WO2020047951A1

WO2020047951A1 - Multi-level safety redundancy control system for electrified monorail system

Info

Publication number: WO2020047951A1
Application number: PCT/CN2018/110765
Authority: WO
Inventors: 楼佩煌; 郭大宏; 钱晓明; 张沪松; 张炯; 胡泊
Original assignee: 天奇自动化工程股份有限公司; 南京航空航天大学
Priority date: 2018-09-06
Filing date: 2018-10-18
Publication date: 2020-03-12
Also published as: CN109254526A; CN109254526B

Abstract

A multi- level security redundancy control system for an electrified monorail system. A task input module inputs a task instruction to a motion controller, and the motion controller generates a driving instruction according to the task instruction, and transmits the driving instruction to a driving device of an execution component; low, medium and high priority sensors respectively acquire sensing signals and transmit the sensing signals to a security processor. The security processor performs data fusion processing based on health estimation, and makes a decision according to the processing result. If it is necessary to take action on the execution component, the security processor firstly prohibits, by means of I/O signal hardware flow control, the motion controller from transmitting a driving instruction to the driving device of the execution component, and then the security processor transmits to the driving device of the execution component a control instruction corresponding to the decision that has been made. The motion controller and the security processor periodically back up parameter information about the other party; and the motion controller and the security processor are watchdogs of each other. The multi-level security redundancy control system improves system security and stability, and avoids significant personal or property loss.

Description

Multi-level safety redundant control system for hanging self-conveying trolley

Technical field

The invention belongs to the field of industrial field production transportation control, and particularly relates to a multi-level safety redundant control system for a suspension self-conveying trolley.

Background technique

Suspension self-conveying trolley, also called Electric Monorail System (EMS), is a high-tech conveying and handling control system that integrates machinery, electronics, electrical, and computer. It will be used in production, storage and other processes. The material is transported or moved on a predetermined track by a self-propelled trolley device according to a predetermined control program. Suspension self-conveying trolleys are mostly used for conveying materials at industrial sites, especially new energy automobile assembly production lines. Their operating conditions are complex, not only working at high altitudes, but also suspending automobile frames weighing more than 1000kg. Any safety accident may bring Serious life safety hazards and property damage.

New energy vehicles have large capacity changes, and their models are flexible and changeable. They are mostly upgraded from existing models. They are especially suitable for assembly and production using EMS, which is a suspension self-conveying trolley (hereinafter referred to as EMS), because the EMS production cycle is flexible and variable. In the early stage, the investment is small, and the process and production capacity can be adjusted flexibly according to the technical upgrade in the later stage.

At present, the control system of domestic EMS mostly depends on imports, and stays in a single controller to process sensor signals and task instructions. When a single processor encounters unexpected failures (such as program running, electromagnetic interference, mechanical vibration, etc.) The motor of the execution unit is still operating incorrectly, even if the probability of failure is extremely low, once it occurs, it will cause a temporary loss of control of the execution unit, which is extremely harmful to life and property.

Summary of the Invention

In order to solve the technical problems mentioned in the above background technology, the present invention aims to provide a multi-level safety redundant control system for hanging a self-conveying trolley to improve system safety and stability.

In order to achieve the above technical objective, the technical solution of the present invention is:

A multi-level safety redundant control system for a suspension self-conveying trolley includes a task input module, a motion controller, a safety processor, a low-priority sensor, a medium-priority sensor, a high-priority sensor, and a driving device for an execution component; a task; The input module inputs task instructions to the motion controller, and the motion controller generates driving instructions according to the task instructions, and transmits the driving instructions to the driving device of the execution component, and controls the execution component to perform the corresponding task; low priority sensors, medium priority sensors, and high Priority sensors collect their own sensing signals and transmit them to the security processor. The security processor first performs data fusion processing based on health assessment on the signals collected by each sensor, and makes decisions based on the processing results. Measures, the security processor first prohibits the motion controller from transmitting driving instructions to the driving device of the execution component through the I / O signal hardware flow control, and then the security processor sends the control instruction corresponding to the decision taken to the driving device of the execution component; Controller and Safety Division There is information interaction between the controllers. The motion controller and the safety processor regularly send their respective parameter information to each other, and back up each other's parameter information. When one of them fails and restarts, it can obtain the parameter information before the failure from the other; The motion controller and the security processor are watchdogs. When one of them A fails, and the other B finds that A has not sent the parameter information according to the original rules, B first disables the A pair through the hardware flow control of the I / O signal. The control of the execution unit sends an emergency stop command to the driving unit of the execution unit.

