or voltage approaches the threshold, the power is directly cut off, which can easily cause the robot to become unstable and tip over, resulting in secondary damage to the equipment.

[0003] Furthermore, in traditional solutions, battery protection and robot motion control systems are independent of each other. High-power actions can still be performed when the battery is abnormal, which will exacerbate the failure and create a vicious cycle. The existing system does not introduce a mechanism to judge the body posture and vibration impact. Under unbalanced conditions, high-power discharge poses a high risk of fire and short circuit. At the same time, the protection parameters need to be fixed by burning firmware for modification, and there is no online configuration capability, which cannot flexibly adapt to the differentiated protection needs of multiple models and multiple scenarios. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a robot battery safety collaborative protection system and electronic device. By constructing a robot battery safety collaborative protection system with an integrated battery and motion collaborative protection architecture consisting of a data acquisition unit, a safety collaborative decision-making unit, a dual-redundant communication unit and a motion control unit, the system solves the technical problems of existing robot battery protection thresholds, such as the coexistence of false protection and leakage protection, the ease with which a single hard power failure can cause robot instability and overturning, the separation between battery monitoring and motion control which exacerbates fault deterioration, the lack of attitude interlock protection mechanism, and protection interruption due to single communication link failure. The system achieves full-process safety collaborative protection by cross-linking and hierarchical judgment of robot battery electrical parameters and body attitude data, fault gradient constraint of robot motion, continuous protection function during communication abnormalities, and automatic release of protection after fault parameters are restored.

[0005] This application provides a robot battery safety collaborative protection system, which includes a data acquisition unit, a safety collaborative decision-making unit, a motion control unit, and a dual-redundant communication unit. The safety collaborative decision-making unit is signal-connected to the data acquisition unit, and establishes a bidirectional communication connection with the motion control unit through the dual-redundant communication unit. The data acquisition unit is used to collect battery operation data corresponding to the lithium battery module set in the target robot in response to the robot battery safety collaborative protection system completing power-on synchronization initialization and full-link self-test, and to collect the three-axis tilt angle data of the target robot body. The safety collaborative decision-making unit is used to cross-validate the battery operation data and the fuselage three-axis tilt angle data based on preset trigger thresholds, hierarchical protection logic, and motion constraint strategies. It uses a preset multi-fault priority arbitration mechanism to determine the fault level judgment result corresponding to the lithium battery module and outputs the protection control command corresponding to the fault level judgment result. In response to detecting that the battery operation data and the fuselage three-axis tilt angle data rise to a level greater than or equal to a preset exit hysteresis threshold and the rise duration is greater than or equal to a preset stabilization duration, it generates and outputs a protection level rollback command. The motion control unit is configured to, in response to receiving the protection control command, perform constraint control corresponding to the protection control command on the integrated joint unit of the target robot, or in response to receiving the protection level reversal command, perform release control corresponding to the protection level reversal command on the integrated joint unit. The dual-redundant communication unit includes an industrial bus channel and a hard-wired security channel. The hard-wired security channel is used to monitor the master control heartbeat signal of the industrial bus channel in real time. In response to the interruption time of the master control heartbeat exceeding the preset interruption duration and determining that the industrial bus channel has failed, it independently takes over the hierarchical protection logic and replicates the hierarchical protection strategy.

[0006] Furthermore, the system also includes a threshold storage management unit; The threshold storage management unit has a built-in non-volatile storage component for storing the trigger threshold and the exit hysteresis threshold corresponding to the trigger threshold; wherein, both the trigger threshold and the exit hysteresis threshold support online custom configuration and multi-condition parameter template configuration switching; The trigger thresholds include low battery warning threshold, severe low battery protection threshold, individual cell low voltage protection threshold, total low voltage protection threshold, instantaneous peak overcurrent threshold, continuous overcurrent threshold, cell overtemperature threshold, bus overtemperature threshold, fuselage tilt warning threshold, and fuselage tilt fault threshold; the exit hysteresis thresholds include low battery warning exit threshold, severe low battery protection exit threshold, individual cell low voltage protection exit threshold, total low voltage protection exit threshold, instantaneous peak overcurrent exit threshold, continuous overcurrent exit threshold, cell overtemperature exit threshold, bus overtemperature exit threshold, fuselage tilt warning exit threshold, and fuselage tilt fault exit threshold.

[0007] Furthermore, the fault level determination result includes one of the following: normal operation, level one warning, level two severe fault, and ultimate fallback fault; The system also includes a multi-level battery safety protection unit; the multi-level battery safety protection unit integrates the hierarchical protection logic and the motion constraint strategy corresponding to the hierarchical protection logic. The graded protection logic includes low power protection, severe low power protection, low voltage protection, graded overcurrent protection, graded overtemperature protection, graded tilt protection, and ultimate protection; wherein, the graded overcurrent protection includes overcurrent warning protection and continuous overcurrent fault protection, the graded overtemperature protection includes overtemperature warning protection and severe overtemperature fault protection, and the graded tilt protection includes tilt warning protection and tilt fault protection. The motion constraint strategy includes a first-level early warning strategy, a second-level severe fault strategy, and a final fallback strategy; wherein, the low battery protection, the tilt angle early warning protection, the overcurrent early warning protection, and the overtemperature early warning protection correspond to the first-level early warning strategy; the severe low battery protection, the low voltage protection, the continuous overcurrent fault protection, the severe overtemperature fault protection, and the tilt angle fault protection correspond to the second-level severe fault strategy; and the final protection corresponds to the final fallback strategy.

[0008] Furthermore, the first-level early warning strategy includes at least one of power limiting and height limiting dynamic actions, and retains the basic operational capabilities of the target robot; the second-level severe fault strategy includes at least one of locking movement, forced posture reset, and cutting off high-power output; the ultimate fallback strategy includes at least a physical hardware circuit breaker and irreversible cutting off of high voltage. The secondary severe fault strategy includes an attitude secondary fault strategy and an electrical secondary severe fault strategy; the multi-fault priority arbitration mechanism includes: the ultimate fallback strategy is superior to the attitude secondary fault strategy, the attitude secondary fault strategy is superior to the electrical secondary severe fault strategy, and the electrical secondary severe fault strategy is superior to the primary early warning strategy; When multiple motion constraint strategies are triggered simultaneously, the protection control instruction corresponding to the motion constraint strategy with the first priority masks the protection control instruction corresponding to the motion constraint strategy with the second priority, so as to avoid control logic conflicts.

[0009] Furthermore, the graded overcurrent protection includes logic for distinguishing between transient impacts and persistent faults; the logic for distinguishing between transient impacts and persistent faults includes: When the duration of the peak discharge current of the lithium battery module is less than or equal to the first preset overcurrent duration, the movement of the target robot is determined to be a normal inrush current and overcurrent protection is not triggered. When the discharge current of the lithium battery module is greater than the preset continuous overcurrent threshold and the duration is greater than the second preset overcurrent duration, the lithium battery module is determined to have a current fault, and the graded overcurrent protection is triggered.

[0010] Furthermore, the timing execution logic corresponding to the Level 2 severe fault strategy includes: The walking movement of the target robot is locked, and new operation commands for the target robot are blocked; the target robot is controlled to lie down or squat down to reset, and after the lie down or squat down reset is stable, a high-power discharge limiting operation is performed; wherein, in the process group of executing the timing execution logic, the tilt angle data of the three axes of the robot body is monitored in a closed loop to avoid instability during the lie down or squat down reset process.

[0011] Furthermore, the system also includes a three-level hardware circuit breaker unit; the three-level hardware circuit breaker unit is connected in series in the high-voltage output main circuit of the lithium battery module; The three-level hardware circuit breaker unit includes a MOS pre-disruption circuit, a high-voltage relay main circuit, and a thermal fuse final circuit arranged in sequence. The three-level hardware circuit breaker unit is used to cut off the high-voltage output main circuit in response to the trigger protection failure condition, so as to achieve irreversible hardware fallback protection for the lithium battery module.

[0012] Furthermore, the security collaborative decision-making unit is also equipped with attitude interlocking protection logic that characterizes the pre-protection mechanism under the first priority of the system. The attitude interlocking protection logic includes: When the fuselage three-axis tilt angle data is greater than or equal to the fuselage tilt angle warning threshold, the safety collaborative decision unit reduces the instantaneous peak overcurrent threshold, continuous overcurrent threshold, cell overtemperature threshold, and bus overtemperature threshold, and instructs the motion control unit to only allow the triggering of low-speed attitude return operation; When the three-axis tilt angle data of the fuselage is greater than or equal to the fuselage tilt angle fault threshold, the safety collaborative decision unit forcibly cuts off the high power output of the lithium battery module and instructs the motion control unit to control the target robot to perform autonomous posture recovery; if the target robot cannot recover its posture within the preset recovery time, the motion function of the target robot is locked.

[0013] Furthermore, the security collaborative decision-making unit is also equipped with a cross-protection type linkage verification mechanism, which includes: When the low battery protection is triggered, the instantaneous peak overcurrent threshold and the continuous overcurrent threshold are reduced respectively; when the graded overcurrent protection is triggered, the target discharge rate value of the lithium battery module is reduced; when the graded tilt protection and the graded overcurrent protection are triggered simultaneously, the servo power output of the target robot is cut off; wherein, when any two types of first-level early warning strategies are triggered in combination, the strategy is upgraded to the second-level severe fault strategy.

