A safety control method, device and electronic equipment for an engineering machine

Abstract

The application discloses an engineering machine safety control method and device and electronic equipment, and relates to the technical field of machine control. The method comprises the following steps: receiving a fault level reported by a mechanism controller. When the fault level is the first level, a speed reduction shutdown instruction is sent, the mechanism controller keeps the current torque and is controlled to stop at a low speed without torque reduction. When the fault level is the second level, a torque keeping instruction is sent, the mechanism controller is controlled to prohibit torque reduction and to prohibit shutdown of driving power and to keep torque. A brake holding instruction is sent to a brake device, and after confirming that the brake device is in a brake holding state, a brake holding confirmation signal is sent to the mechanism controller to make the mechanism controller exit torque output. The application adopts reverse hierarchical fault processing, and when a fault occurs, the torque output of a motor is preferentially ensured until the brake device is fully effective, a torque vacuum period is eliminated, a hook sliding distance is further shortened, and the safety of the machine is ensured.

Description

Technical Field

[0001] This application relates to the field of mechanical control technology, and in particular to a safety control method, device and electronic equipment for engineering machinery. Background Technology

[0002] The safe operation of new energy cranes and other construction machinery relies on a dual protection system of motor torque support and hydraulic brake. During normal shutdown, the motor first decelerates to zero and maintains torque, then releases torque only after the hydraulic brake has fully engaged, thus preventing hook slippage. However, under fault conditions, existing technologies generally employ a positive hierarchical logic where higher fault levels result in more stringent restrictions.

[0003] This logic suffers from a serious design flaw: it cuts off the motor torque immediately after a malfunction. This creates a torque vacuum, causing the load to lose all support and fall freely under gravity. The hook can slip a distance of tens of centimeters or even several meters, posing a significant risk of serious accidents. Therefore, ensuring safe operation under malfunction conditions is a pressing issue that needs to be addressed. Summary of the Invention

[0004] In view of the above problems, this application provides a method, device, and electronic equipment for safety control of engineering machinery to improve operational safety under fault conditions. The specific solution is as follows: The first aspect of this application provides a safety control method for engineering machinery, applied to a vehicle controller, wherein the vehicle controller is communicatively connected to various mechanism controllers and braking devices, and the method includes: Receive the fault levels reported by the controllers of each mechanism; When the fault level is the first level, a deceleration and shutdown command is sent to the corresponding mechanism controller so that the mechanism controller maintains the current output torque and performs deceleration and shutdown, without performing the operation of reducing the motor output torque; When the fault level is the second level, a torque holding command is sent to the mechanism controller to prevent the mechanism controller from performing operations that reduce the output torque of the motor and from performing operations that cut off the motor drive power, and to maintain the output torque; A brake-holding command is sent to the braking device, and after confirming that the braking device is in a brake-holding state, a brake-holding confirmation signal is sent to the mechanism controller so that the mechanism controller can disengage torque output; the brake-holding confirmation signal indicates that the braking device has reached an effective braking state.

[0005] In one possible implementation, the engineering machinery safety control method further includes: When the fault level is the first level, the vehicle controller receives the brake holding request sent by the mechanism controller, and in response to the brake holding request, sends the brake holding command to the braking device; When the fault level is the second level, when sending a brake-holding command to the braking device, the vehicle controller no longer waits for the brake-holding request sent by the mechanism controller, and directly sends the brake-holding command to the braking device.

[0006] In one possible implementation, the first level is a shutdown-capable fault that does not affect the basic operation of the system; the second level includes a second sub-level and a third sub-level, wherein the second sub-level is an operational fault in which the hardware is not damaged, and the third sub-level is an output torque fault in which the hardware is not completely damaged.

[0007] In one possible implementation, confirming that the braking device is in a holding state includes: The system receives the pressure value detected by the pressure sensor of the braking device. When the pressure value is not less than the rated pressure value of a preset ratio, the system confirms that the braking device is in the holding state.

[0008] In one possible implementation, after sending the brake confirmation signal to the mechanism controller, the method further includes: The mechanism controller gradually stops torque output after a preset delay.

[0009] In one possible implementation, if the braking device is not confirmed to be in a braking state within a preset time after the brake command is sent to the braking device, a maximum torque request is sent to the mechanism controller so that the mechanism controller outputs a sustaining torque.

[0010] In one possible implementation, the process of the mechanism controller executing the deceleration and stop command includes: the mechanism controller performing deceleration and stop at a preset deceleration rate, and maintaining the current torque output when the motor speed drops below a preset threshold.