Further, the low-priority sensor includes a voltage sensor, a temperature sensor, and a humidity sensor, which are respectively used to detect a change in the input voltage of the EMS cart, and the temperature and humidity of the working environment; the medium-priority sensor includes a first vibration sensor and a remote sensor. The distance laser ranging sensor is respectively used to detect the mechanical vibration at the bottom of the EMS trolley lifting structure and the EMS trolley long-distance obstacle; the high-priority sensor includes a second vibration sensor, a short-range laser ranging sensor, and a safety edge, wherein The second vibration sensor and the short-range laser ranging sensor are respectively used to detect the mechanical vibration on the top of the lifting structure of the EMS trolley and the short-distance obstacle of the EMS trolley. The safety touch edge is a pressure-sensitive switch fixed on the edge of the forward direction of the EMS trolley. For detecting collision or squeeze signals.

Further, the decision made by the security processor according to the result of the data fusion processing includes: continued operation, alarming and feedback to the MES system or ERP system, deceleration operation, and emergency shutdown.

Further, the process of the data fusion processing based on the health assessment is as follows:

First, the signals collected by each sensor are quantified, and then the quantized signals are used to calculate the health of the EMS car according to the following formula:

In the above formula, h _j is the health degree corresponding to decision j, ε _j is the correction coefficient of decision j, δ _i is the influence factor of sensor i on health, x _i is the quantized value of the signal collected by sensor i, and f _i (x _i ) is the health of the EMS car by sensor i, and n is the total number of sensors that need to be considered for decision j;

The sensors that need to be considered for alarm and feedback to the MES system or ERP system are low-priority sensors, the sensors that need to be considered for deceleration are medium-priority sensors, and the sensors that need to be considered for emergency shutdown are high-priority sensors;

The health degree h _{j of} each decision corresponds to a pre-set alert value H _j . If the health degree h _{j is} lower than the alert value H _j , the decision is triggered; if an alarm is reported and fed back to the MES system or ERP system, the deceleration operation and If none of the three emergency stop decisions are triggered, the operation will continue.

Further, the parameter information in the information interaction between the motion controller and the security processor includes task parameters and self-running parameters in the motion controller, and various sensor acquisition parameters and self-running parameters in the security processor.

Beneficial effects brought by adopting the above technical solutions:

(1) In the present invention, the motion controller and the security processor are set to be watchdogs with each other. It is assumed that the high-security embedded controllers on the market now fail (running, electromagnetic interference, failure caused by mechanical vibration, etc.). The probability is 0.01%, then the two sides are watchdog control methods for each other, and the probability that the two parts fail at the same time and cause the execution part to lose control is 0.0001%, which is much higher than the existing single controller control safety and stability;

(2) The multi-sensor data fusion processing based on the health evaluation of the EMS car of the present invention avoids the "one-to-one" feedback of a single sensor to the processor in the past, and the "multi-to-one" feedback and multi-sensor fusion are beneficial to the processor Comprehensive calculation and evaluation of the health of the EMS, solved the dependence of the EMS on a single sensor, and greatly improved the reliability of equipment operation;