[0014] This application embodiment also provides a robot battery safety collaborative protection method, which is applied to the robot battery safety collaborative protection system as described above, and the method includes: The data acquisition unit responds to the robot battery safety collaborative protection system by completing power-on synchronization initialization and full-link self-test, and collects the battery operation data corresponding to the lithium battery module set in the target robot, and collects the body three-axis tilt angle data corresponding to the target robot. The safety collaborative decision-making unit, based on preset trigger thresholds, hierarchical protection logic, and motion constraint strategies, cross-validates the battery operation data and the three-axis tilt angle data of the fuselage, uses a preset multi-fault priority arbitration mechanism to determine the fault level judgment result corresponding to the lithium battery module, and outputs the protection control command corresponding to the fault level judgment result. In response to the detection that the battery operation data and the body three-axis tilt angle data rise to a level greater than or equal to a preset exit hysteresis threshold and the rise duration is greater than or equal to a preset stabilization duration, a protection level rollback command is generated and output. In response to receiving the protection control command, the motion control unit performs constraint control corresponding to the protection control command on the integrated joint unit of the target robot, or in response to receiving the protection level reversal command, performs release control corresponding to the protection level reversal command on the integrated joint unit. The hardwired security channel monitors the master control heartbeat signal of the industrial bus channel in real time. In response to the interruption time of the master control heartbeat exceeding the preset interruption duration and determining that the industrial bus channel has failed, it independently takes over the hierarchical protection logic and replicates the hierarchical protection strategy.

[0015] This application also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the robot battery safety collaborative protection method described above are performed.

[0016] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the robot battery safety collaborative protection method described above.

[0017] The robot battery safety collaborative protection system and electronic device provided in this application embodiment include a data acquisition unit, a safety collaborative decision-making unit, a motion control unit, and a dual-redundant communication unit. The safety collaborative decision-making unit is signal-connected to the data acquisition unit, and establishes a bidirectional communication connection with the motion control unit through the dual-redundant communication unit. The data acquisition unit is used to collect battery operation data corresponding to the lithium battery module set in the target robot and to collect the three-axis tilt angle data of the target robot's body, in response to the robot battery safety collaborative protection system completing power-on synchronization initialization and full-link self-test. The safety collaborative decision-making unit is used to cross-validate the battery operation data and the three-axis tilt angle data based on preset trigger thresholds, hierarchical protection logic, and motion constraint strategies, and to determine the fault level judgment result corresponding to the lithium battery module using a preset multi-fault priority arbitration mechanism. The system outputs the protection control command corresponding to the fault level determination result; in response to the monitoring that the battery operation data and the body three-axis tilt angle data rise to a level greater than or equal to a preset exit hysteresis threshold and the rise duration is greater than or equal to a preset stabilization duration, it generates and outputs a protection level rollback command; the motion control unit is used to execute the constraint control corresponding to the protection control command on the integrated joint unit set on the target robot in response to receiving the protection control command, or to execute the release control corresponding to the protection level rollback command on the integrated joint unit in response to receiving the protection level rollback command; the dual-path redundant communication unit includes an industrial bus channel and a hard-wired safety channel; the hard-wired safety channel is used to monitor the master control heartbeat signal of the industrial bus channel in real time, and in response to the interruption time of the master control heartbeat exceeding a preset interruption duration and determining that the industrial bus channel has failed, it independently takes over the graded protection logic and replicates the graded protection strategy.

[0018] Compared with existing robot battery protection technologies and overall safety protection systems, this robot battery safety collaborative protection system, which constructs an integrated battery and motion collaborative protection architecture consisting of a data acquisition unit, a safety collaborative decision-making unit, a dual-redundant communication unit, and a motion control unit, solves technical problems such as the coexistence of false and false protection caused by the fixed battery protection threshold, the easy occurrence of robot instability and overturning due to a single hard power failure, the mutual separation between battery monitoring and motion control exacerbating fault deterioration, the lack of attitude interlock protection mechanism, and protection interruption due to the failure of a single communication link. It achieves full-process safety collaborative protection by cross-linking and hierarchical judgment of robot battery electrical parameters and body attitude data, fault gradient constraint of robot motion, continuous protection function without interruption when communication is abnormal, and automatic release of protection after the fault parameters are restored.

[0019] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is one of the structural schematic diagrams of a robot battery safety collaborative protection system provided in the embodiments of this application; Figure 2 This is a second schematic diagram of a robot battery safety collaborative protection system provided in an embodiment of this application; Figure 3 A flowchart illustrating a collaborative protection method for robot battery safety provided in this application embodiment; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0023] Research has revealed that quadruped robots and humanoid bipedal robots are highly dynamic and unstable mobile platforms. Their motion mechanisms, load characteristics, and posture change patterns are completely different from AGVs, tracked vehicles, and stationary equipment. Furthermore, their battery operating conditions exhibit several unique and extreme characteristics, which is the core reason why traditional battery protection systems are incompatible. The instantaneous inrush current of multi-joint synchronous devices is extremely large, and the dynamic ratio far exceeds that of conventional equipment. When quadruped robots run, jump, overcome obstacles, land and buffer, and adjust their posture rapidly, as well as when humanoid robots stand up, squat, climb ladders, carry loads, and maintain balance, multiple joint servo devices will simultaneously and explosively pull current. The instantaneous discharge current can reach 3 to 8 times the rated current. This type of inrush current has a short duration, extremely high amplitude, and strong randomness. The smooth and steady-state discharge characteristics of traditional AGVs are completely unsuitable, which makes it very easy for conventional fixed overcurrent thresholds to cause problems such as "false protection shutdown" or "leakage protection burning out battery cells and busbars".

[0024] The robot's posture changes drastically at high frequency, and the battery is subjected to vibration, tilting, and abnormal stress conditions for a long time: Quadruped robots and humanoid bipedal robots may experience extreme posture changes during operation, such as significant tilting, single-leg support, instantaneous shift of the center of gravity, falling, lying down, and getting up to reset. The battery pack is continuously shaken, twisted, and impacted by the robot, which can easily cause loosening of high-voltage terminals, increased bus contact resistance, cell compression deformation, and micro-damage to internal electrode plates. If high-current discharge continues in a tilted, tipped, or loose state, it will quickly cause local overheating, sparking, gas generation, and thermal runaway. This is a high-risk working condition that does not exist for wheeled robots.

[0025] The power consumption dynamics vary greatly, and the power consumption is completely irregular, making a single threshold unsuitable: The instantaneous power consumption of quadruped robots and humanoid bipedal robots during standby, slow walking, uniform speed inspection, heavy-duty operation, jumping and obstacle crossing, and ladder climbing can vary by more than 10 times, resulting in extremely unstable power consumption. Traditional fixed SOC low power protection thresholds cannot cover multiple working conditions: if the threshold is set too high, it will cause frequent power limiting and task interruption during normal high-dynamic operations; if the threshold is set too low, it will cause power overdraft, low voltage drop, and instantaneous power loss of the entire machine, directly causing humanoid robots to collapse and quadruped robots to become unstable and overturn, resulting in secondary damage to the body structure, joints, and precision components, and even personnel safety risks.

[0026] The enclosed body and dynamic high current lead to abnormal battery temperature rise and higher thermal risks: The quadrupedal, humanoid robot has a highly integrated body and an enclosed internal space, resulting in poor heat dissipation conditions in the battery compartment; at the same time, the transient high current brought about by high-frequency dynamic movements, the vibration and contact heating of the bus terminals, and the inward conduction of heat from the joints combine to make the temperature rise rate of the battery cells, copper busbars, and connectors much higher than that of ordinary mobile devices, which can easily lead to the accumulation of local hot spots and induce the risk of uncontrolled thermal runaway.

[0027] The significant differences in operating conditions among various robot models necessitate a differentiated and configurable safety threshold system. Heavy-duty industrial quadruped robots, lightweight humanoid service robots, and outdoor exploration legged robots have vastly different load capacities, movement intensity, operating environments, and safety margins. A uniform, fixed battery protection parameter cannot adapt to the diverse operational needs of different models and scenarios. To address the unique safety protection requirements of legged robots, the battery system needs to be equipped with a configurable, tiered protection mechanism covering five core protection types: low battery protection, severe low battery protection, low voltage protection, tiered overcurrent protection, and tiered overtemperature protection. Furthermore, all protection thresholds and corresponding robot constraint actions can be customized. The system can automatically trigger differentiated safety actions based on different operating conditions, such as restricting running, limiting dynamic movement, prohibiting obstacle crossing and load-bearing, forcing the robot to lie down or squat for reset, and locking movement, thoroughly adapting to the highly dynamic and easily unstable operating characteristics of legged robots.

[0028] Furthermore, existing robot battery protection technologies and overall safety systems are based on traditional equipment designs that are stable, low-dynamic, and posture-stable. They are not adapted to the high-dynamic, unstable, and impact-prone operating characteristics of quadrupedal or humanoid robots, resulting in the following technical deficiencies: The protection thresholds are fixed throughout the entire process, making them unsuitable for the transient impact conditions of legged robots. This results in both false and missed protection: Existing battery management systems use factory-fixed overcurrent, low voltage, low charge, and overtemperature protection thresholds with no customizable configuration capabilities. They cannot adaptively adjust protection strategies based on the dynamic movement patterns of quadrupedal or humanoid robots, such as jumping, running, carrying loads, climbing ladders, and impacts. On one hand, the instantaneous, large inrush current generated by the robot running and jumping is easily misjudged as a fault by the fixed overcurrent threshold, triggering shutdown protection and affecting operational continuity. On the other hand, continuous minor overloads, dynamic low voltage drops, and localized battery temperature rises cannot be accurately identified, preventing early intervention and ultimately extending the battery cell lifespan. Furthermore, the fixed thresholds cannot match the protection requirements of different robot models and different operational intensities, lacking a tiered control logic adapted to legged robots, resulting in poor protection accuracy.

