CN101046678A - Safety cut-off method and device for output in three-mould redundancy safety computer - Google Patents

Abstract

The invention discloses a safety shutdown method output by a triple-mode redundant safety computer. The invention mainly uses the safety shutdown condition signal output by the triple-mode redundancy safety computer to judge, and performs multiple groups of safety shutdown condition signals Vote to determine whether a safe shutdown is required. A shutdown signal is generated through a conversion circuit from a dynamic signal to a level signal, and directly controls the module to output the power supply of the safety shutdown circuit to realize a safety shutdown output. The safety shutdown method output by the triple-mode redundant safety computer is also safe.

Description

Safety shutdown method and device for output in triple-mode redundant safety computer

technical field

The invention relates to a safety shut-off method for the output of a triple-mode redundant safety computer, and is a control system for the safety output of the safety computer, especially in the fields of train operation control, nuclear power plant control, and the like, and also relates to the operation control of a maglev train.

Background technique

Triple Modular Redundancy (TMR), also known as two out of three, is currently the most commonly used fault-tolerant technology in secure computer systems. Triple-mode redundancy means that three modules with the same function perform the same operation at the same time, use the outputs of the three modules to make a large number of votes, and use most of the same outputs as the correct output of the triple-mode redundancy system. The system is based on the "minority obeys the majority" error correction principle, and is often referred to as a two-out-of-three system.

Figure a is a block diagram of the triple-mode redundancy (TMR) system. M1, M2, and M3 in the figure are three working modules with the same function, and V is an output voter.

Under normal circumstances, the results output by the three modules should be exactly the same, and V will finally output this result as the correct output of the TMR system. Under abnormal circumstances, if a module makes an error, its output will be different from the output of the other two modules. According to the principle of "the minority obeys the majority", V will still output the correct result. Therefore, the logic expression of the output voter can be written: F=M ₁ M ₂ +M ₂ M ₃ +M ₁ M ₃ , it is not difficult to design a logic circuit of the voter according to this expression, as shown in Figure b shown.

It can be seen from the above logic diagram that in a three-mode redundant system, when two modules fail at the same time and produce the same error state, the output of the voter V will have an error output. In general, the reliability of each individual module in a triple-mode redundant system is very high, so the probability that two of the three modules experience transient errors at the same time is very small. However, the situation of error accumulation must be considered: that is, if an error occurs in one module, if the system does not do any processing, another module will also have an error after a period of time, and the voting output obtained by the voter V will be the wrong output, or the system Can not work normally. This shows that if a module fails in the three-mode voting system, if its output maintains the original value or other values, no matter whether it is correct or not, the system output may be unsafe. In systems with higher safety levels, erroneous output under system failure may lead to dangerous operations, resulting in serious personal injury or property damage. Therefore, in the design of the safety system, it should be ensured that the system leads to a safe output in the event of a failure as much as possible.

In view of the above situation, the present invention proposes a method for safely shutting down the output of a triple-redundant safety computer, so that the output of the safety computer system is directed to the safety side in the event of a failure.

Contents of the invention

The purpose of the present invention is to solve the problem of safe output of the safety computer, and propose a method and device for safely shutting down the output of the triple-mode redundant safety computer, so as to ensure that the voting output of the triple-mode redundant system does not fail even in the event of a module error. will lead to the dangerous side. This method forces the output of the module to be set to a pre-specified safe value when an error occurs. At the same time, the forced circuit itself is also safe, that is, the output of the system will not be directed to the dangerous side when a fault occurs.

In order to achieve the above object, the present invention is achieved through the following technical solutions.

A safety shutdown method output in a triple-mode redundant safety computer, comprising the following steps;

Select the safety computer output safety side step;

Steps for setting safety shutdown conditions;

The step of judging the safety shutdown condition signal;

The control module outputs a safety shutdown circuit step.

Determines the state the output should be in if the system fails. For control systems, the safe side of the output can be set to the state after the energy is released. This state is related to the shutdown logic of the output safety shutdown circuit.

Use the safety shutdown condition signal output by the three-mode redundant safety computer to judge, decide whether to shut down the output according to the corresponding principle, and realize the safety shutdown output by directly controlling the power supply of the safety shutdown circuit output by the module.

