SE533061C2 - Operating system for a working machine, and control procedure - Google Patents

Description

533 051 In order to increase the operational reliability of the forest machines, attempts have typically been made to make the forest machines powerful, whereby it has been possible to reduce their risk of damage. However, it is not very easy to make the control system more powerful, if you want to achieve comfortable usability. Therefore, there is a need to further develop the control system.

Brief summary of the invention A solution has now been invented with which the fault tolerance of a work machine's control and / or operating system can be increased.

To achieve this object, the inventive operating system is mainly characterized by what is presented in the independent claim 1. The inventive control procedure is again mainly characterized by what is presented in the independent claim 5. The inventive connection of an actuator in an operating system for a work machine is mainly characterized by what is presented in the independent claim 12. The inventive method for monitoring the condition of an actuator in a work machine is again mainly characterized by what is presented in the independent claim 14. In the other, dependent claims, some advantageous embodiments of the invention are presented. In a control system according to the basic idea of the invention, setpoints are given by an actuator, and on the basis of setpoints the control quantities are to be formed which are to be used for controlling one or more actuators through a control unit. In addition, control quantities are formed on the basis of the setpoints obtained from the actuator also with a spare control unit, and the control units formed by the reserve control unit are used for controlling the drive unit when the control unit is not capable of functioning correctly.

The control system for a work machine according to the basic idea of the invention comprises at least one actuator, a control unit, one or two control devices and a spare control unit. The actuator is intended to provide setpoints, and it can be, for example, a coupler, a control resistor or another suitable device.

The control unit processes setpoints obtained from the actuator and forms the control quantities to be used for control. The drive devices again control drive devices, and a drive device can be, for example, a valve or a relay.

The spare control unit is connected to the actuator and the control unit.

The reserve control unit also processes setpoints obtained from the actuator and forms the control quantities that are to be used for the control and that are to be used when needed to control the actuators.

In one embodiment, the control unit comprises at least two control modules which are connected to each other by a communication bus. In one embodiment, the control system further comprises at least one or fl your spare drivers. The spare driver is connected to the spare control unit. Spare drivers can be controlled with the spare control unit, preferably even when it is not possible to control the drivers. In one embodiment, the actuator comprises a hall sensor or a potentiometer with at least three independent adjustment groups, which adjustment groups have their own voltage inputs and outputs. With fl your adjustment groups, the fault tolerance is increased, as the position of the actuator can be determined even though one / some of the adjustment groups would be damaged.

In one embodiment, the control system comprises a hall sensor or a potentiometer with three independent adjustment groups. From the actuator, the signals of the adjustment groups are transferred to two separate microcontrollers. These microcontrollers function as a control unit and a backup control unit, and they are preferably adapted to monitor the function of other units. The control unit is responsible for the control and operation of the work machine when the control system is in order. In the fault condition of the operating system, the control responsibility is transferred either to the control unit or to the reserve control unit according to which unit can operate. For example, the control responsibility can be transferred to the reserve control unit in all other fault conditions than in the event of a fault in the reserve control unit. It depends on the type of fault whether the work machine can function normally or with reduced performance or whether the work machine must be stopped as soon as possible. In one application, the actuator of the control system, which comprises juster your adjustment groups, is connected in such a way that the voltage supply to the adjustment group of at least one actuator is connected to the control unit control unit and the voltage input to at least one adjustment group is connected to the control system reserve control. The outputs from all adjustment groups are connected to the control unit and the reserve control unit. In one embodiment, the condition and function of the work machine actuator are monitored by checking voltage inputs to the adjustment groups and signals from the adjustment groups.

The control solution can be used in many ways, and in one embodiment at least three different operating states are determined, of which the operating state to be used is selected on the basis of a fault analysis. In an advantageous embodiment, there are four operating states: the normal, the first adapted, the second adapted, and the downward. Depending on the operating condition, the work machine may operate normally or with reduced performance, or the work machine must be stopped as soon as possible.

The different embodiments of the now presented solution, why themselves and in different combinations, offer special benefits. The invention enables i.a. the realization of a fault-tolerant control system. Furthermore, with the help of the solution it is possible to determine the operating condition of the working machine according to different degrees of damage.

Description of the drawings In the following description, the invention will be illustrated in more detail with reference to the accompanying principles, where Figure 1 shows a first embodiment of an operating system in the form of a diagram, Figure 2 shows a second embodiment of an operating system in the form of a diagram, Figure 3 shows the effect of error types on the system's operating condition. 10 15 20 25 30 35 533 051 For the sake of clarity, the drawings have shown only the details that are necessary to understand the invention. The structures and details that are unnecessary for the understanding of the invention but clear to a person skilled in the art have been omitted from the fi gures to emphasize the special features of the invention.