[0011] In one possible implementation, when the fault level is the second level, if the mechanism controller suffers a complete hardware failure, the vehicle controller receives an emergency stop signal sent by the mechanism controller and, in response to the emergency stop signal, sends an emergency brake command to the braking device corresponding to the mechanism controller that suffered a complete hardware failure, while simultaneously sending a command to other mechanism controllers to maintain the current output torque and prohibiting the other mechanism controllers from executing new action commands.

[0012] A second aspect of this application provides a safety control device for engineering machinery, applied to a vehicle controller, wherein the vehicle controller is communicatively connected to various mechanism controllers and a braking device, and the device includes: The fault determination module is used to receive the fault levels reported by the controllers of each mechanism; The first-level processing module is used to send a deceleration and shutdown command to the mechanism controller when the fault level is the first level, so that the mechanism controller maintains the current output torque and performs deceleration and shutdown, and does not perform the operation of reducing the output torque of the motor; The second-level processing module is configured to, when the fault level is second-level, send a torque holding command to the mechanism controller, so that the mechanism controller prohibits the operation of reducing the output torque of the motor and prohibits the operation of cutting off the motor drive power, and maintains the output torque; and, The brake control module is used to send a brake command to the braking device, and after confirming that the braking device is in the brake state, send a brake confirmation signal to the mechanism controller so that the mechanism controller can withdraw torque output; the brake confirmation signal indicates that the braking device has reached an effective braking state.

[0013] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the engineering machinery safety control method described in the first aspect or any implementation thereof.

[0014] A fourth aspect of this application provides an electronic device, including at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the engineering machinery safety control method described in the first aspect or any implementation thereof.

[0015] The fifth aspect of this application provides a computer storage medium carrying one or more computer programs, which, when executed by an electronic device, enable the electronic device to implement the engineering machinery safety control method described in the first aspect or any implementation thereof.

[0016] By employing the aforementioned technical solution, the engineering machinery safety control method provided in this application maintains the current output torque and performs deceleration and shutdown without torque reduction during a first-level fault, and prohibits torque reduction and drive power disconnection while maintaining output torque during a second-level fault. The higher the fault level, the more priority is given to ensuring torque output. A brake confirmation signal is sent only after a brake-holding command is sent to the braking device and the brake-holding status is confirmed, causing the mechanism controller to withdraw torque output. This ensures that the brake confirmation signal indicates that the braking device has reached an effective braking state, effectively filling the torque vacuum period and reducing the hook slippage distance from tens of centimeters to less than a centimeter, achieving a safety design where faults are treated as safety. Simultaneously, a normal shutdown procedure is used for first-level faults instead of torque reduction operation, avoiding hook slippage and equipment impact caused by torque reduction. This solves the technical problem of hook slippage caused by torque vacuum periods in existing positive hierarchical fault handling logic, effectively ensuring operational safety under fault conditions. Attached Figure Description

[0017] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0018] Figure 1 A flowchart of a safety control method for engineering machinery provided in this application; Figure 2 A structural diagram of a safety control device for engineering machinery provided in this application; Figure 3 This is a structural diagram of an electronic device provided in this application. Detailed Implementation

[0019] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0020] As will be known to those skilled in the art, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0021] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0022] Currently, under fault conditions, existing technologies generally adopt a positive hierarchical logic where "the higher the fault level, the more severe the restrictions." Level 1 fault: Torque drops to 80% of rated value; continue operation. Level 2 fault: Immediately force zero torque output; Level 3 fault: Immediately shut off all power transistors and disconnect the motor power supply.

[0023] This logic has a fatal design flaw: the mechanical response time of the hydraulic brake is 50-100ms, while existing technology cuts off the motor torque within 1-2ms after a failure. During this 50-100ms torque vacuum period, the heavy object completely loses support and falls freely under gravity, with the hook slipping a distance of tens of centimeters or even several meters, which can easily lead to a serious accident.

[0024] According to relevant statistics, in accidents involving heavy objects falling from new energy cranes, 68% are caused by the torque vacuum period during fault handling, rather than the failure of the brakes themselves.

[0025] To address the aforementioned problems, this application provides a safety control method for construction machinery. The following detailed description of the construction machinery safety control method according to the accompanying drawings is provided in conjunction with the accompanying drawings.

[0026] Taking a new energy crane as an example, a new energy crane typically includes a vehicle control unit (VCU), multiple mechanism controllers such as a main winch MCU (Motor Controller Unit), an auxiliary winch MCU, a luffing winch MCU, a permanent magnet synchronous motor, a braking device, and a CAN bus. The vehicle control unit communicates with each mechanism controller and the braking device. In this embodiment, the braking device is a hydraulic brake system, including a hydraulic pump station, solenoid valves, and pressure sensors. The pressure sensor has an accuracy of ±1% and a sampling period of 1ms. The CAN bus communication period is 10ms, fault information is sent with the highest priority, and the transmission delay does not exceed 1ms.