Each module of the triple-mode redundant safety computer outputs 3 sets of conditional signals for safe shutdown, and the judgment of whether it is safe to shutdown adopts the principle of "it must be shut down if it thinks it is wrong, or it must be shut down if the other two modules think it is wrong".

The three-mode redundant safety computer realizes the safety shutdown output by directly controlling the power supply of the module output safety shutdown circuit, and adopts a series-parallel structure or a parallel structure to improve the safety and reliability of the shutdown circuit.

The conversion of the dynamic signal output by the triple-mode redundant safety computer to the level signal is realized by a digital logic counter circuit.

The safety shutdown method for the output in the triple-mode redundant safety computer and the safety output circuit of the device adopt the methods shown in Figs. 6-9.

Beneficial effects of the present invention: the application of the present invention can lead the output of the safety computer to the safety side when the safety computer breaks down, thereby improving the reliability and safety of the safety computer and avoiding the life and death that may be caused by the failure of the safety computer loss of property. At the same time, the invention also has a wide application range, and can be extended to other multi-mode redundant safety computers to improve the safety of output.

Description of drawings

Fig. 1 is the schematic diagram of the safety shutdown method of triple-mode redundant safety computer;

Figure 1a is a functional block diagram of a triple-mode redundant (TMR) system;

Figure 1b is a logical diagram of two out of three voting;

Figure 2 is a schematic diagram of the power supply control of the safety shutdown circuit;

Fig. 3 is the synthesizing method of multiple output safety shutdown condition level signals;

Fig. 4 is the conversion circuit of digital dynamic signal to level signal;

Fig. 5 is the conversion circuit of analog dynamic signal to level signal;

Fig. 6 is safety output logic circuit one;

Fig. 7 is safety output logic circuit two;

Fig. 8 is safety output logic circuit three;

Figure 9 is the safety output logic circuit four.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Embodiment 1;

(1) Select the safety side of the output

The first step is to determine the state the output should be in when the system fails. For control systems, the safe side of the output can be set to the state after the energy is released. In a triple-mode redundant system, ground (logic "0") is selected as the output safety side. This selection is very important as it relates to the shutdown logic of the output safety shutdown circuit. That is to say, the output safety shutdown circuit described later is based on the precondition that logic "0" is the output safety side.

(2) Conditions for output safety shutdown

In the triple-mode redundant safety computer, three groups of conditional signals for outputting safety shutdown are set for the three modules, one of which represents the judgment of the module on its own working state, and the other two represent the module’s response to the other two groups of modules. Judgment of working status. In this way, a total of 9 groups of output safety shutdown condition signals are obtained, namely: module M ₁ outputs 3 groups of output safety shutdown condition signals GD _AA , GD _AN , GD _AC ; module M ₂ outputs 3 groups of output safety shutdown condition signals GD _BB , GD _BA , GD _BC ; module M ₃ outputs 3 groups of output safety shutdown condition signals GD _CC , GD _CA , GD _CN .

For each module, use the above three groups of output safety shutdown condition signals to control the power supply of its safety shutdown circuit. When the module fails or the other two modules consider it to be faulty, it will cut off the power supply of its safety shutdown circuit, and its output will lead to a safe "0" level. In this way, it can be avoided that when the module fails, its output maintains an erroneous state, thereby causing potential safety hazards.

The logical expression of the power supply of the control module safely shutting down the circuit is: GD _XX (GD _XY +GD _XZ ), where X, Y, and Z represent A, B, and C, respectively. The meaning of this expression is: if the module thinks that it has an error, it must turn off the output; or if the other two modules think that this module has an error, it must also turn off the output.

(3) The structure of the power supply for the safety shutdown circuit

When controlling the power supply of each module to output the safety shutdown circuit, a relay (photoelectric, mechanical) device is used to realize the safety shutdown of the power supply. The relay device can adopt a series or series-parallel structure. Generally, a series-parallel structure or a parallel-series structure is used, so that the safety and reliability of the safety shutdown circuit are guaranteed. Of course, a simple series connection structure can also be adopted, at this time, the safety index of the safety shutdown circuit will not decrease, but the reliability index will decrease.