Description of the invention in detail Figure 1 shows an operating system for a working machine according to the basic idea of the invention, comprising at least one operating device 1, a control unit 2, one or more of the drive devices 3 and a spare control unit 4.

With actuator 1, setpoints are given to the control system. In this context, the actuator 1 means a part of the control system, with which the user influences the control system. The actuator 1 can be, for example, a control lever, a manual lever, a trim knob, a push button, a pedal or the like.

The actuator 1 typically comprises various components, such as, for example, couplers, control resistors, etc., with the cooperation of which the required properties are achieved and which produce the setpoints.

The control unit 2 processes the setpoints obtained from the actuator 1 and forms the control quantities to be used for control. In one embodiment, the control unit 2 is realized at least in part with software, and the processing of setpoints and the formation of the control quantities takes place by using a suitable algorithm. In the solution according to fi gur1 fi there is a reserve control unit 4 next to the control unit 2. The reserve control unit 4 is connected to the actuator 1 and the control unit 2. The reserve control unit 4 processes setpoints obtained from the actuator 1 and forms the control quantities to be used for the control. if necessary for control of the actuators 3. It is advantageous to also realize the reserve control unit 4 at least in part with software so that the processing of setpoints and the formation of the control quantities takes place by using a suitable algorithm. In terms of reliability, it is advantageous to realize the control unit 2 and the reserve control unit 4 in the form of modules which are separate from each other, although it is also possible to place a functionally independent control unit and an independent reserve control unit in the central control unit. 051 same module. A suitable realization solution is to use separate microcontrollers such as both the control unit 2 and the breed / control unit 4.

The drive devices 3 again control drive devices, and a drive device 3 can be, for example, a valve or a relay. The drive device can be, for example, a pump, a motor and / or a cylinder. In one application, the actuator 3 is a valve of a hydraulic circuit with which the flow of a pressure medium is adjusted.

In the application shown in Figure 1, the control system also comprises spare drive unit 5. The spare drive unit 5 is connected to the spare control unit 4.

The spare drives 5 can be controlled with the spare control unit 4, preferably even when it is not possible to control the drives 3.

The condition of the actuators 3 and the spare actuators 5 can be monitored, for example, by electrically controlled valves by monitoring the current, whereby it is possible to identify e.g. short circuits, interruptions of the circuit and deviations between the setpoint and the measured value.

Figure 2 shows another embodiment. In this application, the control unit 2 has a modular construction. In the example, the control unit 2 comprises a main control module 6 and a device control module 7. There may also be olika your different control modules. For example, individual device control modules 7 may be located close to drive devices 3 and / or drive devices in the work machine. The modules 6, 7 are connected to each other by means of a suitable communication solution, such as for example a CAN bus 8. In the example, the CAN bus 8 connects the main control module 6 of the control unit 2 and the device control module 6 and the reserve control unit 4. The reserve control unit 4 can also consist of fl your modules.

The function and condition of the control units 2, 4 and the various control modules 6, 7 are observed, for example, by monitoring their inputs (voltage inputs) and / or outputs, whereby possible deviations in these values can be interpreted as errors. The monitoring of the function of the units 2, 4 and the modules 6, 7 can be realized, for example, so that the function of the units and modules is monitored through one or andra your other units and / or modules. 10 15 20 25 30 35 533 051 Figure 2 also shows a certified actuator 1. In one application, the actuator 1 comprises a hall sensor or a potentiometer with at least three independent adjustment groups, which adjustment groups have their own voltage inputs and outputs. In the solution according to fi guren, the voltage input to two adjustment groups from the control unit 2 and the voltage input to an adjustment group from the reserve control unit 4. The outputs of all adjustment groups are in the example connected to both the control unit 2 and the reserve control unit 4. The position of the certified actuator 1 can be determined, even if some of the adjustment groups are damaged. The connection shown also enables the function, even though the voltage supply from the control unit 2 or from the reserve control unit 4 would be interrupted. In a normal situation, control data of the certified actuator 1 can be concluded, for example, from the intermediate value between outputs of two or three adjustment groups. Control data can also be concluded with another formula, whereby it is possible, for example, to place more weight on one adjustment group than another. By monitoring the voltage inputs and outputs of the adjustment groups, it is possible to check whether their values are within a permitted range. When values are within the allowable range, it is assumed that the adjustment group is in order. If the value of the voltage input and / or the output of an adjustment group is not within the allowable range, it can be assumed that such an adjustment group or any other circuit affecting it has been damaged. Such an adjustment group can be disregarded when determining control data. Control data is preferably determined according to values of the adjustment groups whose values are within the permitted range.