(3) In the present invention, the motion controller and the safety processor are set to back up their respective operating parameters. When one party A temporarily fails, after resetting, the other party B can send the operating parameters before A to A; assuming that A cannot After completing the self-resetting operation, maintenance personnel can also obtain various operating parameters before fault A from B. Such beneficial effects are as follows: it is convenient for maintenance personnel to obtain data before operation to troubleshoot the cause, and After externally resetting A's hardware and inputting parameters through task instructions, A can continue to complete the work before the failure without re-dispatching tasks and scheduling, saving valuable time for downtime maintenance.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a block diagram of the system composition of the present invention;

2 is a mechanical structural diagram of an EMS system in the embodiment;

3 is a distribution function diagram of the degree of health with respect to the ambient temperature in the embodiment;

FIG. 4 is a multi-sensor data fusion flowchart in the embodiment.

detailed description

The technical solution of the present invention will be described in detail below with reference to the drawings.

The present invention proposes a multi-level safety redundant control system for a suspension self-conveying trolley. As shown in FIG. 1, the system includes a task input module, a motion controller, a safety processor, a low priority sensor, a medium priority sensor, and a high priority. Drives for level sensors and actuators.

The suspension self-conveying trolley system provided in this embodiment runs on a production line for manufacturing and assembling a new energy vehicle. The mechanical structure is shown in FIG. 2. In the event of a safety accident in a production line of automobile manufacturing and assembly, in addition to the loss of products and injuries, the serious consequences of the assembly line will also affect the production cycle of the entire workshop, and production tasks will be greatly affected.

The control method proposed by the present invention includes four control strategies:

Control strategy 1: The task input module inputs task instructions to the motion controller, and the motion controller generates driving instructions according to the task instructions, and transmits the driving instructions to the driving device of the execution unit, and controls the execution unit to perform the corresponding task.

For strategy one, the MES (manufacturing enterprise production process execution system) or ERP (enterprise resource planning) system sends the motion controller to the workstations A, B, C, and D in order to complete the tooling through the industrial bus or industrial wifi, then the motion control After the processor analyzes and processes this task instruction, it sends the corresponding forward, stop, lift and other instructions to the execution motor driver in turn.

Control Strategy 2: Low-priority sensors, medium-priority sensors, and high-priority sensors collect their respective sensing signals and transmit them to the security processor. The security processor first performs data fusion based on the health assessment of the signals collected by each sensor. Process and make decisions based on the processing results. If measures are required on the execution unit, the safety processor first prohibits the motion controller from transmitting drive instructions to the drive unit of the execution unit through I / O signal hardware flow control, and then the safety processor sends The driving device of the execution unit sends a control instruction corresponding to the adopted decision.

The so-called health degree refers to the possibility of being in a safe state. For an EMS car, which is a highly integrated mechatronics device carrying many sensors and driving equipment, its safety is very important. Since its own weight is as high as hundreds of kilograms or even tons, and it belongs to high-altitude operations, if an accident occurs, the consequences must be unimaginable.

Taking the ambient temperature as an example to illustrate the impact of a single sensor (factor) on the health of the EMS car, the ideal working environment temperature of the EMS car is -20 ° C to + 40 ° C, and the health is close to 100%. Outside this range, the health has Decrease regularly. This data is determined by the actual operation test results and the ideal working environment temperature of all the components in the EMS cart components. Figure 3 is the distribution function of the equipment health degree with respect to the ambient temperature. This function is only qualitative and not an exact value. Then the working environment temperature defines the health of the EMS car as f _T (x _T ), where x _T is the quantized value of the temperature sensor output data.

The present invention considers the impact of multiple sensors (factors) on the health of the EMS cart:

In the above formula, h _j is the health degree corresponding to decision j, ε _j is the correction coefficient of decision j, δ _i is the influence factor of sensor i on health, x _i is the quantized value of the signal collected by sensor i, and f _i (x _i ) is the health of the EMS car by sensor i, and n is the total number of sensors that need to be considered for decision j.