[0027] The vehicle controller, as the core of safety control, is responsible for receiving fault reports, coordinating fault handling, controlling the braking system, and sending brake confirmations. Each mechanism controller is independently responsible for fault detection, motor control, and torque maintenance of its corresponding mechanism.

[0028] Reference Figure 1 , Figure 1 This application provides a flowchart illustrating a safety control method for engineering machinery, as shown in the embodiments below. Figure 1 As shown in the embodiments of this application, the engineering machinery safety control method may include steps S101 to S104, which are described in detail below.

[0029] This safety control method for construction machinery is applied to the vehicle control unit (VCU) of the aforementioned new energy crane. The VCU is connected via a CAN 2.0B bus to multiple mechanism controllers, including the main winch motor controller, auxiliary winch motor controller, and luffing winch motor controller, as well as braking devices such as the hydraulic brake system. The method includes: Step S101: Receive the fault levels reported by the controllers of each mechanism.

[0030] During operation, each mechanism controller monitors the operating status of its corresponding permanent magnet synchronous motor in real time, including parameters such as current, voltage, temperature, speed, and encoder signals. When an anomaly is detected, each mechanism controller classifies the fault according to a preset fault level classification standard and reports the fault level and fault code to the VCU via the CAN bus.

[0031] In this embodiment, as shown in Table 1 below: Table 1

[0032] Fault levels are classified according to their impact on system safety and whether the motor still has controllable torque output capability. Level 1 faults (first level) are minor faults that do not affect basic system operation and can be safely shut down, including but not limited to over-temperature warnings (temperature below 85℃), slight fluctuations in bus voltage (±10%), and slight encoder signal abnormalities. Level 2 faults (second sub-level) are general faults that affect system performance but do not damage the hardware and allow for short-term operation, including but not limited to overcurrent warnings (current below 1.2 times the rated value), communication interruption warnings, and abnormal drive voltage. Level 3 faults (third sub-level) are serious faults where the hardware is not completely damaged and controllable torque output capability is still maintained, including but not limited to overcurrent (current greater than 1.2 times the rated value), damage to a single power transistor (other bridge arms still function normally), and severely abnormal drive voltage.

[0033] Furthermore, this application classifies phase-to-phase short circuits, short circuits to ground, encoder signal loss, and motor stall as uncontrollable faults. Under such faults, the motor or controller has lost its controllable torque output capability and cannot execute the torque holding strategy. Therefore, the reverse graded torque holding control of this application is not applicable. Instead, the vehicle controller directly controls the hydraulic brake of the corresponding mechanism to perform the braking action, using mechanical braking as the last safety barrier.

[0034] The second level includes a second sub-level (i.e., the aforementioned level two fault) and a third sub-level (i.e., the aforementioned level three controllable severe fault). The second sub-level is an operational fault where the hardware is not damaged, and the third sub-level is a severe fault where the hardware is not completely damaged but still has the ability to output controllable torque. Uncontrollable faults are not sub-levels of the second level and are not subject to torque holding strategies. The level two faults and level three controllable severe faults in Table 1 above are collectively referred to as the second level of this application, and the level one fault is the first level.

[0035] Step S102: When the fault level is the first level, send a deceleration and stop command to the corresponding mechanism controller so that the mechanism controller maintains the current output torque and performs deceleration and stop, and does not perform the operation of reducing the output torque of the motor.

[0036] Upon receiving a Level 1 fault report, the VCU immediately sends a deceleration and shutdown command to the corresponding mechanism controller. Specifically, the mechanism controller executes the deceleration and shutdown command by: decelerating at a preset deceleration rate (e.g., 0.5 m / s², the same as the normal shutdown deceleration rate), and maintaining the current torque output when the motor speed drops below a preset threshold (e.g., ±5 rpm), instead of reducing the torque to zero. During this process, the mechanism controller does not implement any torque reduction or power reduction limits, maintaining the current output torque until the motor speed drops below the threshold.

[0037] Subsequently, the mechanism controller sends a brake-holding request to the VCU. The VCU receives the brake-holding request from the mechanism controller and, in response, sends a brake-holding command to the braking device.

[0038] Step S103: When the fault level is the second level, send a torque holding command to the mechanism controller so that the mechanism controller is prohibited from performing the operation of reducing the motor output torque and the operation of cutting off the motor drive power, and maintains the output torque.