The maneuvering system of a work machine presented above can be used in various ways. In an application, fault conditions are classified into three classes according to it, how they affect safety and usability and how quickly one must react to them. The control system identifies various faults and / or damages, on the basis of which the control system changes the operating condition. We will now describe the classes of fault conditions, the tent types and the function conditions in an application. In the example, the tent states are divided into three classes, there are six error types and four function states. 10 15 20 25 30 35 533 064 In the application according to the example, the fault conditions are divided into three classes. Faults of the first class are classified faults for which the work machine loses its ability to function safely, and thus faults of the first class presuppose a rapid interruption of the function. Faults of the first class can be, for example, scarcity of fluid in the hydraulic system, simultaneous faults in the control unit 2 and in the spare control unit 4, as well as various engine faults.

Faults of the second class include faults for which the work machine loses its ability to function perfectly, but the work machine is still safe to use. For example, as a result of a second-class fault, the speed of the work machine may decrease. The errors of the second class presuppose that the user adapts to the changed performance, but the errors do not presuppose an immediate stop. Faults of the second class may include, for example, certain faults in the control system, in which certified functions are used in a certified state.

Defects of the third class are classified as faults, despite which the work machine can function in the required manner and safely. The errors of the third class do not presuppose that the user interrupts the function, but an error that has sounded an error alarm can be remedied in a suitable situation. The following are some types of faults that can be detected with an application of the control system. The errors can be detected and classified, for example, with the help of an error analysis. The error analysis can preferably be realized with a suitable algorithm. The error types have been divided into six groups, which groups will be used later as an aid when describing the different operating conditions of the work machine. The control system according to the example has been realized in a manner shown in Figure 2. The number of error types can deviate from the example, and errors can be detected in objects that deviate from the example. The purpose of the example is to give a picture of the error types and their impact on the function of the work machine.

Error type T1 occurs in the example when there is an error in an adjustment group of the actuator 1. For example, the input voltage of a group deviates from limit values, the output signal of a group deviates from limit values, the output signal of a group deviates from the output signals of the other 10 15 20 25 30 533 081 groups, and / or successive signal samples of a group deviate from each other more than allowed.

Fault type T2 occurs in the example when operating in the normal operating condition and in the control unit 2 or in the spare control unit 4 an error occurs which can occur in the form of any deviations in inputs and / or outputs. Also a fault in the spare driver 5 is in the example a fault of fault type T2 when operating in the normal operating state.

Error type T3 occurs in the example when there is an error in your adjustment groups of the actuator 1 when operating in the normal operating condition. For example, the output signals of two adjustment groups deviate from limit values, or successive signal samples of two adjustment groups deviate from each other more than is permitted. The faults of the function means 3 are faults of the fault type T3 when operating in the normal operating state. A fault of the device control module 7 is a fault of the fault type T3 when the spare control unit 4 is responsible for generating the control quantities.

Fault type T4 occurs in the example when operating in the first adapted function state and an error occurs in the drive unit 3. An error in fl your adjustment groups of the actuator 1 is also a fault of type fault T4 when operating in the first adapted function state. Some faults of the control unit 2 are also faults of the fault type T4, such as, for example, the discovery that the main control module 6 is not in connection with the device control module 7 when operating in the first adapted operating state.

Error type T5 occurs in the example when operating in the first adapted operating state and an error occurs in the backup control unit 4.

Error type T6 occurs in the example when an error occurs in the spare control unit 4 in the second adapted operating state. The error type T6 also occurs when the voltage inputs to the first and the second channel of the actuator 1 are outside the permitted range, ie. there is an error in the input to the control unit 1 of the control unit 2. In addition, an error in the spare drive 5 is an error of the error type T6 when operating in the first adapted operating state. 10 15 20 25 30 35 533 OEV! 10 Based on the type of fault, the control system changes the operating condition of the work machine. The operating condition can affect, for example, the operating speed of the work machine or other properties. In the example, there are four function states: the normal, the first adapted, the second adapted, and the descending. Figure 3 shows a principle, how the operating conditions in the example case are dependent on the above-mentioned error types. The number of operating conditions can also be smaller or larger. For example, there can be three modes of operation: the normal, the custom, and the downward. In the normal operating condition, the machine works normally. For example, the speed is normal. In the control system, the control unit 2 is responsible for generating the control quantities. The device control module 7 is responsible for controlling the drive units 3. The reserve control unit 4 is in a state of readiness.

