CN219838566U - Safety output control circuit, electronic device and vehicle - Google Patents

Abstract

A safe output control circuit, an electronic device and a vehicle are provided, and the circuit comprises: a control unit; a watchdog circuit; the first voltage input end of the power module circuit is electrically connected with the first voltage output end of the watchdog circuit, and the power module circuit is used for converting the first power voltage into the second power voltage and outputting the second power voltage through the second voltage output end; the second voltage input end of the output circuit is electrically connected with the second voltage output end of the power module circuit; the control unit is further electrically connected to the signal input end of the power module circuit, and is configured to send a first control signal or a second control signal to the power module circuit, and the power module circuit is further configured to output a second power supply voltage to the output circuit through the second voltage output end when receiving the first control signal, or the power module circuit is further configured to disconnect the first voltage input end from the second voltage output end when receiving the second control signal. The circuit can disconnect output when multiple faults occur, and safety redundancy is increased.

Description

Safety output control circuit, electronic device and vehicle

Technical Field

The utility model relates to the technical field of fault safety, in particular to a safety output control circuit, an electronic device and a vehicle.

Background

The rail transit safety output control circuit is an interface circuit with higher safety level, because the interface circuit is directly related to the safety of rail transit and the life and property safety of the public. To ensure the safety of the output circuit, a reliable technical scheme and a reasonable system architecture are generally adopted. In designing a system architecture, the security side of the system is generally defined, where the side of the system that has no output is generally defined as the security side. For example, during operation of the vehicle, when a system failure is detected, the system is directed to the safety side and output of the system to the safety side is ensured to be disconnected.

In the current circuit design, the power supply of an output circuit is controlled by a watchdog, and the watchdog is a monitoring unit for ensuring the safety of a rail transit system, ensures the normal operation of the system by periodically checking the state of the system, and can perform corresponding treatment in time when faults occur. However, in such a control manner, the watchdog may have a failure risk, and at this time, the watchdog cannot disconnect the power supply of the output circuit, and when the dynamic signal for controlling the safety output also fails, the system cannot normally disconnect the output of the safety output control circuit, so that the system has a safety risk under the condition of multiple failures.

There is a need for an improved safety output control circuit, an electronic device, and a vehicle, which at least partially solve the above-mentioned problems.

Disclosure of Invention

The present utility model has been made to solve the above-described problems. The utility model provides a safe output control circuit, comprising: the control unit is used for sending a first feeding dog signal or a second feeding dog signal; the watchdog circuit is electrically connected with the control unit and is used for outputting a first power supply voltage through a first voltage output end when receiving the first feeding signal, and the watchdog circuit is used for controlling the power supply to be disconnected with the first voltage output end when receiving the second feeding signal sent by the control unit; the first voltage input end of the power supply module circuit is electrically connected with the first voltage output end of the watchdog circuit, and the power supply module circuit is used for converting the first power supply voltage into a second power supply voltage and outputting the second power supply voltage through the second voltage output end; the second voltage input end of the output circuit is electrically connected with the second voltage output end of the power supply module circuit; the control unit is further electrically connected to the signal input end of the power module circuit, and is configured to send a first control signal or a second control signal to the power module circuit, and the power module circuit is further configured to output the second power supply voltage to the output circuit through the second voltage output end when receiving the first control signal, or the power module circuit is further configured to disconnect the first voltage input end from the second voltage output end when receiving the second control signal.

The watchdog circuit further comprises a watchdog unit and a relay, wherein the watchdog unit is electrically connected with the relay, the power supply is connected with the first voltage output end through the relay, the watchdog unit is used for controlling the relay to enable a passage to be formed between the power supply and the first voltage output end when the first dog feeding signal is received, or controlling the relay to enable a circuit to be broken between the power supply and the first voltage output end when the second dog feeding signal sent by the control unit is received.

Illustratively, the relay comprises a safety relay comprising a relay coil, at least one pair of normally open nodes and at least one pair of normally closed nodes, and the output end of the watchdog unit is connected with the relay coil to form a loop.

The watchdog circuit further comprises a first stoping circuit, the control unit is electrically connected with a normally closed node of the relay through the first stoping circuit, the first stoping circuit is used for collecting a switching state signal of the normally closed node and sending the switching state signal of the normally closed node to the control unit, and the control unit is used for sending the second control signal to the power module circuit when the switching state of the normally closed node is inconsistent with a logic state.