[0039] Upon receiving a report of a Level 2 or Level 3 controllable severe fault, the VCU immediately sends a torque holding command to the corresponding mechanism controller. This means that during a Level 2 fault (including Level 2 and Level 3 controllable severe faults), the mechanism controller is absolutely prohibited from actively limiting the torque to 0 and from actively shutting down the power transistor. Simultaneously, the mechanism controller immediately sends an emergency brake request to the VCU (rather than waiting for the VCU to actively inquire). The mechanism controller checks its own hardware status; if no complete hardware failure has occurred (i.e., it can still controllably output torque), it executes smooth deceleration and shutdown control, continuously maintaining the maximum available torque output.

[0040] When the VCU receives a report of an uncontrollable fault (phase-to-phase short circuit, short circuit to ground, encoder signal loss, motor stall), it does not send a torque holding command to the controller of that mechanism. Instead, it directly controls the corresponding hydraulic brake to perform the braking action. This mechanism does not participate in the torque holding synchronization control. After the brake pressure reaches 90% of the rated pressure, this mechanism does not perform the torque release operation, and the load support is always borne by the mechanical brake.

[0041] It should be noted that complete hardware failure refers to a state where the motor controller is severely damaged and unable to output torque at all, such as all IGBTs (switching transistors) burning out or the control chip completely failing. In contrast, incomplete hardware failure refers to a critical state where the motor controller has suffered hardware damage but can still output a certain amount of torque, such as a single IGBT failing but the other bridge arms still functioning normally.

[0042] If the mechanism controller suffers a complete hardware failure and is unable to maintain torque, it immediately sends a high-priority emergency stop signal to the VCU. Upon receiving the emergency stop signal, the VCU will perform the corresponding emergency procedures.

[0043] Step S104: Send a brake-holding command to the braking device, and after confirming that the braking device is in the brake-holding state, send a brake-holding confirmation signal to the mechanism controller so that the mechanism controller can withdraw torque output; the brake-holding confirmation signal indicates that the braking device has reached an effective braking state.

[0044] When sending a brake-holding command to the braking device, the VCU's execution strategy varies depending on the fault level.

[0045] In the event of a Level 1 fault, the VCU waits for the mechanism controller to send a brake request before responding by sending a brake command to the braking device. At this time, the brake control sequence is exactly the same as a normal stop: the mechanism controller first completes the deceleration stop, then requests the brake, and the VCU responds to the brake request by controlling the brake.

[0046] In the event of a Level 2 fault, the VCU does not need to wait for the mechanism controller to send a brake-holding request; it directly sends a brake-holding command to the braking device. This is because Level 2 faults are more severe and require a faster response time. The VCU immediately controls the brake, reducing the brake response time from over 100ms to less than 15ms, further reducing the hook slippage distance. Simultaneously, the VCU sends a zero-speed request to all mechanism controllers and disables all mechanism operation commands, allowing only system reset.

[0047] The braking device is a hydraulic brake system, comprising a hydraulic pump station, solenoid valves, and pressure sensors. The pressure sensor has an accuracy of ±1% and a sampling period of 1ms. The VCU sends the brake command to the braking device by controlling the hydraulic solenoid valve to de-energize, causing the hydraulic system to establish brake pressure.

[0048] The VCU continuously receives the pressure value detected by the pressure sensor of the braking device. When the pressure value is not less than the rated pressure value of a preset ratio, it confirms that the braking device is in the holding state.

[0049] In this embodiment, the preset ratio is 90% of the rated pressure. When the pressure sensor detects that the brake pressure reaches more than 90% of the rated pressure, the VCU confirms that the hydraulic brake has been fully activated, that is, the braking device has reached an effective braking state.

[0050] This brake confirmation mechanism is crucial, ensuring that the sole trigger condition for releasing torque is that the braking system has actually built up sufficient braking force, rather than considering brake engagement complete simply by sending a brake command, as is the case with existing technologies. This fundamentally avoids the dangerous situation where the brake fails to take effect due to hydraulic system leaks or solenoid valve jamming, even though the motor has already released torque.

[0051] Once the VCU confirms that the braking device is in the holding state, it sends a holding confirmation signal to the corresponding mechanism controller. The holding confirmation signal indicates that the braking device has reached an effective braking state.

[0052] After receiving the brake confirmation signal, the mechanism controller gradually stops the torque output (i.e., smoothly withdraws the torque output) after a preset delay (e.g., 100ms), rather than instantly reducing the torque to zero. This smooth withdrawal method avoids the huge current surge and mechanical shock caused by direct shut-off, effectively protecting the power devices and mechanical structure.

[0053] This application overturns the traditional forward hierarchical logic where higher fault levels lead to stricter restrictions. Instead, it adopts a reverse hierarchical fault handling architecture where higher fault levels prioritize torque output. In a Level 1 fault, the current output torque is maintained, and deceleration and shutdown are performed without torque reduction. In a Level 2 fault, torque reduction and drive power disconnection are prohibited, while output torque is maintained. This completely fills the 50-100ms torque vacuum period in existing technologies, reducing hook slippage distance from tens of centimeters to less than 8mm, achieving a safety design where faults are treated as safety. Simultaneously, Level 1 faults employ normal shutdown procedures instead of torque reduction, avoiding hook slippage and equipment impact caused by torque reduction, and preventing fault escalation.