The adapted function states include the first adapted function state and the second adapted function state. In an adapted operating condition, the work machine can function safely in an adapted way. You switch to the first adapted function state when, for example, error type T1 or T2 occurs. You switch to the second adapted function state when, for example, error type T3 or T4 occurs. When an error occurs, the user is given an alarm and preferably a prompt to adjust the function of the work machine, for example by reducing the speed. In one application, it is not possible to increase the speed of a work machine which is in the adapted operating state above a limit value for the adapted speed, if the speed is lower than this limit value. In a beneficial application, the speed is not automatically reduced when an error occurs, but the user is allowed to reduce the speed himself in a way that the situation allows. In a corresponding manner, the adapted functional state can be connected to devices and / or switches, whereby in the adapted functional state it is permitted to use devices and / or switches only in a limited way. In the first adapted operating state, it is the control unit 2 that is responsible for generating the control quantities in the operating system. Device control module 15 7 is responsible for controlling the actuators 3. The reserve control unit 4 is in standby mode. In the second adapted operating state, it is the reserve control unit 4 which is responsible for generating the control quantities in the operating system. The control unit 2 is again prevented due to a malfunction to function in the desired manner. In one application, the actuators 3 are controlled on the basis of the control quantities, if, for example, the device control module 7 is capable of transmitting the control quantities to the actuators. In another application, the spare drivers 5 are controlled on the basis of the control quantities, and the device control module 7 is not in use.

You switch to the downward function state when there is, for example, error type T5 or T6. In the descending operating mode, the operation of the work machine must be switched off as soon as possible. In the descending operating state, the control unit 2 (fault type T5) or the spare control unit 4 (fault type T6) is responsible for generating the control quantities. In the downward situation, the work machine may lose its ability to function safely, and therefore the situation presupposes a quick stop of the function. However, an immediate stop can be dangerous, so it is advisable to adapt the control system to allow a shutdown within a certain time. During shutdown, the work machine can, for example, be moved to a safe place and / or to a safe position.

As an example, a forestry machine is presented which comprises the maneuvering system described above. The forestry machine is controlled by an actuator 1 which is a control lever or a control lever. The control can take place, for example, in the case of a forest machine with an intermediate link by turning the front part of the forest machine relative to the rear part. The actuator 1 is secured so that it comprises at least three independent adjustment groups, which adjustment groups have their own voltage inputs and outputs.

The first adapted function state and the second adapted function state can be switched to, for example, in the error situations T1, T2, T3 and T4 described above. When an error occurs, the user is given an alarm and preferably a prompt to adjust the operation of the forestry machine, for example by reducing the speed. In one application, it is not possible to increase the speed of the forestry machine which is in the adapted operating state above a limit value for the adapted speed, if the speed is lower than this limit value. In an advantageous application, the speed is not reduced automatically when an error occurs, but the user may reduce the speed himself in a way that the situation allows. In a corresponding manner, the adapted functional state can affect the permitted driving speed with the aid of the gears, whereby in the adapted functional state it is permitted to use only certain gears.

The transition function state is switched to when there are, for example, the error types T5 or T6 described above. In the downward operating condition, the operation of the forestry machine must be switched off as soon as possible. In the declining situation, the forestry machine may lose its ability to function safely, and therefore the situation presupposes a quick stop of the function. However, an immediate stop can be dangerous, so it is advantageous to adapt the control system to allow a shutdown within a certain time. In one application, when the forestry machine switches to the downward operating state, the power and / or speed of the machine is automatically lowered to a value with which the forestry machine can still be operated in a limited way. During the shutdown, the forestry machine can, for example, be moved to a safe place and / or to a safe position.

The use of the control system is advantageous, for example, when the forestry machine is moved on a road where there is also other traffic. Thus, in the event of a fault in the control system, the operator of the forestry machine is notified of the fault and at the same time the performance of the forestry machine is reduced to a level that better corresponds to the incomplete control system (for example the damaged actuator 1, in which some adjustment groups are not in use). By allowing the forest machine to move even when it is damaged, it is possible to move the device to a safe place.

By combining the functions and structures presented above, in connection with the various embodiments of the invention, different embodiments of the invention can be achieved, which are in accordance with the spirit of the invention. Therefore, the examples presented above need not be construed to limit the invention, but the embodiments of the invention may be varied freely within the scope of the inventive features which are to be presented below.