[0029] Lack of a configurable multi-level power or voltage protection system, no dedicated buffer braking and posture protection for legged robots, resulting in an extremely high risk of overturning upon power failure: The existing technology only provides a single undervoltage power-off protection, and does not establish a three-level protection mechanism of configurable low power, severe low power and low voltage adapted for quadruped or humanoid robots, with no gradient motion restriction and posture fallback logic. In the conventional protection mode, power is cut off directly when the power or voltage approaches the threshold, causing the robot to instantly lose balance control ability, which leads to collapsing of humanoid robots and rolling-over overturning of quadruped robots. Meanwhile, existing solutions cannot customize and configure protection thresholds and linked actions: there is no pre-protection for restricting high-dynamic motions such as running and jumping in the low power stage; no fallback protection for locking all movement actions and forcing the robot to lie down or squat for reset in the severe low power stage; no emergency power limiting protection for single cell or total voltage undervoltage, so that it is impossible to avoid instability, equipment damage and safety risks through hierarchical and configurable management and control, which cannot meet the safety protection requirements of unstable legged carriers.

[0030] The battery protection and motion control system are completely separated, with no dynamic linked protection: The battery management system in traditional solutions only independently monitors battery parameters, and does not link with the robot motion controller, posture system and servo load, so that battery electrical faults are completely disconnected from the robot motion state, with no collaborative protection logic; when the battery triggers configurable warning faults such as low power warning, slight overcurrent, low temperature temperature rise, and undervoltage abnormality, the motion system can still freely perform high-power-consumption motions such as running, jumping, fast ladder climbing, and heavy-load operation, continuously drawing instantaneous large current, which further aggravates battery voltage drop, temperature rise and overload faults, accelerates the thermal runaway process, forms a vicious cycle of "battery fault deterioration and high dynamic load aggravating faults", and cannot realize pre-fault intervention and dynamic load constraint.

[0031] No dedicated safety interlock logic is set for falls, tilts, impact and vibration of legged robots: The existing battery protection system does not introduce judgment mechanisms for body posture inclination angle, vibration impact and tilt state, and cannot identify dedicated dangerous working conditions such as toppling, imbalance and severe jitter of quadruped or humanoid robots. High-power discharge is still allowed when the robot is in an unbalanced state, which is very likely to cause fire and short-circuit accidents in high-risk states such as battery loosening, deformation and heating.

[0032] The parameter modification threshold is extremely high, making it impossible to adapt to multiple models and operating conditions on-site: all protection parameters of the existing battery management system are fixed, and there is no online visual threshold configuration function. It is impossible to customize threshold parameters and linkage motion strategies for the five core protection scenarios (low battery, severe low battery, low voltage, overcurrent, and overtemperature) of quadruped or humanoid robots. If it is necessary to adapt to the protection requirements of different scenarios such as heavy-duty quadrupeds, lightweight humanoids, outdoor high temperature, and high-speed running operations, the firmware must be re-burned and the whole machine calibrated, which has a long debugging cycle and poor versatility. At the same time, it is impossible to flexibly configure fault linkage actions and cannot set gradient protection logic such as "prohibit running and jumping, restrict some movements, lock all movements, and force lying down and resetting" as needed, resulting in poor on-site operation and maintenance flexibility and scenario adaptability.

[0033] Based on this, this application provides a robot battery safety collaborative protection system. By constructing a robot battery safety collaborative protection system with an integrated battery and motion collaborative protection architecture consisting of a data acquisition unit, a safety collaborative decision-making unit, a dual-redundant communication unit, and a motion control unit, the system solves the technical problems of existing robot battery protection thresholds, such as the coexistence of false protection and leakage protection, the ease with which a single hard power failure can cause robot instability and overturning, the separation between battery monitoring and motion control which exacerbates fault deterioration, the lack of attitude interlock protection mechanism, and protection interruption due to single communication link failure. The system achieves full-process safety collaborative protection by cross-linking and hierarchical judgment of robot battery electrical parameters and body attitude data, fault gradient constraint of robot motion, continuous protection function during communication abnormalities, and automatic release of protection after fault parameters are restored.

[0034] Here, the robot battery safety collaborative protection system provided in this application specifically solves the following technical problems: It addresses the issue that traditional battery protection systems have factory-fixed thresholds, making them unsuitable for legged robots experiencing instantaneous high current surges, dynamic power consumption fluctuations, and various operating conditions, leading to false or missed triggering of overcurrent, overtemperature, and low-voltage protection; it addresses the problem that existing battery protection systems lack tiered control logic, relying solely on single power-off protection, directly cutting off power under low charge and low voltage conditions, causing robot instability and tipping, secondary equipment damage, and safety hazards; it addresses the problem that existing battery protection and robot motion systems are independent and lack collaborative linkage, allowing the robot to still perform high-power actions under abnormal battery conditions, continuously exacerbating battery failure and inducing thermal runaway; it addresses the problem that existing technologies are not adapted to the specific operating conditions of legged robots such as tilting, falling, and severe vibration, lacking a posture interlock protection mechanism, resulting in significant safety hazards due to high-power battery discharge under unbalanced conditions; and it addresses the problem that traditional battery management systems require firmware burning for parameter modification, cannot be configured online, cannot adapt to the differentiated protection needs of multiple models, and have poor on-site maintenance adaptability.

[0035] Please see Figure 1 , Figure 1This is one of the structural schematic diagrams of a robot battery safety collaborative protection system provided in this application embodiment. The robot battery safety collaborative protection system provided in this application embodiment is adapted to legged robots such as quadrupeds and humanoid robots, and can be widely used in the safety management of power batteries of legged robots in scenarios such as industrial inspection, outdoor exploration, and heavy-duty operations.

[0036] like Figure 1 As shown, the robot battery safety collaborative protection system 10 includes a data acquisition unit 110, a safety collaborative decision-making unit 120, a motion control unit 130, and a dual-redundant communication unit 140.

[0037] Among them, such as Figure 1 As shown, the safety collaborative decision-making unit 120 is connected to the data acquisition unit 110 via a signal connection, and the safety collaborative decision-making unit 120 establishes a bidirectional communication connection with the motion control unit 130 through the dual-redundant communication unit 140.

[0038] The data acquisition unit 110 is used to collect battery operation data corresponding to the lithium battery module 210 set in the target robot in response to the robot battery safety collaborative protection system completing power-on synchronization initialization and full-link self-test, and to collect the three-axis tilt angle data of the target robot body.

[0039] In this embodiment of the application, the data acquisition unit 110 includes a battery status acquisition module and a robot posture acquisition module. Figure 1 (Not shown in the image), the battery status acquisition module is used to acquire battery operation data corresponding to the lithium battery module 210 set in the target robot, and the robot posture acquisition module is used to acquire the body three-axis tilt angle data corresponding to the target robot.

[0040] Here, after the robot battery safety collaborative protection system 10 is powered on, the safety collaborative decision unit 120 retrieves the preset working condition template and synchronously sends all trigger thresholds and exit hysteresis thresholds to all protection nodes such as the data acquisition unit 110, the safety collaborative decision unit 120, the motion control unit 130, and the dual-redundant communication unit 140, ensuring a startup process with completely consistent judgment parameters across the entire link; it automatically verifies the hardware connectivity and functional integrity of the industrial bus channel, hard-wired safety channel, three-level hardware circuit breaker unit, battery acquisition circuit, and attitude sensor. If the self-test is abnormal, it directly locks all robot motion functions and prohibits operation.

[0041] In this embodiment, the data acquisition unit 110 is the front-end data sensing module of the system 10. After the entire protection system 10 completes power-on synchronous initialization and full-link self-test, it synchronously acquires all the battery operation data of the lithium battery module 210 built into the target robot, as well as the robot's three-axis tilt angle data. After performing filtering, anti-shake and timestamp alignment preprocessing on the raw sampled data, it outputs the standardized monitoring dataset (battery operation data and three-axis tilt angle data) to the safety collaborative decision-making unit 120.

[0042] Among them, the lithium battery module 210 is the core power supply component for the target robot. It is composed of multiple lithium battery cells connected in series and parallel, and is equipped with a basic sampling circuit to provide high-voltage power to the robot's joint servo, controller, and sensors.

[0043] Here, battery operating data includes, but is not limited to, individual cell voltage, total voltage, instantaneous charging and discharging current, continuous bus current, multi-point cell temperature, bus copper bus temperature, battery state of charge (SOC, percentage of remaining capacity), and battery compartment ambient temperature; the three-axis tilt angle data of the robot body is obtained by detecting the tilt angle values ​​of the target robot along the pitch, roll, and yaw dimensions through the body attitude sensors, which are used to quantify the stability of the robot body attitude and the risk of imbalance.

[0044] In this embodiment, filtering is a process of filtering instantaneous data spikes and glitches caused by high dynamic vibration using a moving average filtering algorithm; anti-shake is a process of setting a short-term data buffer to retain only continuously stable and effective parameters and eliminate instantaneous disturbances; timestamp alignment is a calibration process of marking all data within the same sampling period with a unified time identifier to eliminate timing differences between different acquisition loops.

[0045] Here, the standardized monitoring dataset includes battery operation data and fuselage three-axis tilt angle data. It is a structured data packet that has been preprocessed, has a unified format, is time-synchronized, and is free from instantaneous interference. It contains all battery electrical parameters and fuselage attitude parameters and is the sole input basis for backend fault determination.

[0046] In this way, the data acquisition unit 110 solves the problems of traditional battery acquisition systems that only independently monitor electrical parameters, have asynchronous data from different sources, and suffer from data distortion under high vibration conditions. It provides a reliable, accurate, and time-matched input data source for subsequent fault determination based on the cross-linking of electrical and attitude parameters. It effectively eliminates data jumps caused by running, jumping, and body shaking of the legged robot, reducing the probability of false fault triggering from the data source; it achieves synchronous acquisition and time-alignment of battery electrical parameters and body attitude parameters, providing a data foundation for coupling risk identification; and the pre-power-on self-test mechanism prevents equipment from starting with faults, improving system reliability.