The output circuit comprises an output unit, which comprises a first input terminal, a second input terminal and a third input terminal, wherein the third input terminal is used as the second voltage input terminal, and the first input terminal and the second input terminal are respectively connected with the control unit.

The output circuit further comprises a second stoping circuit, the control unit is electrically connected with the output end of the output unit through the second stoping circuit, and the control unit is used for receiving the output state signal of the output unit acquired by the second stoping circuit and sending the second feeding dog signal to the watchdog circuit when the output state signal is inconsistent with a logic state.

The output unit includes a safety and gate, where the safety and gate includes an and gate and a switch circuit, a first input end and a second input end of the and gate are connected to a first output end and a second output end of the control unit, an output end of the and gate is connected to a control end of the switch circuit, an input end of the switch circuit is connected to a second voltage output end of the power module circuit, and an output end of the switch circuit is used as a voltage output end of the output circuit.

Illustratively, the output unit receives a first dynamic pulse signal sent by the control unit through the first input terminal; the output unit receives a second dynamic pulse signal sent by the control unit through the second input end; when the output unit receives the first dynamic pulse signal and the second dynamic pulse signal, and the power module circuit provides the second power voltage for the output unit, the output unit is a passage, otherwise, the output unit is a circuit breaker.

The utility model also provides an electronic device comprising the safety output control circuit.

The utility model also provides a vehicle comprising a safety output control circuit or an electronic device as described in any one of the preceding claims.

The safety output control circuit comprises a power supply module circuit, wherein the power supply module circuit is controlled by a control unit, and when a watchdog circuit positioned at the front stage of the power supply module circuit fails (for example, a relay in the watchdog circuit is stuck at a node and cannot break the output voltage), the system can break the power supply to the output circuit by controlling the power supply module circuit. The utility model solves the potential risk caused by the faults of the watchdog circuit by adding the power supply module circuit to construct the safe output control circuit with double output and double break, improves the safety and reliability of the system under multiple faults, reduces the accident risk, increases the safe redundancy of the system, can effectively disconnect the output signal of the system, and ensures that the system can be reliably maintained in a safe state.

Drawings

The above and other objects, features and advantages of the present utility model will become more apparent from the following more particular description of embodiments of the present utility model, as illustrated in the accompanying drawings. The accompanying drawings are included to provide a further understanding of embodiments of the utility model and are incorporated in and constitute a part of this specification, illustrate the utility model and together with the embodiments of the utility model, and not constitute a limitation to the utility model. In the drawings, like reference numerals generally refer to like parts or steps.

FIG. 1 shows a schematic block diagram of a prior art safety output control circuit;

FIG. 2 shows a schematic circuit diagram of a watchdog circuit in a prior art safety output control circuit;

FIG. 3 shows a schematic block diagram of a secure output control circuit according to an embodiment of the utility model;

FIG. 4 shows a schematic circuit diagram of a watchdog circuit in a secure output control circuit according to an embodiment of the present utility model;

FIG. 5 shows a schematic circuit diagram of a power module circuit in a secure output control circuit according to an embodiment of the utility model;

fig. 6 shows a schematic circuit diagram of an output circuit in a safety output control circuit according to an embodiment of the utility model.

In the drawings:

a safety output control circuit 100, a safety AND gate 110;

a watchdog circuit 200, a watchdog unit 210, a relay 220;

the safety output control circuit 300, the control unit 310, the watchdog circuit 320, the watchdog unit 321, the safety relay 322, the power module circuit 330 and the output circuit 340.

Detailed Description

In order to make the objects, technical solutions and advantages of the present utility model more apparent, exemplary embodiments according to the present utility model will be described in detail with reference to the accompanying drawings. It should be apparent that the described embodiments are only some embodiments of the present utility model and not all embodiments of the present utility model, and it should be understood that the present utility model is not limited by the example embodiments described herein. Based on the embodiments of the utility model described in the present application, all other embodiments that a person skilled in the art would have without inventive effort shall fall within the scope of the utility model.

In the prior art circuit design, the safety output control circuit 100 generally adopts a safety and gate in the field of fail-safe technology, as shown in fig. 1, the safety and gate 110 generates a dc voltage to drive a load circuit located at the rear stage of the safety and gate 110 under the driving of two paths of dynamic pulses CH1 and CH2. Meanwhile, the system can back the output state of the safety AND gate 110, and when the output state is inconsistent with the back state, the system can release two paths of driving signals of the safety AND gate 110 and disconnect the output OUT of the safety AND gate 110.