Claims (15)

533 G61 Patent claims: Operating system for a working machine, comprising at least: - an actuator (1) for providing setpoints, - a control unit (2) for processing the setpoints obtained from the actuator (1) and for forming control quantities to be used for steering, - one or more actuators (3), characterized in that the operating system further comprises at least: - a spare control unit (4) connected to the operating device (1) and the control unit (2), and the spare control unit (4) is arranged to process those from the setpoints obtained by the actuator (1) and to form control quantities - the actuator (1) comprises at least three independent adjustment groups, which adjustment groups have their own voltage inputs and outputs which outputs are connected to the control unit (2) and the reserve control unit (4). Actuating system according to Claim 1, characterized in that the actuating system further comprises at least one or riv your spare drives (5). Operating system according to claim 1 or 2, characterized in that the control unit (2) is arranged to form control quantities from the intermediate value between outputs of two or three adjustment groups. Operating system according to one of the preceding claims, characterized in that the control unit (2) comprises at least two control modules (6, 7), which are connected to one another by a communication bus (8), the first module being connected to said actuator and the second module is connected to said one or more actuators (3). Method for controlling a work machine, wherein - setpoints are formed with an actuator (1), - the control quantities to be used for control are formed with a control unit (2) on the basis of the setpoints obtained from the actuator (1), the control variables are used to control the function of one or more actuators (3), characterized in that: - the control variables are also formed with a spare control unit (4) on the basis of the setpoints obtained from the actuator (1), and - in a normal situation setpoints are formed with at least three independent adjustment groups, which adjustment groups have their own voltage inputs and outputs, and which outputs are connected to the control unit (2) and the reserve control unit (4) - the control quantities formed by the reserve control unit (4) are used to control a drive ( 3) or a spare drive (5) when the control unit (2) is not capable of functioning properly. Method according to claim 5, characterized in that the spare drive (5) is controlled by a spare control unit (4) when the drive (3) is not capable of functioning correctly. Method according to Claim 5 or 6, characterized in that control quantities are formed from the intermediate value between outputs of two or three adjustment groups. Method according to claim 7, characterized in that the setpoint is determined by comparing values of voltage inputs and outputs of said at least three independent adjustment groups. 533 05% 15 Method according to one of the preceding claims 5-8, characterized in that the control unit (2) comprises at least two control modules (6, 7), and information is transmitted between said at least two control modules by a communication bus (8). Method according to one of the preceding claims 5 to 9, characterized in that the method further: - monitors the voltage inputs of the actuator (1), or signals from the actuator (1), or both of them, and investigates the fault in the actuator ( 1) on the basis of the monitoring, and - you select the operating condition to be used for the work machine on the basis of the investigated fault. Method according to claim 10, characterized in that the method further: - limits the speed or power of the work machine to a limit value but does not force the speed or power to decrease automatically, if it is higher than said limit value, or - limits the speed of the work machine or power to a limit value and automatically reduces the speed or power, if it is higher than the said limit value. Coupling of an actuator in the control system of a work machine, comprising: - at least a first independent adjustment group for the actuator (1), which adjustment group has its own voltage input which is connected to the control unit control unit (2) and has its own output which is connected to the control unit control unit (2), characterized in that the coupling further comprises: - a second independent adjustment group for the actuator (1), which adjustment group has its own voltage input which is connected to the control system reserve control unit (4) and has its own output which is connected to the control system control unit (2) and a spare control unit (4), and - a third independent control group of the actuator (1), which has its own voltage input and its own output connected to the control unit (2) and the reserve control unit (4). Coupling according to claim 12, characterized in that the coupling further comprises: - at least one drive device (3) which is connected to the control unit (2), and - at least one spare drive device (5) which is connected to the reserve control unit (4). Method for monitoring the condition of an actuator in a work machine, wherein: - the first adjusting group of the actuator (1) is input from the control unit (2) of the actuating system, - a signal is passed from the first adjusting group of the actuator (1) to the control unit (2), characterized in that the method further: - inputs the second adjustment group of the actuator (1) from the spare control unit (4) of the operating system, - leads a signal from the second adjusting group of the actuator (1) to the control unit (2) and the spare control unit (4), - and directs a signal from the actuator (1)'s third adjustment group to the control unit (2) and the reserve control unit (4), 533 051 lél. of monitoring. Method according to claim 14, characterized in that in the method further: - the fault of the actuator (1) is investigated on the basis of the monitoring, - on the basis of the investigated fault, either the control unit (2) or the reserve control unit (4) is selected to form said control variables for actuators (3) or spare actuators (5).