[0047] The safety collaborative decision-making unit 120 is used to cross-verify the battery operation data and the three-axis tilt angle data of the fuselage based on the preset trigger threshold, hierarchical protection logic and motion constraint strategy, determine the fault level judgment result corresponding to the lithium battery module using the preset multi-fault priority arbitration mechanism, and output the protection control command corresponding to the fault level judgment result.

[0048] The safety collaborative decision-making unit 120 is also used to generate and output a protection level rollback command in response to the monitoring that the battery operation data and the body three-axis tilt angle data rise to a level greater than or equal to a preset exit hysteresis threshold and the rise duration is greater than or equal to a preset stabilization duration.

[0049] In this embodiment, the safety collaborative decision-making unit 120 is the core decision-making center of the system 10. It consists of an independent safety microcontroller, which is physically isolated from the robot motion main controller. Its core execution logic is divided into two parts: Fault classification judgment: Based on the preset trigger threshold, graded protection logic, and motion constraint strategy, it performs cross-linking verification on the input battery operation data and the body three-axis tilt angle data, and completes the fault validity judgment in combination with the preset anti-shake duration; it handles the concurrent scenario of multiple faults through the preset multi-fault priority arbitration mechanism, determines the final fault level judgment result, and outputs the corresponding level of protection control command. Fault recovery judgment: It continuously monitors the recovery status of battery operation data and attitude data. When the parameters rise above the preset exit hysteresis threshold and the continuous stable duration reaches the preset stable duration, and there are no other concurrent faults, it generates and outputs the protection level rollback command, and the control system releases the protection constraints level by level.

[0050] Among them, the trigger threshold is used to determine the critical value of the parameter that triggers the fault. When the monitored parameter reaches the value, the corresponding level of protection is activated. The exit hysteresis threshold is a fault recovery critical value set in pairs with the trigger threshold. It forms a buffer with the trigger threshold to avoid frequent start and stop of protection due to critical fluctuations of parameters. Specifically, the exit hysteresis threshold for power and voltage faults is higher than the trigger threshold, while the exit hysteresis threshold for current, temperature, and attitude faults is lower than the trigger threshold.

[0051] In this embodiment, the graded protection logic is a multi-gradient fault judgment rule divided according to the severity of the fault, covering all dimensions of fault types such as power, voltage, current, temperature, and attitude; the motion constraint strategy is the robot motion and power control rule corresponding to different fault levels, used to realize graded fault control.

[0052] Here, cross-validation breaks the single-parameter independent judgment mode, couples the analysis of battery electrical parameters and fuselage attitude parameters, and identifies the judgment method of high-risk coupled working conditions that cannot be detected by single parameters; the multi-fault priority arbitration mechanism is an arbitration rule that, when multiple types of faults are triggered at the same time, sorts them according to preset priorities and executes only the highest priority protection command to avoid control logic conflicts.

[0053] In this way, the safety collaborative decision-making unit 120 solves the problems of traditional battery management systems, such as independent judgment of single parameters, single fault level, lack of multi-fault conflict handling, and the need for manual code clearing and reset for fault recovery. It constructs a precise, hierarchical, and automatically recoverable core decision-making system to achieve collaborative judgment of battery faults and attitude risks. It can accurately distinguish between normal motion impacts and real faults, significantly reducing the probability of false protection; it can identify coupled high-risk operating conditions such as "tilt and high current" and "low charge and over-temperature", enabling pre-fault intervention; when multiple faults occur concurrently, the instructions are unique and conflict-free, avoiding instability caused by the robot receiving contradictory instructions; and it automatically recovers after the fault meets the conditions, without manual intervention, making it suitable for unattended operation scenarios.

[0054] In this embodiment, the multi-parameter cross-linking verification breaks the traditional battery management system's single-parameter independent judgment logic of "voltage only judges voltage, current only judges current". It cross-couples and verifies battery electrical parameters and body attitude parameters to accurately distinguish between "normal operating condition fluctuations" and "real faults", and at the same time identifies high-risk coupling that cannot be detected by single parameters. Specifically, it includes the following verification mechanisms: Intelligent Current Condition Differentiation and Verification (Solving False Protection Due to Instantaneous Impact): For the instantaneous large currents generated by the jumping, standing up, and landing buffering of legged robots, differentiated judgment is made based on "duration duration" to fundamentally prevent normal movement from being mistaken for overcurrent faults. For example, peak discharge currents with a duration of less than or equal to 100ms are judged as normal impact currents of the robot's dynamic movement, and even if the amplitude exceeds the continuous overcurrent threshold, no overcurrent protection is triggered; discharge currents with a duration of greater than or equal to 300ms and a value greater than the preset continuous overcurrent threshold are judged as continuous fault currents (such as servo stall, hidden short circuit in the bus), and formally enter the overcurrent fault judgment process.

[0055] Electrical and attitude cross-coupling verification (solving protection leakage under tilt conditions): The body tilt angle is used as a "dynamic correction coefficient" for all electrical protections. When the attitude is abnormal, the electrical protection standards are automatically tightened to identify high-risk coupling conditions that cannot be detected by single parameters, such as "tilt and high current" and "tipping and overheating". When the body attitude is stable, the short-term fault tolerance range of current and temperature is appropriately relaxed to ensure the robot's motion performance. When the body tilt angle reaches the warning threshold, the trigger threshold of overcurrent and overtemperature protection is automatically tightened (for example, the overcurrent threshold is reduced by 20%), and the monitoring sensitivity is improved simultaneously. When the body tilt angle reaches the fault threshold, regardless of whether the battery voltage, current and temperature are normal, it is directly judged as a high-risk state and the high-power cut-off logic is forcibly triggered.

[0056] Multi-electrical parameter cross-protection linkage verification (solving the problem of continuous fault deterioration): Different types of electrical faults are no longer judged in isolation. When one type of fault is triggered, the judgment criteria of other protections are automatically adjusted to achieve early intervention: When the low-charge condition is triggered, the trigger threshold of overcurrent protection is automatically tightened and the maximum allowable discharge current is reduced to avoid damage to the battery cell and aggravation of voltage drop caused by the superposition of low charge and high current; When the overcurrent condition is triggered, the temperature rise trend is predicted in conjunction with the system, and the discharge rate is reduced in advance to suppress the heat accumulation caused by continuous overcurrent; When any two types of first-level warnings (such as low charge and over-temperature, overcurrent and tilt angle warnings) are triggered at the same time: it is directly judged as risk superposition and automatically upgraded to the second-level severe fault protection level.

[0057] Fault Anti-shake Verification (Solving False Triggers Due to Fluctuations): For the instantaneous parameter jumps caused by the high-dynamic motion of legged robots, a dedicated anti-shake judgment duration is configured for each type of fault. The parameter must continuously exceed the trigger threshold for the corresponding duration to be considered a valid fault, avoiding false triggers caused by instantaneous data spikes. For example, low battery warning: a continuous SOC below the threshold for 5 seconds is considered a valid warning; severe low battery or low voltage fault: a continuous SOC or voltage below the threshold for 3 seconds or 2 seconds is considered a valid fault; over-temperature and tilt angle faults: execute according to the corresponding preset anti-shake duration, with a default uniform configuration for stable duration verification.

[0058] Please see Figure 2 , Figure 2 This is a second schematic diagram of a robot battery safety collaborative protection system provided in an embodiment of this application.

[0059] like Figure 2 As shown, the system 10 further includes a threshold storage management unit 121; the threshold storage management unit 121 has a built-in non-volatile storage component for storing the trigger threshold and the exit hysteresis threshold corresponding to the trigger threshold; wherein, both the trigger threshold and the exit hysteresis threshold support online custom configuration and multi-condition parameter template configuration switching.

[0060] Among them, non-volatile storage components are storage media that will not lose data after power failure, such as industrial-grade flash memory chips, which can store configuration parameters and operation logs for a long time to avoid parameter loss after equipment restart; multi-condition parameter templates are a set of threshold parameters pre-configured for different models and different operating scenarios. A template contains all trigger thresholds and corresponding exit hysteresis thresholds, and switching templates can complete batch adjustment of all parameters.

[0061] In this embodiment, the triggering thresholds include low battery warning threshold, severe low battery protection threshold, single-cell low voltage protection threshold, total low voltage protection threshold, instantaneous peak overcurrent threshold, continuous overcurrent threshold, cell overtemperature threshold, bus overtemperature threshold, fuselage tilt warning threshold, and fuselage tilt fault threshold; the exit hysteresis thresholds include low battery warning exit threshold, severe low battery protection exit threshold, single-cell low voltage protection exit threshold, total low voltage protection exit threshold, instantaneous peak overcurrent exit threshold, continuous overcurrent exit threshold, cell overtemperature exit threshold, bus overtemperature exit threshold, fuselage tilt warning exit threshold, and fuselage tilt fault exit threshold.

[0062] For example, suppose a park simultaneously deploys heavy-duty industrial quadruped inspection robots and lightweight humanoid service robots. The two types of devices have significantly different load strengths and motion characteristics. Technicians pre-store two sets of operating condition templates in the non-volatile flash memory of the threshold storage management unit: Heavy-duty quadruped template: The instantaneous peak overcurrent threshold is set to 8 times the rated current, adapting to the high-impact requirements of jumping and obstacle crossing; the low battery warning threshold is set to 25% SOC, ensuring sufficient battery life for heavy-duty operations. Lightweight humanoid template: The instantaneous peak overcurrent threshold is set to 4 times the rated current, adapting to smooth service scenarios; the low battery warning threshold is set to 20% SOC, taking into account the operating time. During on-site maintenance, operators can switch between the corresponding templates via a visual interface on a host computer. All threshold parameters are synchronized to all protection nodes across the entire chain within one second, without needing to re-flash firmware or restart the device, significantly improving the efficiency of multi-model adaptation.