(4) Selection of output safety shutdown condition signal

The above 9 groups output safety shutdown condition signals, and common level signals (TTL, CMOS, etc.) can be selected. Considering reliability and safety, each group of output safety shutdown condition signals includes at least 2 level signals. Generally speaking, it is necessary to consider the influence of the number of signal lines on the complexity of the system, so each group of output safety shutdown condition signals is selected. Includes 2 or 3 level signals. When multiple level signals are used, it is necessary to consider how to synthesize multiple level signals into one module to output the power supply control signal of the safety shutdown circuit. In general, when two level signals are used, the method of two out of two is used for comparison, that is, only when the two level signals indicate that the system is working normally, the module can output the power supply for the safety shutdown circuit; when using When there are 3 level signals, two out of three is usually used for voting, that is, when there are a majority of level signals indicating that the system is working normally, the module can output the power supply for safely shutting down the circuit.

In addition, when the digital circuit fails, it will cause a solid "0" or "1" error in the level signal, but the specific "0" or "1" is not fixed, and the probability of occurrence is roughly the same. Therefore, no matter whether "0" or "1" is used to represent a safety computer system failure, it may bring a safety hazard. However, since most of the digital circuits fail to maintain a certain fixed level, dynamic signals can be used to replace the above-mentioned level signals (TTL, CMOS, etc.) as a sign that the security computer system is working normally. Here, the dynamic signal refers to the signal whose high and low levels alternately flip, which can be distinguished from the output signal solid "0" or solid "1" error caused by the failure of the digital circuit, so the dynamic signal itself is safe.

Of course, the dynamic signal itself cannot directly control components such as relays, and the dynamic signal cannot be used to directly turn off the power supply of the safety shutdown signal. Therefore dynamic signal to level signal conversion must be done. The conversion from dynamic signal to level signal can adopt traditional analog method or digital circuit conversion method. Among them, the use of digital circuits for conversion can flexibly set the overflow time, which has higher flexibility.

(5) Safety output logic circuit

The safety output logic can be implemented in many ways, but it must be ensured that: when the module is working normally, the power supply of the output safety shutdown circuit is normal, and the module outputs normal logic. Once the module is not working properly, the power supply of the output safety shutdown circuit is disconnected, and its output must be directed to the safe side: 0 level (ground).

Embodiment 2;

Fig. 1 exemplarily shows the principle of the safety shutdown method of the triple-mode redundant safety computer, and the block diagrams of each part will introduce the specific implementation in detail later.

The principle of power supply control of the safety shutdown circuit that controls the output of each module is shown in Figure 2(a)(b), which exemplarily shows the safety shutdown logic of the output power supply. The part to be turned off uses a relay (photoelectric, mechanical). The safety shutdown logic can adopt a serial-parallel structure or a parallel-serial structure, so that the safety and reliability of the system are guaranteed. At the same time, the safety shutdown logic can also be simplified to the circuit shown in Figure 2(c), at this time the safety index will not decrease, but the reliability index will decrease.

FIG. 3 shows a method for synthesizing multiple output safety shutdown condition signals into one output safety shutdown circuit power supply control signal. When each group of output safety shutdown condition signals are 2-level signals, they can be combined in parallel ("or" logic) into one module to output the safety shutdown circuit power supply control signal, that is, as long as one condition signal is valid, Then the output control signal is valid, as shown in Figure 3(a); when each group of output safety shutdown condition signals is a 3-level signal, it can be synthesized into a module output safety shutdown circuit power supply by using a 2 out of 3 voting method The power control signal, that is, the output control signal is valid only when most conditional signals are valid, as shown in Figure 3(b).

The most important characteristic of safety computer is fault-oriented safety, so the fault diagnosis signal given in safety computer is a dynamic signal logic with safety side. Figure 5 shows an analog circuit implementation method for converting dynamic signals into level signals. Wherein, the dynamic signal is a signal whose high and low levels are flipped alternately. In the figure, DTOUTA1 is the dynamic signal input end, and TJA1 is the level signal output end.

When the working state of the security computer is normal, DTOUTA1 is a dynamic flip signal. When DTOUTA1 is in the half cycle of the low level, the emitter voltage of the transistor N7 is 0, and the transistor is cut off, so the terminal TJ01 is in the high level. At this time, the emitter of the transistor N1 is forward-biased, the transistor N1 is turned on, the emitter voltage of the transistor P1 is about 0, and the transistor P1 is turned off. When the transistor N1 is turned on and the transistor P1 is turned off, the power supply will charge the capacitor E4 through the loop of N1, E4, and D29, so that the capacitor E4 can store energy. At the same time, if the capacitor E5 is in an energy storage state before, the capacitor E5 will release energy through the load of the subsequent stage.