The power wd_vdd of the safety and gate 110 is also controlled by the watchdog circuit 200 of the preceding stage of the safety and gate 110, which is a monitoring circuit for ensuring the safety of the rail transit system, ensuring the normal operation of the system by periodically checking the state of the system, and performing corresponding processing in time when a fault occurs.

Specifically, as shown in fig. 2, the watchdog circuit 200 controls the electrical connection of the output circuit to the power supply by controlling the on and off of the relay 220. When the dog feeding signal is abnormal, the watchdog unit 210 releases control on the relay 220, the normally open node of the relay 220 is restored to the normally open state, the watchdog circuit 200 breaks the electrical connection between the output circuit and the power supply, the safety AND gate of the output circuit loses power, and at the moment, all loads at the later stage of the output circuit are disconnected from the electrical connection with the power supply.

However, in the above control manner, there may be a risk of node adhesion in the relay 220 in the watchdog circuit 200, at this time, the watchdog circuit 200 cannot disconnect the electrical connection between the output circuit and the power supply, and when two dynamic signals driving the safety and gate fail at the same time (for example, the failure includes two dynamic pulses not being controlled by the system and always output), at this time, the system can obtain the current output state of the output circuit through the stoping circuit, but the system cannot disconnect the electrical connection between the output circuit and the power supply normally at present, so that the system cannot disconnect the output to the safety side and there is a system risk under such multiple failures.

In view of the above technical problems, the present utility model provides a safety output control circuit, which can effectively disconnect the output of a system by using a safety output control circuit based on output double-break when multiple faults occur in the system, guide the system to the safety side, disconnect the output to the safety side, so that the system can be reliably maintained in a safety state, and increase the safety redundancy of the system.

The safety output control circuit provided by the present utility model is described in further detail below with reference to fig. 3 to 6, wherein fig. 3 shows a schematic block diagram of the safety output control circuit according to an embodiment of the present utility model; FIG. 4 shows a schematic circuit diagram of a watchdog circuit in a secure output control circuit according to an embodiment of the present utility model; FIG. 5 shows a schematic circuit diagram of a power module circuit in a secure output control circuit according to an embodiment of the utility model; fig. 6 shows a schematic circuit diagram of an output circuit in a safety output control circuit according to an embodiment of the utility model.

In one embodiment, as shown in fig. 3, the secure output control circuit 300 includes a control unit 310, and the control unit 310 may be a micro control unit (MicrocontrollerUnit, MCU), a central processor (CentralProcessingUnit, CPU), a digital signal processor (DigitalSignal Processing, DSP), a single chip and embedded device, or other form of control unit having data processing and/or instruction execution capabilities.

Further, as shown in fig. 3 and fig. 4, the safety output control circuit 300 further includes a watchdog circuit 320, a voltage input terminal of the watchdog circuit 320 is electrically connected to a power supply, for example, a 24V direct current power supply DC24V, the watchdog circuit 320 is electrically connected to a control terminal of the control unit 310, for example, the watchdog circuit 320 is electrically connected to the control unit 310, so as to receive a feeding signal sent by the control unit 310, where the feeding signal may include a first feeding signal or a second feeding signal, the first feeding signal may be a correct feeding signal, and the second feeding signal may be an abnormal feeding signal, the watchdog circuit 320 is configured to output, when receiving the first feeding signal sent by the control unit 310, a first power supply voltage wd_vdd through a first voltage output terminal, and the watchdog circuit 320 is configured to control, when receiving the second feeding signal sent by the control unit 310, to be an open circuit between the power supply and the first voltage output terminal, so that the power supply is turned off for a subsequent module.

In one embodiment, as shown in fig. 4, the watchdog circuit 320 includes a watchdog unit 321, a relay, and a first extraction circuit. Illustratively, the relay may be a safety relay 322, where the safety relay 322 includes a relay coil, at least one pair of normally closed nodes, and at least one pair of normally open nodes, and an output end of the watchdog unit is electrically connected to the relay coil, where when the watchdog unit 321 receives the first watchdog feeding signal, the watchdog unit 321 controls the relay coil to be energized, the relay coil generates electromagnetic force, attracts the armature, and makes the normally open nodes close to form a conductive state, and at this time, a path is formed between the power supply and the first voltage output end of the watchdog circuit 320; when the relay coil is de-energized, the relay coil loses electromagnetic force, releases the armature, and causes the normally open node to open, forming an open circuit condition, at which time an open circuit is formed between the power supply and the first voltage output of the watchdog circuit 320. When the system works normally, the control unit sends a first feeding dog signal to the watchdog unit 321 in the watchdog circuit 320, the watchdog unit 321 receives and responds to the first feeding dog signal to output a direct-current voltage to drive the normally open node of the relay to be conducted, at this time, the first voltage output end of the watchdog circuit 320 is powered on, and the watchdog circuit 320 outputs a first power supply voltage WD_VDD.