[0063] In this embodiment of the application, the fault level determination result includes one of the following: normal operation, first-level warning, second-level severe fault, and ultimate fallback fault.

[0064] like Figure 2 As shown, the system 10 also includes a multi-level battery safety protection unit 122; the multi-level battery safety protection unit 122 integrates the hierarchical protection logic and the motion constraint strategy corresponding to the hierarchical protection logic.

[0065] The multi-level battery safety protection unit 122 is a functional module that specifically carries all the graded protection judgment rules, which can realize the accurate mapping between fault type and protection level.

[0066] Here, the graded protection logic includes low power protection, severe low power protection, low voltage protection, graded overcurrent protection, graded overtemperature protection, graded tilt protection, and ultimate protection.

[0067] The graded overcurrent protection includes overcurrent early warning protection and continuous overcurrent fault protection; the graded overtemperature protection includes overtemperature early warning protection and severe overtemperature fault protection; and the graded tilt protection includes tilt early warning protection and tilt fault protection.

[0068] Here, the motion constraint strategy includes a first-level early warning strategy, a second-level severe fault strategy, and a final fallback strategy.

[0069] Among them, the low battery protection, the tilt angle warning protection, the overcurrent warning protection, and the overtemperature warning protection correspond to the first-level warning strategy; the severe low battery protection, the low voltage protection, the continuous overcurrent fault protection, the severe overtemperature fault protection, and the tilt angle fault protection correspond to the second-level severe fault strategy; and the ultimate protection corresponds to the ultimate fallback strategy.

[0070] For example, suppose a quadruped robot is performing an outdoor inspection task and its remaining battery power is slowly decreasing: When the State of Charge (SOC) drops to 20%, low battery protection is triggered, corresponding to a Level 1 warning strategy: restricting running and jumping movements while retaining low-speed walking inspection capabilities; if it does not return to base in time, the SOC drops to 5%, triggering a severe low battery protection strategy, corresponding to a Level 2 severe fault strategy: locking all movement, controlling the robot to lie prone and reset, and cutting off high-power output; if an extreme condition of a bus short circuit occurs, ultimate protection is triggered, corresponding to an ultimate fallback strategy: physically cutting off the high-voltage circuit. Through a tiered protection hierarchy, faults are managed step-by-step from minor to severe, balancing operational efficiency and safety bottom lines.

[0071] In this embodiment, the first-level early warning strategy includes at least one of power limiting and height limiting dynamic actions, while preserving the basic operational capabilities of the target robot; the second-level severe fault strategy includes at least one of locking movement, forced posture reset, and cutting off high-power output; the ultimate fallback strategy includes at least a physical hardware circuit breaker and irreversible high-voltage disconnection.

[0072] The secondary severe fault strategy includes an attitude secondary fault strategy and an electrical secondary severe fault strategy; the multi-fault priority arbitration mechanism includes: the ultimate fallback strategy is superior to the attitude secondary fault strategy, the attitude secondary fault strategy is superior to the electrical secondary severe fault strategy, and the electrical secondary severe fault strategy is superior to the primary early warning strategy.

[0073] When multiple motion constraint strategies are triggered simultaneously, the protection control instruction corresponding to the motion constraint strategy with the first priority masks the protection control instruction corresponding to the motion constraint strategy with the second priority, so as to avoid control logic conflicts.

[0074] For example, suppose a quadruped robot is climbing a slope when both a low battery level 1 warning (electrical level 1 warning) and a tilt level 2 fault (attitude level 2 fault) are triggered simultaneously. According to the priority arbitration rule, the attitude level 2 fault strategy has higher priority than the level 1 warning strategy. The system directly executes the tilt level 2 fault protection command: forcibly cutting off high-power output, controlling the robot to perform attitude correction, and disabling the mild constraint command of the low battery warning. After the attitude fault is resolved and the tilt angle returns to normal, the system automatically downgrades to execute the low battery warning protection strategy. There are no command conflicts throughout the process, and the protection logic is clear and stable.

[0075] In this embodiment, the graded overcurrent protection includes a logic for distinguishing between instantaneous impacts and continuous faults. The logic includes: when the duration of the peak discharge current of the lithium battery module 210 is less than or equal to a first preset overcurrent duration, the movement of the target robot is determined to be a normal impact current, and overcurrent protection is not triggered; when the discharge current of the lithium battery module 210 is greater than a preset continuous overcurrent threshold and the duration is greater than a second preset overcurrent duration, the lithium battery module 210 is determined to be a current fault, and the graded overcurrent protection is triggered.

[0076] The first preset overcurrent duration is a short-term impact judgment threshold, corresponding to the duration of current during robot actions such as jumping, standing up, and landing buffering; the second preset overcurrent duration is a continuous fault judgment threshold, corresponding to the duration of current during faults such as servo stall and hidden short circuit of bus.

[0077] For example, suppose a heavy-duty quadruped robot has a rated discharge current of 50A, the system is set with a first preset overcurrent duration of 100ms, a second preset overcurrent duration of 300ms, and a continuous overcurrent threshold of 150A (3 times the rated current). Scenario 1: The robot performs a jump obstacle crossing action, and a peak current of 320A appears on the bus, lasting for 80ms. System 10 determines this as a normal motion inrush current and does not trigger overcurrent protection. The robot completes the jump normally without any shutdown interference. Scenario 2: A servo motor of a joint of the robot stalls, and the bus current stabilizes at 180A for 350ms. System 10 determines this as a continuous overcurrent fault, immediately triggers the second-level overcurrent protection, cuts off the servo power output, and prevents the device from burning out.

[0078] In this embodiment, the timing execution logic corresponding to the Level 2 severe fault strategy includes: locking the walking movement of the target robot and blocking new operation instructions for the target robot; controlling the target robot to lie down or squat down for reset, and performing a high-power discharge limiting operation after the lie down or squat down reset remains stable; wherein, during the execution of the timing execution logic, the three-axis tilt angle data of the robot body are monitored in a closed loop to avoid instability during the lie down or squat down reset process.

[0079] For example, assuming a humanoid service robot triggers a severe low battery level 2 fault, the system executes protective measures in the following sequence: immediately lock all walking and ladder-climbing actions, block upper-level service task commands, and stop the robot in place; control the knee and hip joints to slowly and coordinately perform a smooth squatting and repositioning motion, monitoring the robot's pitch and roll angles in real time throughout the process and dynamically adjusting the squatting speed to ensure a stable center of gravity; once the robot is fully squatted, with both feet fully supported and the tilt angle stable within a safe range, cut off the high-power battery discharge circuit, retaining power only for the control system and sensors. This timing design completely avoids the risk of the robot collapsing or its joints and body being damaged due to a direct power outage.

[0080] like Figure 2 As shown, the system 10 also includes a three-level hardware circuit breaker unit 150; the three-level hardware circuit breaker unit 150 is connected in series in the high-voltage output main circuit of the lithium battery module 20; the three-level hardware circuit breaker unit 150 includes a MOS pre-disconnection circuit, a high-voltage relay main circuit, and a thermal fuse final circuit arranged sequentially. Figure 2 (Not shown in the image).

[0081] Here, the three-level hardware circuit breaker unit 150 is used to cut off the high-voltage output main circuit in response to the triggering protection failure condition, so as to achieve irreversible hardware fallback protection for the lithium battery module 210.

[0082] Among them, the MOS pre-disconnection circuit is a fast circuit breaking mechanism composed of power MOSFETs, with a response speed of microseconds, which can realize fast current limiting and pre-disconnection, and can be repeatedly triggered; the high-voltage relay main circuit is a main circuit breaking mechanism composed of electromagnetic high-voltage relays, which has a strong capacity to carry large currents and serves as the core on-off execution component of the high-voltage main circuit; the thermal fuse final circuit is a passive protection device that automatically melts when the current or temperature exceeds the limit value, and cannot be restored after melting, serving as the ultimate safety barrier of the system.

[0083] For example, suppose that during robot operation, an unexpected metallic short circuit occurs on the busbar, and simultaneously the main software control system crashes, the communication bus is interrupted, and all software protection and communication redundancy protection fail. At this time, the three-stage hardware circuit breaker unit automatically triggers: the MOS pre-disconnection circuit quickly starts current limiting within 10 microseconds to suppress the short-circuit current peak; the high-voltage relay main circuit engages and disengages within 5 milliseconds, cutting off the high-voltage main circuit; if the first two stages fail due to faults, the large short-circuit current causes the thermal fuse to blow within 10 milliseconds, completely physically cutting off the high-voltage circuit. The three-stage hardware circuit breaker unit 150 provides a safety net, ensuring that the high voltage is inevitably cut off under extreme operating conditions, preventing serious accidents such as thermal runaway and fire.

[0084] In this embodiment, the safety collaborative decision-making unit 120 is further provided with attitude interlocking protection logic representing the first priority of the system's pre-protection mechanism. The attitude interlocking protection logic includes: when the three-axis tilt angle data of the fuselage is greater than or equal to the fuselage tilt angle warning threshold (tilt angle warning stage), the safety collaborative decision-making unit 120 reduces the instantaneous peak overcurrent threshold, continuous overcurrent threshold, cell overtemperature threshold, and bus overtemperature threshold, and instructs the motion control unit 130 to only allow triggering low-speed attitude return operation; when the three-axis tilt angle data of the fuselage is greater than or equal to the fuselage tilt angle fault threshold (tilt angle fault stage), the safety collaborative decision-making unit 120 forcibly cuts off the high-power output of the lithium battery module 210, and instructs the motion control unit 130 to control the target robot to perform autonomous attitude return; if the target robot cannot return to its correct posture within the preset return time, the motion function of the target robot is locked.