[0054] In some embodiments, the VCU's handling procedure during a first-level fault is as follows: After receiving a Level 1 fault report, a zero-speed request is sent to the corresponding MCU; wait for the MCU's brake-holding request without actively controlling the brake; upon receiving the brake-holding request, the hydraulic solenoid valve is de-energized to establish brake pressure; when the pressure sensor detects that the brake pressure is ≥ 90% of the rated pressure, a brake-holding confirmation is sent to the MCU; the yellow fault indicator light is illuminated, and the fault occurrence time, fault code, and operating parameters are recorded.

[0055] In the event of a Level 2 fault, the VCU's handling procedure is as follows: Upon receiving a Level 2 / Level 3 fault report, immediately send a zero-speed request to all MCUs; without waiting for the MCUs' brake request, immediately control the hydraulic solenoid valve to de-energize and establish brake pressure; when the pressure sensor detects that the brake pressure is ≥ 90% of the rated pressure, send a brake confirmation to all MCUs; illuminate the red fault indicator light and issue a continuous audible and visual alarm; prohibit all operating commands of the mechanisms, allowing only system reset; record complete fault data, including all operating parameters for 10 seconds before and after the fault occurs.

[0056] The core of this differentiated control lies in the fact that, in the event of a Level 2 fault, the VCU no longer waits for the MCU's brake request but directly controls the brake, reducing the brake response time from over 100ms to less than 15ms, further reducing the hook slippage distance. Simultaneously, in the event of a Level 2 fault, the MCU immediately disables all torque limit commands after the fault occurs, responding only to the VCU's brake confirmation signal, and automatically increases the current limit to 1.5 times the rated value, ensuring sufficient support torque can be output.

[0057] In other embodiments, the motor must continuously output sufficient support torque to prevent the hook from slipping during the time interval between the occurrence of a fault and the full activation of the hydraulic brake (typically 50-100 ms, i.e., the torque holding window).

[0058] To ensure that the motor always outputs sufficient torque before the brake takes effect, the following multiple safeguards are implemented: Upon the occurrence of a fault, the MCU immediately disables all torque limit commands and only responds to the brake confirmation signal from the VCU. In other words, during the torque holding window, any torque limit commands from the VCU or other controllers are ignored by the MCU, ensuring that the motor output is not disturbed.

[0059] The MCU automatically increases the current limit to 1.5 times the rated value to ensure sufficient supporting torque output. Under heavy load conditions, the supporting torque may exceed the rated torque; increasing the current limit provides hardware assurance for the motor to output sufficient supporting torque.

[0060] The MCU employs an independent torque control loop, which is unaffected by the fault detection loop. Even if the fault detection loop fails or is delayed due to a fault, the torque control loop can still operate independently, ensuring uninterrupted torque output.

[0061] If the MCU detects insufficient torque output (e.g., the actual output torque is less than 90% of the target support torque), it will immediately send an emergency alarm to the VCU, triggering dual protection.

[0062] During fault handling, if the VCU detects that the brake pressure has not reached the preset proportion of the rated pressure within a preset time, backup protection will be immediately activated. The specific procedure is as follows: The VCU starts timing after sending a brake-holding command to the braking device. The preset time is 100ms in this embodiment (which can be adjusted according to the actual response characteristics of the hydraulic system). If the brake pressure detected by the pressure sensor does not reach 90% of the rated pressure within 100ms, the VCU determines that the hydraulic brake system has failed.

[0063] At this point, the VCU immediately performs the following backup protection measures: A maximum torque request is sent to all mechanism controllers, causing them to output a sustaining torque, which is the motor outputting a reverse sustaining torque that balances the load's gravity. At this time, the motor acts as an electric brake, continuously supporting the suspended load and preventing it from falling.

[0064] The VCU illuminates the emergency fault indicator light and emits a rapid audible and visual alarm to warn operators that a serious system malfunction has occurred.

[0065] The VCU prohibits any action from any mechanism, maintains the current state, and prevents misoperation from escalating the accident.

[0066] The VCU records all fault data, facilitating post-fault analysis and fault tracing.

[0067] The aforementioned backup protection mechanism constructs a triple safety system encompassing motor torque maintenance, hydraulic brake braking, and failover protection. Even if the hydraulic system completely fails, the motor can still provide continuous support torque, achieving intrinsic safety design. This mechanism is particularly suitable for scenarios such as hydraulic system leakage, solenoid valve sticking, and hydraulic pump station failure, filling the gap in existing technologies that lack brake failover protection.