In this embodiment, the low-priority sensor includes a voltage sensor, a temperature sensor, and a humidity sensor, which are respectively used to detect changes in the input voltage of the EMS cart, and the temperature and humidity of the working environment; the medium-priority sensor includes a first vibration sensor and Long-distance laser ranging sensors are used to detect mechanical vibration at the bottom of the EMS trolley lifting structure and long-distance obstacles of the EMS trolley, respectively; the high-priority sensor includes a second vibration sensor, a short-range laser ranging sensor, and a safety edge, The second vibration sensor and the short-range laser ranging sensor are respectively used to detect the mechanical vibration on the top of the EMS trolley lifting structure and the short-distance obstacle of the EMS trolley. The safety touch edge is a pressure-sensitive switch fixed on the edge of the forward direction of the EMS trolley. Used to detect collision or squeeze signals.

Decisions made by the security processor based on the results of the data fusion process include: continue operation, alarm and feedback to the MES system or ERP system, deceleration operation, and emergency shutdown. Deceleration operation includes deceleration of the traveling motor and deceleration of the lifting motor. The sensors that need to be considered for alarm and feedback (decision) to the MES system or ERP system are low priority sensors, the sensors that need to be considered for deceleration operation (decision) are medium priority sensors, and the sensors that need to be considered for emergency stop (decision) are high Priority sensor. The health degree h _{j of} each decision corresponds to a pre-set alert value H _j . If the health degree h _{j is} lower than the alert value H _j , the decision is triggered; if an alarm is reported and fed back to the MES system or ERP system, the deceleration operation and If none of the three emergency stop decisions are triggered, the operation will continue. This process is shown in Figure 4.

Control strategy three: There is information interaction between the motion controller and the safety processor. The motion controller and the safety processor regularly send their respective parameter information to each other and back up each other's parameter information. When one of them fails and restarts, it can Obtain the parameter information before the fault from the other party.

The motion controller and the safety processor periodically send each other's operating state parameters and peripheral device parameters, including the command input for the task, the parameters of the motion motor, and the parameters of each sensor, etc., according to the agreed protocol. Such beneficial effects are: 1. If one party fails, the hardware is reset and restarted quickly, and then the other party transfers the pre-failure data to it, and it can quickly connect to the production cycle; 2. In the case of 1, if the hardware cannot be reset, Is the controller failure caused by vibration or electromagnetic interference, then after the shutdown, maintenance personnel can obtain data from the other party to determine what caused the failure, import the data after the fault is removed, and can continue to maintain the original production Beat and continue production.

Control strategy four: The motion controller and the security processor are watchdogs. When one of the A fails and the other B finds that A has not sent the parameter information according to the original rules, B first passes the I / O signal hardware flow. The control prohibits A from controlling the execution unit, and then sends an emergency stop instruction to the driving unit of the execution unit.

The so-called watchdogs, that is, A receives B's data at an agreed time interval, and B receives A's data at an agreed time interval. When a party (assuming it is A) does not read B's information at the agreed time, then B must be Some kind of failure occurred. At this time, for the security of the system, A immediately failed the communication port of B through hardware flow control. (Hardware flow control does not need to go through the user program accordingly, that is, the communication port can be enabled or disabled when the program runs.) At this time, the motor only orders to A, and then A immediately sends an emergency stop instruction to the actuator drive unit to ensure safe stopping. This beneficial effect is: Assuming that both A and B are high-security embedded controllers, the probability of failure is 0.01%, that is, a failure occurs in 10,000 operations, although it may not be necessarily in its production life cycle. A failure will occur once, but once it happens, it will cause damage to the EMS and suspended cars and injury to people, and it will also interrupt the production cycle, which will affect the production capacity and cause large economic losses. Then if A and B adopt this kind of redundant control method of watchdog each other, even if one side is faulty, the other side can immediately detect and prohibit its communication, and then stop the motor. In this way, the probability of an accident is reduced to 0.01% * 0.01% = 0.0001%, that is, the failure of both parties at the same time, which greatly improves safety and stability, which is very important for the automobile production assembly line.

The embodiments are only for explaining the technical idea of the present invention, and cannot be used to limit the protection scope of the present invention. Any modification made on the basis of the technical solution according to the technical idea proposed by the present invention falls within the protection scope of the present invention. .