[0085] For example, suppose a quadruped robot is performing an outdoor slope climbing operation. The system is set with a tilt warning threshold of 15°, a tilt fault threshold of 30°, and a preset recovery time of 5 seconds. Scenario 1: When the robot climbs the slope, its body tilt angle reaches 18°, triggering a tilt warning. System 10 automatically lowers the overcurrent threshold by 20% and the overtemperature threshold by 5°, while prohibiting the robot from running or jumping, allowing only low-speed climbing and minor posture adjustments to avoid high-current discharge causing terminal arcing and localized overheating in a tilted state. Scenario 2: The robot accidentally steps off the ground and tilts to the side, reaching a body tilt angle of 35°, triggering a tilt fault. System 10 immediately cuts off the high-power output of the battery and simultaneously controls the leg joints to adjust their movements in an attempt to autonomously return to normal. If the robot fails to return to a stable posture after 5 seconds, the system permanently locks all motion functions and pushes an emergency alarm to prevent forced movement in a tilted state from causing the robot to roll over and cause more serious damage.

[0086] In this embodiment, the safety collaborative decision-making unit 120 is further provided with a cross-protection type linkage verification mechanism, which includes: when the low battery protection is triggered, reducing the instantaneous peak overcurrent threshold and the continuous overcurrent threshold respectively; when the graded overcurrent protection is triggered, reducing the target discharge rate value of the lithium battery module 210; and when the graded tilt protection and the graded overcurrent protection are triggered simultaneously, cutting off the servo power output of the target robot.

[0087] When any two Level 1 early warning strategies are triggered simultaneously, the system is upgraded to the Level 2 severe fault strategy.

[0088] For example, suppose a quadruped robot operates in a high-temperature environment, simultaneously triggering a low battery level 1 warning and an overheat level 1 warning. According to the cross-protection linkage rules, the two level 1 warnings automatically escalate to a level 2 severe fault strategy: System 10 no longer executes the mild power limiting warning action, but directly executes the level 2 fault sequence: locking movement, controlling the robot to lie prone and reset to a stable posture, deeply limiting discharge power, and running the cooling system at full load. Through this risk escalation mechanism, the coupled conditions of "low battery and high temperature" prevent thermal runaway, achieving proactive fault intervention.

[0089] Furthermore, for cases where the fault level is determined to be a Level 1 warning (e.g., low battery warning, overcurrent warning, overtemperature warning, tilt warning), the core positioning is "limiting actions, reducing load, not stopping the machine, and early intervention." This differs from the traditional battery management system's "only alarms, no linkage" mode. Through deep collaboration between the battery protection system and the robot motion control system, high-power actions are proactively constrained and the battery discharge load is reduced in the early stages of a fault, thus delaying the deterioration of the fault. At the same time, the robot's basic operational capabilities are preserved, avoiding unnecessary task interruptions.

[0090] Specifically, when a low battery warning is triggered, three linked actions are executed: motion-side constraints, which send a command to the motion control unit 130 to block high-dynamic, high-power-consumption actions such as running, jumping, obstacle crossing, and heavy-duty operations, retaining only low-power operation capabilities such as low-speed walking, in-situ attitude fine-tuning, and routine inspections; electrical-side constraints, which dynamically lower the peak discharge current limit of the servo system, reduce the upper limit of instantaneous current pulling of a single joint, and avoid large current discharge in the low battery state from aggravating cell voltage drop and damaging cell life; and operation guidance, which simultaneously triggers the body's audible and visual warning device, prompting a low battery status in a pop-up window on the host computer or touch screen human-machine terminal, guiding the equipment to return to charging, without forcibly stopping the machine throughout the process.

[0091] When the current is determined to be a continuous mild overcurrent (not a transient surge), a graded power limiting strategy is implemented: power constraint, which limits the maximum output power of the servo system to 50% of the rated value, prohibits heavy-load operation and sudden burst actions, and reduces the bus discharge current from the source; linkage temperature control, which synchronously lowers the upper limit of the discharge rate, anticipates the temperature rise trend caused by continuous overcurrent, suppresses heat accumulation in advance, and avoids the rapid superposition of overcurrent and overtemperature faults; closed-loop verification, which continuously monitors changes in bus current, and after confirming that the power limiting action has taken effect, maintains the current constraint state and waits for the parameters to fall back.

[0092] When the temperature of the battery cell or bus reaches the warning threshold, a dual action of heat dissipation and load limiting is executed: motion-side constraint, prohibiting all high-dynamic movements, reducing the continuous power consumption of the whole machine, and reducing heat sources; electrical-side constraint, reducing the maximum discharge rate of the battery by 40%, limiting the Joule heat caused by continuous discharge of large current; heat dissipation enhancement, controlling the battery compartment cooling fan to run at full speed, enhancing convection heat dissipation, and slowing down the rate of temperature rise; threshold linkage, simultaneously tightening the overcurrent protection trigger threshold to prevent large current from further aggravating the temperature rise.

[0093] When the robot body tilts to the warning angle but does not trigger the fault threshold, the attitude priority constraints are executed: motion constraints prohibit high-speed walking, heavy loads, jumping and other actions that are likely to aggravate imbalance, and only allow the robot to perform low-speed posture correction operations; electrical linkage automatically tightens the overcurrent and overtemperature protection thresholds, reduces the discharge power in the tilted state, and avoids arcing and local overheating caused by large current discharge when the battery terminals are loose or have poor contact.

[0094] In this embodiment, when multiple Level 1 warnings are triggered simultaneously, the constraint intensity is automatically upgraded to avoid risk accumulation: if both "low battery warning" and "tilt angle warning" are triggered simultaneously, the power limit is further tightened and the range of prohibited actions is expanded on the basis of the original low battery constraint, upgrading from "height limit dynamic" to "limited medium speed walking, only allowing extremely low speed operation"; if both "overcurrent warning" and "overtemperature warning" are triggered simultaneously, the Level 1 mild power limit is skipped directly, and a stricter power constraint is executed, which is equivalent to the pre-current limiting logic of Level 2 faults, thus blocking the vicious cycle of "overcurrent, overheating, and more severe overcurrent".

[0095] Furthermore, for cases where the fault level is determined to be a Level 2 severe fault (e.g., severe low battery, low voltage, continuous overcurrent, severe overtemperature, tilt angle fault), the general execution principle of "attitude priority, sequential progression, and forced linkage" is followed, with priority higher than all Level 1 warnings; after triggering, the attitude interlocking logic is forcibly activated, unaffected by temporary fluctuations in a single electrical parameter, and the overall progressive execution stages include: The first phase involves immediate movement locking and command blocking (executed immediately upon fault triggering). As the first action after a fault is triggered, its core purpose is to immediately terminate high-risk movements and prevent continued operation from exacerbating the fault or causing instability. The safety collaborative decision-making unit 120 immediately issues a full movement function lock command to the motion control unit 130, blocking all displacement-related action commands such as walking, running, jumping, obstacle crossing, and heavy-duty operations, and prohibiting the robot from continuing to move its position; simultaneously blocking all external new operation commands and upper-level task scheduling commands, retaining only the execution permissions of internal commands such as posture adjustment and safety protection, to avoid business layer commands interfering with the execution of protection logic; freezing the current operation task status, and recording the task node and location information when the fault was triggered, so as to facilitate the continuation of operation after the fault is cleared.

[0096] The second phase, active posture reset and closed-loop stabilization (core innovation): This is a dedicated design for the "unstable carrier" characteristics of legged robots, and the most significant difference from traditional battery protection solutions. Automatic model-matched reset strategy: Quadruped robots control their joints to slowly and collaboratively perform a smooth prone reset, ultimately landing in a low-center-of-gravity stable posture with four legs; humanoid robots control their lower limb joints to slowly bend their knees and squat, eventually transitioning to a squatting or fully supported low-center-of-gravity stable posture. Closed-loop tilt monitoring is implemented throughout the reset process: Real-time reading of the robot's three-axis tilt data dynamically adjusts joint movement rates and torque output to ensure a smooth, impact-free, and tipping-free reset, preventing secondary instability caused by the posture adjustment itself. Special handling for extreme postures: If the trigger source is a tilt fault (the robot is already at the critical tilt point), a posture recovery action is prioritized; if the robot cannot autonomously recover within a preset time (default 5 seconds), all movement functions are immediately and permanently locked to prevent forced actions from exacerbating the tipping and causing more severe equipment damage.

[0097] The third stage involves in-depth electrical protection and power constraints (executed after attitude stabilization): After confirming that the robot's attitude has reached a stable threshold, targeted electrical protection is implemented. Different constraint strategies are matched to different fault types, balancing safety and equipment recoverability: Severe low battery or low voltage faults: The high-power discharge circuit of the battery is locked across the entire domain, retaining only the low-voltage power supply to the control system, sensors, and attitude detection modules; any instantaneous peak current output is completely prohibited to prevent cell polarization damage and thermal runaway risks caused by low-voltage high-current discharge. Continuous overcurrent level 2 faults: The servo power output is directly cut off, and the robot maintains a steady-state attitude in place; if the overcurrent fault is triggered three times in a short period of time, it is determined that there is a hardware fault in the servo or bus, and the motion function is permanently locked to prevent the fault from continuing to expand and burn out the components. Severe overtemperature faults: Executed in the sequence of "software deep current limiting, full-load operation of heat dissipation, and hardware pre-circuit standby": The battery discharge rate is reduced to the minimum safe value, and the battery compartment heat dissipation system operates at full power; at the same time, the MOS pre-disconnection circuit of the level 3 hardware circuit breaker unit is triggered to standby, and the hardware circuit breaker is executed immediately once the temperature continues to rise. Tilt-angle level 2 fault: Regardless of whether the battery voltage, current, temperature and other electrical parameters are within the normal range, the high-power output of the battery is forcibly cut off, and only the low-power power supply required for the attitude to return to normal is retained; completely eliminate the high-risk of terminal loosening and arcing, overheating of contact resistance, and short circuit of battery cell deformation caused by high current discharge in the tilt state.