When DTOUTA1 is in the half cycle of the high level, the emitter of the transistor N7 is forward biased, and the transistor N7 is turned on, so the terminal TJ01 is in the low level. According to the foregoing, at this time, the capacitor E4 stores energy, and TJ02 is at a high level, so the emitter of the transistor N1 is reverse-biased, the transistor N1 is cut off, the emitter of the transistor P1 is forward-biased, and the transistor P1 is turned on. Transistor N1 is turned off and triode P1 is turned on to make capacitor E4 charge capacitor E5 through the circuit of P1, E5 and D28, so that capacitor E5 stores energy, and capacitor E4 releases energy at the same time.

To sum up, when DTOUTA1 is a dynamic flip signal, the circuit is in the state of alternately charging and discharging capacitors E4 and E5, so that TJA1 maintains a negative voltage. And if the safety computer works abnormally, that is, when the input signal is a fixed level signal, or when a certain component in the circuit is abnormal (short circuit or open circuit), the capacitors E4 and E5 cannot be charged and discharged alternately, so that the output level is fixed at 0. flat.

The conversion from dynamic signal to level signal can also be realized by means of digital logic, as shown in Figure 4. First use a counter to count, and then use a rising edge and falling edge extraction circuit to convert each rising edge and falling edge of the dynamic signal into a short pulse signal, and use it as an asynchronous reset signal for the counter. In addition, using a simple AND or logic and a latch, the circuit outputs a low level when it counts to a certain value, and the rest outputs a high level. Under normal circumstances, the dynamic signal remains inverted, and the rising edge and falling edge extraction circuit uniformly transforms the rising edge or falling edge into a short pulse signal, that is, uniformly transforms it into a falling edge. The falling edge resets the counter asynchronously, so that the counter will be reset every once in a while, and the count value will never exceed the set overflow time. When the safety computer is abnormal, that is, the dynamic signal stops flipping. At this time, the asynchronous reset of the counter is always invalid, and the counter will keep counting up. Once the counter value reaches the value specified in advance, the AND or logic circuit will output to the latch. The latch signal makes the latch output low. In this way, when the dynamic signal is invalid, the circuit output leads to the safe side-zero level, so that the power supply of the output safety shutdown circuit is disconnected, and the purpose of fault-oriented safety is achieved. When the dynamic signal returns to normal, a falling edge will be generated to set the latch, so that the circuit continues to work in the normal state.

The circuit can flexibly set the threshold value of dynamic signal inversion, that is, it can be set how long the dynamic signal is considered invalid if there is no inversion. By designing the AND or logic, it is possible to determine how much the counter counts to generate a latch signal. In addition, the circuit can generate two output signals, and compare the two signals with the principle of two out of two, which can improve the safety of the circuit. When two output signals are generated, the other dynamic signal can be reversed and then input to the circuit that converts the same dynamic signal into a level signal, or the counter of the other can be counted down, so that the circuit has a dual-rail output function, and at the same time It also further improves the safety of the circuit.

The logic of the safety output can be realized by using the following four circuits, as shown in Figure 6; the resistor R1 is connected to the base of the transistor N2, the collector of the transistor N2 is connected to one end of the resistor R2 and the resistor R3, and the other end of the resistor R3 is connected to the base of the transistor P2 , The emitter of the transistor P2 is connected to the resistor R2 and the controlled power supply; the collector of the transistor P2 is connected to the resistor R4 and the output; the emitter of the transistor N2 is connected to one end of the resistor R4 and the ground.

As shown in Figure 7; the input is connected to one end 1 of the optocoupler UA, one end 2 of the optocoupler UA is connected to the resistor R5, and the other end 16 of the optocoupler UA is connected to the control power supply; the other end 15 of the optocoupler UA is connected to the output and The resistor R6, the resistor R5 and the other end of the resistor R5 are grounded.

As shown in Figure 8; the input is connected to the resistor R7 and then the base of the triode N3, the emitter of the triode N3 is connected to the resistor R8 and the output; the collector of the triode N3 is connected to the control power supply; the other end of the resistor R8 is grounded.