[0068] In other embodiments, a torque smoothing exit mechanism is set after the mechanism controller receives the brake confirmation signal sent by the VCU.

[0069] Specifically, after receiving the brake confirmation signal, the mechanism controller does not immediately reduce the torque to 0, but gradually stops the torque output after a preset delay (100ms in this embodiment). Gradual stopping means that the torque decreases linearly at a certain rate (such as 10% / ms of the rated torque), rather than a step decrease.

[0070] This smooth shutdown method avoids the enormous back electromotive force and mechanical shock caused by the instantaneous drop in motor current from hundreds of amperes to zero due to direct power transistor shutdown. With direct shutdown, the inrush current can reach 3 to 5 times the rated current, easily causing secondary damage to power devices such as IGBTs. Simultaneously, the mechanical shock accelerates fatigue damage to transmission components such as reducers and couplings. The smooth shutdown method, however, controls the current change rate within a safe range, extending the service life of power devices and mechanical structures by more than 30%.

[0071] Considering extreme cases, in the event of a Level 2 or Level 3 fault, if the mechanism controller suffers complete hardware failure, meaning the motor controller is completely unable to output any torque (e.g., all IGBTs are burned out, the DC bus capacitor explodes and becomes inoperable, the control chip completely fails, etc.), then the strategy of maintaining torque output cannot be executed.

[0072] In this situation, the mechanism controller immediately sends a high-priority emergency stop signal to the VCU. Upon receiving the emergency stop signal, the VCU performs the following actions: Immediately send an emergency brake command to the hydraulic brake corresponding to the mechanism that has suffered complete hardware failure, without waiting for any confirmation signal, and let the mechanical brake directly bear the load support of the mechanism.

[0073] Send a command to other mechanism controllers that have not suffered complete hardware failure to maintain the current output torque and prohibit them from executing any new action commands, so as to prevent the boom from generating additional bending moment or force change due to unilateral power change.

[0074] It issues the highest level of emergency audible and visual alarm, prompting operators to immediately move away from the danger zone.

[0075] Record complete fault data, including all operating parameters in the 10 seconds before and after the fault occurs, to provide data support for post-fault analysis and equipment improvement.

[0076] This emergency handling mechanism for complete hardware failure clarifies the handling boundaries in the most extreme cases, improves the complete logical chain of fault handling, and avoids logical chaos when the system is unable to execute the predetermined strategy.

[0077] As a specific application of the above-mentioned safety control methods for engineering machinery, the interaction process between the MCU and VCU will be explained in detail: 1. Level 1 fault handling procedure: MCU-side actions: Upon detecting a Level 1 fault, the fault level and code are immediately reported to the VCU via the CAN bus.

[0078] No torque / power reduction limits are applied; the current output torque is maintained.

[0079] Perform smooth deceleration and shutdown control with a deceleration rate of 0.5 m / s² (the same as the normal shutdown deceleration rate).

[0080] When the motor speed drops to within ±5 rpm, maintain the current torque output.

[0081] Send a brake holding request to the VCU.

[0082] Maintain torque output until a brake confirmation signal is received from the VCU.

[0083] After receiving confirmation of the brake holding, the torque output is smoothly discontinued after a 100ms delay.

[0084] VCU side action: Upon receiving a Level 1 fault report, a zero-speed request is immediately sent to the corresponding MCU.

[0085] Wait for the MCU to request the brake to be applied, but do not actively control the brake.

[0086] Upon receiving a brake application request, the hydraulic solenoid valve is de-energized to establish brake pressure.

[0087] When the pressure sensor detects that the brake pressure is ≥ 90% of the rated pressure, it sends a brake confirmation to the MCU.

[0088] Illuminate the yellow fault indicator light and record the time of the fault, the fault code, and the operating parameters.

[0089] 2. Level 2 / Level 3 Fault Handling Procedure: MCU-side actions: Upon detecting a Level 2 / Level 3 fault, the fault level and code are immediately reported to the VCU via the CAN bus.

[0090] It is absolutely forbidden to actively limit the torque to 0, and it is absolutely forbidden to actively turn off the power transistor.

[0091] An emergency brake-holding request was immediately sent to the VCU.

[0092] Check the hardware status; if no complete hardware failure has occurred, execute smooth deceleration and shutdown control.

[0093] Maintain maximum available torque output until a brake confirmation signal is received from the VCU.

[0094] After receiving confirmation of the brake holding, the torque output is smoothly discontinued after a 100ms delay.