[0098] The fourth stage involves high-frequency alarms and fault data retention: High-frequency audible and visual alarms are activated, and a strong fault notification pop-up appears on the human-machine interface, pushing the fault type, severity level, and emergency handling suggestions to guide maintenance personnel to handle the situation promptly or arrange for the equipment to return to charging. Automatic snapshots of the entire operation before and after the fault are retained: This includes full data such as battery parameters, attitude data, motion commands, and joint states from 10 seconds before the fault trigger to the stable phase after triggering, for subsequent fault tracing and operational condition optimization analysis. This fault is marked as a severe fault and stored in the system's dedicated fault database, distinct from the lightweight logs of the first-level warning, serving as the core basis for equipment maintenance and health assessment.

[0099] Furthermore, after the protection is triggered, the safety collaborative decision-making unit 120 continuously monitors the recovery status of the corresponding parameters. When the data rises above the exit hysteresis threshold, a stabilization timer is started. When the preset stabilization time is met (default 10s, configurable) and there is no parameter drop or other concurrent faults, the protection level is gradually rolled back in the order of "first release power limit, then release motion constraint, and finally restore full power". After the protection is completely released, the system 10 automatically returns to normal operation. The entire process data of this fault is archived: the first-level warning is stored in the lightweight alarm log, and the second-level fault is stored in the fault snapshot library.

[0100] like Figure 1As shown, the motion control unit 130 is configured to, in response to receiving the protection control command, perform constraint control on the integrated joint unit 220 of the target robot corresponding to the protection control command, or in response to receiving the protection level reversal command, perform release control on the integrated joint unit 220 corresponding to the protection level reversal command.

[0101] In this way, the motion control unit 130 solves the problem of traditional battery protection and robot motion control systems being completely disconnected, and the robot still being able to perform high-power actions during battery failure, thus exacerbating the failure. It achieves deep synergy between battery safety protection and overall motion control, suppressing failure deterioration from the load side. During the failure phase, it actively reduces the battery discharge load, breaking the vicious cycle of "failure deterioration and high load exacerbating the failure," effectively delaying the development of the failure. The hierarchical constraint mechanism takes into account both safety protection and operational continuity, preserving basic operational capabilities in minor failures and avoiding unnecessary task interruptions. The attitude reset linkage avoids the risk of robot tipping over caused by direct power failure at the source.

[0102] The dual-redundant communication unit 140 includes an industrial bus channel and a hard-wired security channel. Figure 1 (not shown in the image). The hard-wired security channel is used to monitor the master control heartbeat signal of the industrial bus channel in real time. In response to the interruption time of the master control heartbeat exceeding the preset interruption duration and determining that the industrial bus channel has failed, it independently takes over the hierarchical protection logic and replicates the hierarchical protection strategy.

[0103] Here, the industrial bus channel is a high-speed communication link built on the industrial real-time Ethernet protocol, characterized by high transmission rate, large data volume, and strong real-time performance. It is used for full data interaction and parameter configuration under normal operating conditions. The hard-wired safety channel is an independent communication link that transmits switch quantity safety control signals through physical hard wiring. It operates completely independently of the bus system, has a fast response speed and strong anti-interference capability, and is specifically used for backup protection in emergency fault scenarios.

[0104] Among them, the master control heartbeat signal is a status identification signal sent by the master controller at fixed intervals to characterize the operating status of the communication link and the master controller. Heartbeat interruption indicates that the link or master controller has failed.

[0105] In this way, the dual-redundant communication unit 140 solves the problem of the entire protection system failing when a single communication link fails due to vibration or strong electromagnetic interference. It constructs a redundancy fallback mechanism at the communication level to ensure the continuity of protection functions in complex and harsh environments. The protection function is uninterrupted when the bus communication is abnormal, and the hierarchical linkage protection capability is fully preserved. The dual links operate independently, with strong anti-interference capabilities, and are suitable for the complex operating environment of legged robots in the field with high vibration and strong electromagnetic interference. After the fault is recovered, it automatically switches back to the main link without manual intervention.

[0106] In summary, the robot battery safety collaborative protection system provided in this application has the following significant advantages compared with the prior art: Strong scene adaptability and full threshold configurability: Breaking through the limitations of fixed thresholds in traditional battery management systems, it supports online custom configuration of trigger thresholds and exit hysteresis thresholds. It can store and switch multiple working condition templates with one click, adapting to different models and operating scenarios such as heavy-duty quadruped and lightweight humanoid, avoiding problems such as accidental shutdown and cell overdraft damage caused by fixed thresholds.

[0107] Eliminate the risk of instability and tipping over with graded protection and linked attitude control: Replace the traditional single hard power cut mode with a three-level gradient protection system. Follow the timing logic of "stabilize attitude first, then limit power". When the battery fails seriously, prioritize controlling the robot to return to a low center of gravity and stable attitude before implementing electrical protection. This avoids robot imbalance and tipping over, equipment damage and personnel safety risks from the root.

[0108] Battery and motion work in deep coordination to effectively suppress fault deterioration: Real-time linkage between abnormal battery state and robot motion is achieved. During the fault warning stage, high-power actions are actively prohibited to reduce battery discharge load, break the vicious cycle of "battery fault deterioration and high dynamic load exacerbating the fault", effectively delay fault development and reduce the probability of thermal runaway.

[0109] Dedicated working condition adaptation, covering risks unique to legged robots: The addition of a posture interlock protection mechanism and an instantaneous impact fault tolerance mechanism specifically addresses the unique working condition hazards of legged robots such as tilting and falling, and instantaneous high current impact; through electrical and posture cross-linking verification, it accurately identifies coupled high-risk working conditions, and the protection logic is fully matched to the highly dynamic and unstable operating characteristics of legged robots.

[0110] Multi-layered backup architecture for extremely high protection reliability: It adopts a dual-redundant communication architecture with industrial bus and hard-wired safety channels, coupled with three-level independent hardware circuit breaking mechanisms, to build a three-layer hierarchical protection system of "software linkage protection, communication redundancy backup, and hardware ultimate circuit breaking". It is not affected by software crashes or communication interruptions, and is suitable for complex operating environments with high vibration and strong electromagnetic interference, completely eliminating the risk of protection failure.

[0111] Convenient and efficient operation and maintenance, no firmware flashing required: Supports online visual parameter modification through multiple channels such as host computer, touch screen, and motion controller, and one-click switching of working condition templates without re-flashing firmware; Software faults support automatic recovery of hysteresis without the need for manual clearing of fault codes or manual reset, greatly reducing on-site debugging and operation and maintenance costs, and adapting to unattended operation scenarios.

[0112] The robot battery safety collaborative protection system provided in this application addresses technical issues such as the coexistence of false and false protection caused by the fixed protection threshold of existing robot batteries, the easy occurrence of robot instability and overturning due to a single hard power failure, the exacerbation of faults due to the disconnect between battery monitoring and motion control, the lack of attitude interlock protection mechanism, and the interruption of protection due to the failure of a single communication link. It achieves full-process safety collaborative protection by cross-linking and hierarchical judgment of robot battery electrical parameters and body attitude data, fault gradient constraint of robot motion, continuous protection function during communication abnormalities, and automatic release of protection after fault parameters are restored.

[0113] Please see Figure 3 , Figure 3 This is a flowchart illustrating a collaborative protection method for robot battery safety provided in an embodiment of this application. Figure 3 As shown in the embodiments of this application, the robot battery safety collaborative protection method is applied to the above-described... Figure 1 as well as Figure 2 The method described in the embodiment of the robot battery safety collaborative protection system includes: S101, the data acquisition unit responds to the robot battery safety collaborative protection system completing power-on synchronization initialization and full-link self-test, acquires the battery operation data corresponding to the lithium battery module set in the target robot, and acquires the body three-axis tilt angle data corresponding to the target robot.

[0114] S102. The safety collaborative decision-making unit, based on the preset trigger threshold, hierarchical protection logic and motion constraint strategy, cross-verifies the battery operation data and the three-axis tilt angle data of the fuselage, uses the preset multi-fault priority arbitration mechanism to determine the fault level judgment result corresponding to the lithium battery module, and outputs the protection control command corresponding to the fault level judgment result.

[0115] S103. In response to the detection that the battery operation data and the body three-axis tilt angle data rise to a level greater than or equal to a preset exit hysteresis threshold and the rise duration is greater than or equal to a preset stabilization duration, a protection level rollback command is generated and output.

[0116] S104. In response to receiving the protection control command, the motion control unit performs constraint control corresponding to the protection control command on the integrated joint unit of the target robot, or in response to receiving the protection level reversal command, performs release control corresponding to the protection level reversal command on the integrated joint unit.

[0117] S105. The hard-wired security channel monitors the master control heartbeat signal of the industrial bus channel in real time. In response to the interruption time of the master control heartbeat exceeding the preset interruption duration and determining that the industrial bus channel has failed, it independently takes over the hierarchical protection logic and replicates the hierarchical protection strategy.