The first recovery circuit is electrically connected with a normally closed node of the relay and the control unit, and is used for collecting a switching state signal of the normally closed node and sending the switching state signal of the normally closed node to the control unit, and the control unit is used for sending a second control signal to the power module circuit when the switching state of the normally closed node is inconsistent with the logic state, so that a circuit break is formed between a voltage input end and a voltage output end of the power module circuit, and the power supply is prevented from supplying power to the safety output circuit.

Specifically, taking the A1 end and the A2 end of a pair of normally closed contacts of the safety relay 322 as an example, the A1 end and the A2 end of the normally closed contacts are respectively connected with a control unit such as an MCU, the MCU outputs a pulse signal to the A2 end, and the recovered pulse signal is subjected to voltage detection by the MCU through the ADC port, the logic state of the safety relay 322 is determined according to the recovered pulse signal voltage, for example, the logic state of the safety relay 322 when the relay coil is turned on is made to be 1, the logic state of the relay coil when the relay coil is turned off is made to be 0, if the current logic state of the safety relay 322 is made to be 1, that is, the current state of the safety relay 322 should be the state of the relay coil being turned on, and the actual state of the safety relay 322 is described as the state of the relay coil being turned off by the MCU, because the switching state signal such as the pulse signal voltage acquired by the MCU is inconsistent with the logic state, the MCU determines that the logic state of the safety relay 322 is abnormal, the control unit sends the second control signal vdo_tt to the power supply module, and the current state of the control unit is made to be the voltage between the power supply module and the output end of the ctr, so that the current end of the power supply module is ensured to be the power supply end is turned off. It will be appreciated that the first extraction circuit may be any suitable circuit known to those skilled in the art, and that there are various implementations, and the present embodiment is not limited to the specific circuit of the first extraction circuit.

In one embodiment, the safety output control circuit 300 includes a power module circuit 330, as shown in fig. 3 and 5, a first power supply voltage wd_vdd output from the watchdog circuit 320 is used as an input voltage of the power module circuit 330, and the power module circuit 330 converts the first power supply voltage wd_vdd and outputs a second power supply voltage wd_vdd_out under the control of a first control signal vdo_batt_ctrl sent from the control unit. The power module circuit 330 is further configured to output the second power supply voltage wd_vdd_out to the and output circuit 340 through the voltage output terminal of the power module circuit 330 when receiving the first control signal vdo_batt_ctrl sent by the control unit, or the power module circuit 330 is further configured to disconnect the voltage input terminal from the voltage output terminal when receiving the second control signal vdo_batt_ctrl sent by the control unit.

In one embodiment, as shown in fig. 5, the power module circuit 330 further includes a power module unit U1 and capacitors C1, C2, C3, C4 and C5, wherein two ends of the capacitor C1 and the capacitor C2 are electrically connected in parallel to the +vin input terminal and the-Vin input terminal of the power module unit U1, two ends of the capacitor C3, the capacitor C4 and the capacitor C5 are electrically connected in parallel to the +vout output terminal and the-Vout output terminal of the power module, and the power module unit U1 further includes an input Ctrl electrically connected to the control unit, for receiving a control signal vdo_batt_ctrl output by the control unit, for example, the first control signal vdo_batt_ctrl or the second control signal vdo_batt_ctrl. The roles of the capacitors in the power module circuit 330 mainly include: the filtering function, such as connecting between the positive and negative poles of the DC output of the power module, can filter the unnecessary AC components in the DC module, and can make the DC smoother.