Claims

A multi-level safety redundant control system for a suspension self-conveying trolley is characterized in that it includes a task input module, a motion controller, a safety processor, a low-priority sensor, a medium-priority sensor, a high-priority sensor, and an execution component. Driving device; the task input module inputs the task instruction to the motion controller, and the motion controller generates the driving instruction according to the task instruction, and transmits the driving instruction to the driving device of the execution unit to control the execution unit to perform the corresponding task; the low priority sensor, the medium priority Level sensors and high-priority sensors collect their respective sensing signals and transmit them to the security processor. The security processor first performs data fusion processing based on the health assessment of the signals collected by each sensor, and makes decisions based on the processing results. When measures are taken on the execution unit, the safety processor first prohibits the motion controller from transmitting drive instructions to the drive unit of the execution unit through I / O signal hardware flow control, and then the safety processor sends the corresponding decision to the drive unit of the execution unit. Control instruction There is information exchange between the controller and the safety processor. The motion controller and the safety processor regularly send their respective parameter information to each other and back up each other's parameter information. When one of them fails and restarts, it can obtain information from the other before the failure. The motion controller and the safety processor are watchdogs to each other. When one of the A fails and the other B finds that A has not sent the parameter information according to the original rules, B first passes the I / O signal hardware flow. The control prohibits A from controlling the execution unit, and then sends an emergency stop instruction to the driving unit of the execution unit.
The multi-level safety redundant control system for a suspension self-conveying cart according to claim 1, wherein the low-priority sensors include a voltage sensor, a temperature sensor, and a humidity sensor, respectively, for detecting changes in the input voltage of the EMS cart, The temperature and humidity of the working environment; the medium-priority sensors include a first vibration sensor and a long-distance laser ranging sensor, which are respectively used to detect the mechanical vibration at the bottom of the EMS trolley lifting structure and the long-distance obstacles of the EMS trolley; the high priority Level sensors include a second vibration sensor, a short-range laser ranging sensor, and a safety edge. The second vibration sensor and the short-range laser ranging sensor are used to detect the mechanical vibration on the top of the EMS trolley lifting structure and the EMS trolley near obstacles, respectively. , The safety touch edge is a pressure-sensitive switch fixed on the edge of the EMS trolley in the forward direction, and is used to detect a collision or squeeze signal.
The multi-level safety and redundancy control system for a self-sustaining trolley according to claim 1 or 2, characterized in that the decision made by the safety processor according to the data fusion processing result includes: continue operation, alarm and feedback to the MES system or ERP system , Decelerating operation and emergency stop.
The multi-level safety and redundant control system for a suspension self-propelled trolley according to claim 3, wherein the process of the data fusion processing based on the health assessment is as follows:

First, the signals collected by each sensor are quantified, and then the quantized signals are used to calculate the health of the EMS car according to the following formula:

In the above formula, h j is the health degree corresponding to decision j, ε j is the correction coefficient of decision j, δ i is the influence factor of sensor i on health, x i is the quantized value of the signal collected by sensor i, and f i (x i ) is the health of the EMS car by sensor i, and n is the total number of sensors that need to be considered for decision j;

The sensors that need to be considered for alarm and feedback to the MES system or ERP system are low-priority sensors, the sensors that need to be considered for deceleration are medium-priority sensors, and the sensors that need to be considered for emergency shutdown are high-priority sensors;

The health degree h j of each decision corresponds to a pre-set alert value H j . If the health degree h j is lower than the alert value H j , the decision is triggered; if an alarm is reported and fed back to the MES system or ERP system, the deceleration operation and If none of the three emergency stop decisions are triggered, the operation will continue.
The multi-level safety redundant control system for a suspension self-conveying trolley according to claim 3, characterized in that the parameter information in the information interaction between the motion controller and the safety processor includes task parameters and self-operation parameters in the motion controller and safety Each sensor in the processor collects parameters and its own operating parameters.