As shown in Figure 9; the input is connected to the resistor R9 and then the base of the triode P3, the collector of the triode P3 is connected to the resistor R10 and the output; the emitter of the triode P3 is controlled by the power supply; the other end of the resistor R10 is grounded.

Their common feature is: when the safety computer is working normally, the power supply of the output safety shutdown circuit is normal, and the module outputs normal logic. Once the safety computer works abnormally, according to the above-mentioned implementation method, the power supply of the output safety shutdown circuit can be disconnected, and at this time, the output must lead to the safety side-0 level (ground). In addition, because the methods of these four circuit output safety shutdowns are to directly cut off the power supply, even if the components in the circuit fail (regardless of short-circuit or open-circuit failure), their output will be directed to the safe side - 0 power supply. level, so the four circuits themselves are also fail-safe.

Claims (9)

1. the safety cut-off method of exporting in the three-mould redundancy safety computer is characterized in that:

May further comprise the steps;

Select the side step of fail-safe computer output safety rapid;

Set safe shutdown condition step;

The safe shutdown conditioned signal carries out determining step;

Control module output safety breaking circuit step.

2. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1, it is characterized in that: safe shutdown condition step, judge whether safe shutdown adopt " self thinking makes mistakes then must turn-off, perhaps other two module think to make mistakes then must turn-off " method.

3. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1, it is characterized in that: the control module output safety breaking circuit of control module output safety breaking circuit step adopts string and structure or and string structure, the directly power supply of control module output safety breaking circuit.

4. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1 is characterized in that: the Dynamic Signal of control module output safety breaking circuit step is realized by the counter circuit of Digital Logic to the conversion of level signal.

5. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1, it is characterized in that: control module output safety breaking circuit step is; At first utilize a counter to count, utilize a rising edge and negative edge to extract circuit then, the pulse signal that each rising edge and the negative edge of Dynamic Signal all is converted to a weak point, and as the asynchronous reset signal of counter, in addition, utilize one simple with or logic and latch, make circuit output low level when counting down to certain numerical value, all the other export high level, under the normal condition, Dynamic Signal keeps upset, rising edge and negative edge extract the pulse signal that circuit is transformed to rising edge or negative edge unification a weak point, i.e. unification is transformed to a negative edge, this negative edge carries out asynchronous reset to counter, counter will be reset at set intervals like this, when fail-safe computer occurs when unusual, be that Dynamic Signal stops upset, the asynchronous reset of this hour counter is invalid all the time, the counter counting that will always make progress, after in case counter values reaches the numerical value of prior appointment, with or logical circuit will be to latch output latch signal, make the latch output low level, like this, when Dynamic Signal was invalid, circuit export orientation secure side-zero level was disconnected output safety breaking circuit power supply, when Dynamic Signal recovers just often, produce a negative edge latch is carried out set.

6. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1 is characterized in that: the circuit that control module output safety breaking circuit step adopts is; Resistance (R1) connects triode (N2) base stage, an end of triode (N2) collector connecting resistance (R2) and resistance (R3), another termination triode (P2) base stage of resistance (R3), triode (P2) emitter connecting resistance (R2) and controlled source; Triode (P2) collector connecting resistance (R4) and output; One end of triode (N2) emitter connecting resistance (R4) and ground.

7. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1 is characterized in that: the circuit that control module output safety breaking circuit step adopts is; Input connects an end (1) of photoelectrical coupler (UA), and an end (2) connecting resistance (R5) of photoelectrical coupler (UA), the other end (16) of photoelectrical coupler (UA) are accepted the control power supply; The other end (15) of photoelectrical coupler (UA) connects output and resistance (R6), the other end ground connection of resistance (R5) and resistance (R5).

8. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1 is characterized in that: the circuit that control module output safety breaking circuit step adopts is; Connect triode (N3) base stage behind the input connecting resistance (R7), triode (N3) emitter connecting resistance (R8) and output; Triode (N3) collector is accepted the control power supply; The other end ground connection of resistance (R8).

9. the safety cut-off method of a kind of three-mould redundancy safety computer output according to claim 1 is characterized in that: the circuit that control module output safety breaking circuit step adopts is; Connect triode (P3) base stage behind the input connecting resistance (R9), triode (P3) collector connecting resistance (R10) and output; Triode (P3) emitter is accepted the control power supply; The other end ground connection of resistance (R10).

Images