The power supply module circuit is a controllable power supply module circuit which can have the functions of voltage stabilization or voltage reduction and the like, and meanwhile, the safety output control circuit provided by the utility model has the function of disconnecting a power supply path to the output circuit when the watchdog circuit fails and the output circuit fails, so that the system is more stable. Further, the safety output control circuit 300 of the present utility model further includes an output circuit 340, wherein a voltage input terminal of the output circuit 340 is electrically connected to a voltage output terminal of the power module circuit, as shown in fig. 6, and the output circuit 340 includes an output unit. The output unit, for example, employs a safety AND gate in the field of fail-safe technology. The output unit (e.g., the safety and gate U2) converts the input voltage (i.e., the second power supply voltage wd_vdd_out) of the output circuit 340 into the output voltages vdo+ and VDO-of the output circuit 340 under the driving of the first dynamic pulse signal and the second dynamic pulse signal, wherein the input voltage of the output circuit 340 is from the second power supply voltage wd_vdd_out outputted by the power supply module circuit of the previous stage. And the control unit can periodically acquire the output state of the output unit through the second stoping circuit.

The output circuit comprises an output unit, the output unit comprises a first input end, a second input end and a third input end, the third input end is used as a voltage input end of the output circuit, the first input end and the second input end are respectively connected with the control unit, the output unit receives a first dynamic pulse signal sent by the control unit through the first input end, and the output unit receives a second dynamic pulse signal sent by the control unit through the second input end.

In one embodiment, the safety AND gate comprises an AND gate and a switch circuit, wherein a first input end and a second input end of the AND gate are respectively connected with a first output end and a second output end of the control unit, an output end of the AND gate is connected with a control end of the switch circuit, an input end of the switch circuit is connected with a voltage output end of the power module circuit, and an output end of the switch circuit is used as a voltage output end of the output circuit and can be used for supplying power to the load circuit. The two output ends of the control unit, such as MCU, are respectively connected with the two input ends of the AND gate, and continuously send a first dynamic pulse signal and a second dynamic pulse signal to the two input ends of the AND gate, wherein the first dynamic pulse signal and the second dynamic pulse signal respectively form CH1 and CH2. When the first dynamic pulse signal and the second dynamic pulse signal are both high-level signals, the output end of the AND gate outputs the high-level signals to control the connection between the input end and the output end of the switch circuit, otherwise, the output end of the AND gate outputs the low-level signals to control the disconnection between the input end and the output end of the switch circuit. In this embodiment, the first dynamic pulse signal and the second dynamic pulse signal are both PWM signals, and according to the characteristics of the and gate, when the two PWM signals output by the MCU are both high level signals, the output end of the and gate outputs the high level signals, and at this time, the input end of the switch circuit and the output end of the switch circuit are connected, whereas when any one of the two PWM signals output by the MCU is abnormal, the output end of the and gate outputs the low level signals, and at this time, the input end of the switch circuit and the output end of the switch circuit are disconnected. It is understood that the switching circuit may also be a switching circuit formed by a MOS transistor or a triode. The safety AND gate may also employ any suitable safety AND gate chip.

Further to determine the state of the output circuit 340, as shown in fig. 6, the output circuit 340 further includes a second extraction circuit, through which the control unit is electrically connected to the output terminal of the output unit, and when the output state signal is inconsistent with the logic state (for example, to turn off the output circuit 340, the output state signal collected through the second extraction circuit indicates that the output circuit 340 is not turned off, and indicates that the output state signal is inconsistent with the logic state), the control unit sends a second feeding signal to the watchdog circuit, and the watchdog circuit is configured to control, when the second feeding signal sent by the control unit is received, an open circuit between the power supply and the first voltage output terminal, and because the output state signal is inconsistent with the logic state, indicate that the output circuit 340 is faulty, for example, that two dynamic pulses CH1 and CH2 of the output circuit 340 are faulty, and the output circuit 340 cannot be effectively turned off, for example, the switching circuit of the safety and the gate is turned off.

For another example, when the output status signal is consistent with the logic status (e.g., the output circuit is turned on, and the output status signal is collected by the second extraction circuit and indicates that the output circuit is in an on state, the control unit sends the first watchdog signal to the watchdog circuit, and if the output circuit is to be turned off, and the output status signal collected by the second extraction circuit indicates that the output circuit is turned off, the output status signal is consistent with the logic status, at which time it may be confirmed that the power supply to the safety output portion (e.g., the load circuit) has been cut off, the control unit may not send the watchdog signal to the watchdog unit any more.