[0095] If a complete hardware failure occurs and torque cannot be maintained, an emergency stop signal with the highest priority is immediately sent to the VCU. Upon receiving the emergency stop signal, the VCU directly controls the hydraulic brake corresponding to that mechanism to engage in emergency braking, while requiring other mechanisms to maintain the current torque and prohibiting new actions.

[0096] VCU-side actions: Upon receiving a Level 2 / Level 3 fault report, a zero-speed request is immediately sent to all MCUs.

[0097] Without waiting for the MCU to request the brake, the hydraulic solenoid valve is immediately de-energized to establish the brake pressure.

[0098] When the pressure sensor detects that the brake pressure is ≥ 90% of the rated pressure, a brake confirmation is sent to all MCUs.

[0099] The red fault indicator light will illuminate, and a continuous audible and visual alarm will be emitted.

[0100] Disable all commands to operate the system; only system reset is permitted.

[0101] Record complete fault data, including all operating parameters for 10 seconds before and after the fault occurred.

[0102] The above describes a safety control method for construction machinery provided by the embodiments of this application. The following will describe the apparatus for performing the above-described safety control method for construction machinery.

[0103] Please see Figure 2 , Figure 2 This is a structural schematic diagram of a safety control device for engineering machinery provided in an embodiment of this application. Figure 2 As shown, the safety control device for construction machinery includes: The fault determination module 201 is used to receive the fault level reported by each mechanism controller.

[0104] The first-level processing module 202 is used to send a deceleration and stop command to the mechanism controller when the fault level is first level, so that the mechanism controller maintains the current output torque and performs deceleration and stop, and does not perform the operation of reducing the output torque of the motor.

[0105] The second-level processing module 203 is used to send a torque holding command to the mechanism controller when the fault level is second-level, so that the mechanism controller prohibits the operation of reducing the motor output torque and prohibits the operation of cutting off the motor drive power, and maintains the output torque. And, The brake control module 204 is used to send a brake command to the braking device and, after confirming that the braking device is in the brake state, send a brake confirmation signal to the mechanism controller so that the mechanism controller can withdraw torque output; the brake confirmation signal indicates that the braking device has reached an effective braking state.

[0106] In one possible implementation, the brake control module 204 is also used for: When the fault level is the first level, the vehicle controller receives the brake holding request sent by the mechanism controller, and in response to the brake holding request, sends a brake holding command to the braking device. When the fault level is level two, when sending a brake-holding command to the braking device, the vehicle controller no longer waits for the brake-holding request sent by the mechanism controller, but directly sends the brake-holding command to the braking device.

[0107] In one possible implementation, the first level is a shutdown-capable fault that does not affect the basic operation of the system; the second level includes a second sub-level and a third sub-level, where the second sub-level is an operational fault where the hardware is not damaged, and the third sub-level is an output torque fault where the hardware is not completely damaged.

[0108] In one possible implementation, the process by which the brake control module 204 confirms that the braking device is in a brake-holding state includes: The system receives the pressure value detected by the pressure sensor of the braking device. When the pressure value is not less than the rated pressure value of a preset ratio, it confirms that the braking device is in the holding state.

[0109] In one possible implementation, after sending a brake confirmation signal to the mechanism controller, the brake control module 204 is further configured to: The mechanism controller gradually stops torque output after a preset delay.

[0110] In one possible implementation, the brake control module 204 is further configured to send a maximum torque request to the mechanism controller within a preset time after sending a brake command to the braking device, if it is not confirmed that the braking device is in a brake state, so that the mechanism controller outputs a sustaining torque.

[0111] In one possible implementation, the process of the mechanism controller in the first-level processing module 202 executing the deceleration and stop command includes: the mechanism controller performs deceleration and stop at a preset deceleration rate, and maintains the current torque output when the motor speed drops below a preset threshold.

[0112] In one possible implementation, when the fault level is level two, the brake control module 204 is also used to, if the mechanism controller suffers complete hardware failure, receive an emergency stop signal sent by the mechanism controller, and in response to the emergency stop signal, send an emergency brake command to the braking device corresponding to the mechanism controller that suffered complete hardware failure, and at the same time send a command to other mechanism controllers to maintain the current output torque, and prohibit other mechanism controllers from executing new action commands.

[0113] This application also provides an electronic device in its embodiments. (See reference...) Figure 3 The diagram illustrates a structural schematic suitable for implementing the electronic device in the embodiments of this application. The electronic device in the embodiments of this application may include, but is not limited to, ECU (Electronic Control Unit), VCU (Vehicle Control Unit), HCU (Hybrid Control Unit), etc. Figure 3 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0114] refer to Figure 3 As shown, the electronic device includes at least one processor 301 and a memory 302 connected to the processor 301, wherein: the memory is used to store computer programs; the processor 301 is used to execute the computer programs so that the electronic device can implement the engineering machinery safety control method as described in the above embodiment.