[0118] The robot battery safety collaborative protection method provided in this application addresses technical issues such as the coexistence of false and false protection caused by the fixed protection threshold of existing robot batteries, the easy occurrence of robot instability and overturning due to a single hard power failure, the exacerbation of faults due to the disconnect between battery monitoring and motion control, the lack of attitude interlock protection mechanism, and the interruption of protection due to the failure of a single communication link. It achieves full-process safety collaborative protection by cross-linking and hierarchical judgment of robot battery electrical parameters and body attitude data, fault gradient constraint of robot motion, continuous protection function without interruption when communication is abnormal, and automatic release of protection after the fault parameters are restored.

[0119] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 400 includes a processor 410, a memory 420, and a bus 430.

[0120] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 and the memory 420 communicate via the bus 430. When the machine-readable instructions are executed by the processor 410, they can be used as described above. Figure 1 and Figure 2 The robot battery safety collaborative protection system in the system embodiment shown can also perform the above-described actions. Figure 3 The steps of the robot battery safety collaborative protection method in the illustrated method embodiment can be found in the system embodiment for specific implementation methods, which will not be repeated here.

[0121] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can be used as described above. Figure 1 and Figure 2 The robot battery safety collaborative protection system in the system embodiment shown can also perform the above-described actions. Figure 3 The steps of the robot battery safety collaborative protection method in the illustrated method embodiment can be found in the system embodiment for specific implementation methods, which will not be repeated here.

[0122] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0123] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0124] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0125] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0126] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0127] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A collaborative protection system for robot battery safety, characterized in that, The system includes a data acquisition unit, a safety collaborative decision-making unit, a motion control unit, and a dual-redundant communication unit; wherein, the safety collaborative decision-making unit is signal-connected to the data acquisition unit, and the safety collaborative decision-making unit establishes a bidirectional communication connection with the motion control unit through the dual-redundant communication unit; The data acquisition unit is used to collect battery operation data corresponding to the battery module set in the target robot in response to the robot battery safety collaborative protection system completing power-on synchronization initialization and full-link self-test, and to collect the three-axis tilt angle data of the target robot body. The safety collaborative decision-making unit is used to cross-validate the battery operation data and the fuselage three-axis tilt angle data based on preset trigger thresholds, hierarchical protection logic, and motion constraint strategies. It uses a preset multi-fault priority arbitration mechanism to determine the fault level judgment result corresponding to the lithium battery module and outputs the protection control command corresponding to the fault level judgment result. In response to detecting that the battery operation data and the fuselage three-axis tilt angle data rise to a level greater than or equal to a preset exit hysteresis threshold and the rise duration is greater than or equal to a preset stabilization duration, it generates and outputs a protection level rollback command. The motion control unit is configured to, in response to receiving the protection control command, perform constraint control corresponding to the protection control command on the integrated joint unit of the target robot, or in response to receiving the protection level reversal command, perform release control corresponding to the protection level reversal command on the integrated joint unit. The dual-redundant communication unit includes an industrial bus channel and a hard-wired security channel. The hard-wired security channel is used to monitor the master control heartbeat signal of the industrial bus channel in real time. In response to the interruption time of the master control heartbeat exceeding the preset interruption duration and determining that the industrial bus channel has failed, it independently takes over the hierarchical protection logic and replicates the hierarchical protection strategy.

2. The system according to claim 1, characterized in that, The system also includes a threshold storage management unit; The threshold storage management unit has a built-in non-volatile storage component for storing the trigger threshold and the exit hysteresis threshold corresponding to the trigger threshold; wherein, both the trigger threshold and the exit hysteresis threshold support online custom configuration and multi-condition parameter template configuration switching; The trigger thresholds include low battery warning threshold, severe low battery protection threshold, individual cell low voltage protection threshold, total low voltage protection threshold, instantaneous peak overcurrent threshold, continuous overcurrent threshold, cell overtemperature threshold, bus overtemperature threshold, fuselage tilt warning threshold, and fuselage tilt fault threshold; the exit hysteresis thresholds include low battery warning exit threshold, severe low battery protection exit threshold, individual cell low voltage protection exit threshold, total low voltage protection exit threshold, instantaneous peak overcurrent exit threshold, continuous overcurrent exit threshold, cell overtemperature exit threshold, bus overtemperature exit threshold, fuselage tilt warning exit threshold, and fuselage tilt fault exit threshold.

3. The system according to claim 1, characterized in that, The fault level determination result includes one of the following: normal operation, level one warning, level two severe fault, and ultimate fallback fault; The system also includes a multi-level battery safety protection unit; the multi-level battery safety protection unit integrates the hierarchical protection logic and the motion constraint strategy corresponding to the hierarchical protection logic. The graded protection logic includes low power protection, severe low power protection, low voltage protection, graded overcurrent protection, graded overtemperature protection, graded tilt protection, and ultimate protection; wherein, the graded overcurrent protection includes overcurrent warning protection and continuous overcurrent fault protection, the graded overtemperature protection includes overtemperature warning protection and severe overtemperature fault protection, and the graded tilt protection includes tilt warning protection and tilt fault protection. The motion constraint strategy includes a first-level early warning strategy, a second-level severe fault strategy, and a final fallback strategy; wherein, the low battery protection, the tilt angle early warning protection, the overcurrent early warning protection, and the overtemperature early warning protection correspond to the first-level early warning strategy; the severe low battery protection, the low voltage protection, the continuous overcurrent fault protection, the severe overtemperature fault protection, and the tilt angle fault protection correspond to the second-level severe fault strategy; and the final protection corresponds to the final fallback strategy.

4. The system according to claim 3, characterized in that, The first-level early warning strategy includes at least one of power limiting and height limiting dynamic actions, and retains the basic operational capabilities of the target robot; the second-level severe fault strategy includes at least one of locking movement, forced posture reset, and cutting off high-power output; the ultimate fallback strategy includes at least a physical hardware circuit breaker and irreversible cutting off of high voltage. The level 2 severe fault strategy includes an attitude level 2 fault strategy and an electrical level 2 severe fault strategy; The multi-fault priority arbitration mechanism includes: the ultimate fallback strategy is superior to the attitude level 2 fault strategy, the attitude level 2 fault strategy is superior to the electrical level 2 severe fault strategy, and the electrical level 2 severe fault strategy is superior to the level 1 early warning strategy; When multiple motion constraint strategies are triggered simultaneously, the protection control instruction corresponding to the motion constraint strategy with the first priority masks the protection control instruction corresponding to the motion constraint strategy with the second priority, so as to avoid control logic conflicts.

5. The system according to claim 3, characterized in that, The graded overcurrent protection includes logic for distinguishing between transient impacts and persistent faults; the logic for distinguishing between transient impacts and persistent faults includes: When the duration of the peak discharge current of the lithium battery module is less than or equal to the first preset overcurrent duration, the movement of the target robot is determined to be a normal inrush current and overcurrent protection is not triggered. When the discharge current of the lithium battery module is greater than the preset continuous overcurrent threshold and the duration is greater than the second preset overcurrent duration, the lithium battery module is determined to have a current fault, and the graded overcurrent protection is triggered.

6. The system according to claim 3, characterized in that, The timing execution logic corresponding to the Level 2 severe fault strategy includes: The walking movement of the target robot is locked, and new operation commands for the target robot are blocked; the target robot is controlled to lie down or squat down to reset, and after the lie down or squat down reset is stable, a high-power discharge limiting operation is performed; wherein, in the process group of executing the timing execution logic, the tilt angle data of the three axes of the robot body is monitored in a closed loop to avoid instability during the lie down or squat down reset process.

7. The system according to claim 1, characterized in that, The system also includes a three-level hardware circuit breaker unit; the three-level hardware circuit breaker unit is connected in series in the high-voltage output main circuit of the lithium battery module. The three-level hardware circuit breaker unit includes a MOS pre-disruption circuit, a high-voltage relay main circuit, and a thermal fuse final circuit arranged in sequence. The three-level hardware circuit breaker unit is used to cut off the high-voltage output main circuit in response to the trigger protection failure condition, so as to achieve irreversible hardware fallback protection for the lithium battery module.

8. The system according to claim 1, characterized in that, The security collaborative decision-making unit is also equipped with attitude interlocking protection logic that characterizes the pre-protection mechanism under the first priority of the system. The attitude interlocking protection logic includes: When the fuselage three-axis tilt angle data is greater than or equal to the fuselage tilt angle warning threshold, the safety collaborative decision unit reduces the instantaneous peak overcurrent threshold, continuous overcurrent threshold, cell overtemperature threshold, and bus overtemperature threshold, and instructs the motion control unit to only allow the triggering of low-speed attitude return operation; When the three-axis tilt angle data of the fuselage is greater than or equal to the fuselage tilt angle fault threshold, the safety collaborative decision unit forcibly cuts off the high power output of the lithium battery module and instructs the motion control unit to control the target robot to perform autonomous posture recovery; if the target robot cannot recover its posture within the preset recovery time, the motion function of the target robot is locked.

9. The system according to claim 3, characterized in that, The security collaborative decision-making unit is also equipped with a cross-protection type linkage verification mechanism, which includes: When the low battery protection is triggered, the instantaneous peak overcurrent threshold and the continuous overcurrent threshold are reduced respectively; when the graded overcurrent protection is triggered, the target discharge rate value of the lithium battery module is reduced; when the graded tilt protection and the graded overcurrent protection are triggered simultaneously, the servo power output of the target robot is cut off; wherein, when any two types of first-level early warning strategies are triggered in combination, the strategy is upgraded to the second-level severe fault strategy.

10. An electronic device, characterized in that, include: The system includes a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and the processor communicates with the memory via the bus when the electronic device is running, and the machine-readable instructions are applied by the processor during operation to the robot battery safety collaborative protection system as described in any one of claims 1 to 9.

Images