[0115] This application also provides a computer program product, including computer-readable instructions, which, when executed on an electronic device, cause the electronic device to implement any of the engineering machinery safety control methods provided in this application.

[0116] This application also provides a computer-readable storage medium that carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any of the engineering machinery safety control methods provided in this application.

[0117] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0118] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the engineering machinery safety control method described in the various embodiments of this application.

[0119] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0120] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A safety control method for engineering machinery, applied to a vehicle controller, wherein the vehicle controller is communicatively connected to each mechanism controller and the braking device, characterized in that, The method includes: Receive the fault levels reported by the controllers of each mechanism; When the fault level is the first level, a deceleration and shutdown command is sent to the corresponding mechanism controller so that the mechanism controller maintains the current output torque and performs deceleration and shutdown, without performing the operation of reducing the motor output torque; When the fault level is the second level, a torque holding command is sent to the mechanism controller to prevent the mechanism controller from performing operations that reduce the output torque of the motor and from performing operations that cut off the motor drive power, and to maintain the output torque; A brake-holding command is sent to the braking device, and after confirming that the braking device is in a brake-holding state, a brake-holding confirmation signal is sent to the mechanism controller so that the mechanism controller can disengage torque output; the brake-holding confirmation signal indicates that the braking device has reached an effective braking state.

2. The engineering machinery safety control method according to claim 1, characterized in that, Also includes: When the fault level is the first level, the vehicle controller receives the brake holding request sent by the mechanism controller, and in response to the brake holding request, sends the brake holding command to the braking device; When the fault level is the second level, when sending a brake-holding command to the braking device, the vehicle controller no longer waits for the brake-holding request sent by the mechanism controller, and directly sends the brake-holding command to the braking device.

3. The engineering machinery safety control method according to claim 1, characterized in that, The first level is a shutdown-capable fault that does not affect the basic operation of the system; the second level includes a second sub-level and a third sub-level, the second sub-level being an operational fault where the hardware is not damaged, and the third sub-level being an output torque fault where the hardware is not completely damaged.

4. The engineering machinery safety control method according to claim 1, characterized in that, The confirmation that the braking device is in the holding state includes: The system receives the pressure value detected by the pressure sensor of the braking device. When the pressure value is not less than the rated pressure value of a preset ratio, the system confirms that the braking device is in the holding state.

5. The engineering machinery safety control method according to claim 1, characterized in that, After sending the brake confirmation signal to the mechanism controller, the method further includes: The mechanism controller gradually stops torque output after a preset delay.

6. The engineering machinery safety control method according to claim 1, characterized in that, If, within a preset time after sending the brake command to the braking device, the braking device is not confirmed to be in a brake-holding state, a maximum torque request is sent to the mechanism controller so that the mechanism controller outputs a sustaining torque.

7. The engineering machinery safety control method according to claim 1, characterized in that, The process of the mechanism controller executing the deceleration and stop command includes: the mechanism controller performs deceleration and stop at a preset deceleration rate, and maintains the current torque output when the motor speed drops below a preset threshold.

8. The engineering machinery safety control method according to claim 1, characterized in that, When the fault level is the second level, if the mechanism controller suffers complete hardware failure, the vehicle controller receives the emergency stop signal sent by the mechanism controller and, in response to the emergency stop signal, sends an emergency brake command to the braking device corresponding to the mechanism controller that suffered complete hardware failure, and at the same time sends a command to other mechanism controllers to maintain the current output torque, prohibiting the other mechanism controllers from executing new action commands.

9. A safety control device for engineering machinery, applied to a vehicle controller, wherein the vehicle controller is communicatively connected to each mechanism controller and the braking device, characterized in that, The device includes: The fault determination module is used to receive the fault levels reported by the controllers of each mechanism; The first-level processing module is used to send a deceleration and stop command to the mechanism controller when the fault level is the first level, so that the mechanism controller maintains the current output torque and performs deceleration and stop, and does not perform the operation of reducing the output torque of the motor; The second-level processing module is configured to, when the fault level is second-level, send a torque holding command to the mechanism controller, so that the mechanism controller prohibits the operation of reducing the output torque of the motor and prohibits the operation of cutting off the motor drive power, and maintains the output torque; and, The brake control module is used to send a brake command to the braking device, and after confirming that the braking device is in the brake state, send a brake confirmation signal to the mechanism controller so that the mechanism controller can withdraw torque output; the brake confirmation signal indicates that the braking device has reached an effective braking state.

10. An electronic device, characterized in that, It includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the engineering machinery safety control method as described in any one of claims 1 to 8.

Images