The working principle of the safety output control circuit of the utility model is as follows: after the system power-on self-test passes, the control unit sends a first feeding signal (i.e., a correct feeding signal) to the watchdog circuit and sends a first control signal vdo_batt_ctrl to the power module circuit. Under the control of the first feeding signal and the first control signal VDO_BATT_CTRL, the power supply DC24V is converted into the second power supply voltage WD_VDD_OUT through the watchdog circuit and the power supply module circuit to supply power to the output circuit, wherein the first feeding signal and the first control signal VDO_BATT_CTRL can only provide the second power supply voltage WD_VDD_OUT to the output circuit when being enabled at the same time.

In one embodiment, as shown in fig. 4, the watchdog circuit 320 includes a safety relay 322, the relay coil of the safety relay 322 being energized and the normally open node being in a closed state when the system is operating normally. When a relay fails, the failure may include a node stuck condition, which may adversely affect the safety of the system. The on state of the relay in the watchdog circuit is that a normally open node is closed, if the relay adhesion fault occurs at the moment, and under the condition that the system works normally, the control unit collects a switch state signal of the relay through the first stoping circuit, and the relay fault cannot be detected, and belongs to the system latent fault. The fault can only confirm the fault state of the relay by comparing the recovery result of the relay with the expected result when the relay driving state is overturned. Since the node of the relay has stuck at this point, the output circuit 340 cannot be disconnected from the power supply by the watchdog circuit. In the case of the above-described latent failure in which relay sticking occurs, if two dynamic pulses of the output circuit 340 also fail, such as sustained output, the existing safety control circuit cannot effectively disconnect the output circuit 340 from the circuit in the event of such multiple failures.

The safety output control circuit of the utility model can effectively solve the risks caused by various faults, and is concretely as follows: firstly, when the control unit detects that the output state of the output circuit is inconsistent with the expected result, the safety AND gate of the output circuit still keeps on state because the normally open node of the relay is adhered and multiple faults occur simultaneously in two paths of dynamic pulses, and the system cannot effectively disconnect the output circuit from the power supply. Such faults belong to latent faults of the system, and the control unit can only determine the fault state of the relay by comparing the switch state signal of the relay acquired by the second stoping circuit with the second dog feeding signal when the driving state of the relay is changed (for example, the watchdog unit receives the second dog feeding signal and turns off the relay coil).

Further, in one embodiment, when the control unit detects that the output state signal of the output circuit is inconsistent with the logic state (i.e., the output state signal is inconsistent with the expected result), the control unit first sends a second feeding signal to the watchdog circuit, so that the path between the power supply and the output end of the watchdog power supply is cut off, and then the control power supply collects the switch state signal of the relay through the first extraction circuit to determine the state of the relay. When the watchdog unit receives a second watchdog signal and the switch state signal characterizes the relay as being in an off state, it may be determined that power to the output circuit has been disconnected at this time; when the watchdog unit receives the second feeding signal and the switch state signal indicates that the relay is in a conducting state, that is, the switch state signal is inconsistent with a logic state (for example, a node of the relay may have a stuck fault at this time), the control unit sends the second control signal vdo_batt_ctrl to the power module circuit, and at this time, the control unit cuts off the output of the power module circuit through the second control signal vdo_batt_ctrl signal, thereby cutting off the power supply to the output circuit, so as to cut off the power supply to the safety output part, and keep the system in a safety state.

The utility model also provides an electronic device comprising the safety output control circuit.

The utility model also provides a vehicle comprising a safety output control circuit or the electronic device as described above.

The safety output control circuit comprises a power supply module circuit, wherein the power supply module circuit is controlled by a control unit, and when a watchdog circuit positioned at the front stage of the power supply module circuit fails (for example, a relay in the watchdog circuit is stuck at a node and cannot break the output voltage), the system can break the power supply to the output circuit by controlling the power supply module circuit. The utility model solves the potential risk caused by the faults of the watchdog circuit by adding the power supply module circuit to construct the safe output control circuit with double output and double break, improves the safety and reliability of the system under multiple faults, reduces the accident risk, increases the safe redundancy of the system, can effectively disconnect the output signal of the system, and ensures that the system can be reliably maintained in a safe state.

Although the illustrative embodiments have been described herein with reference to the accompanying drawings, it is to be understood that the above illustrative embodiments are merely illustrative and are not intended to limit the scope of the present utility model thereto. Various changes and modifications may be made therein by one of ordinary skill in the art without departing from the scope and spirit of the utility model. All such changes and modifications are intended to be included within the scope of the present utility model as set forth in the appended claims.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present utility model.

In the several embodiments provided by the present utility model, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described device embodiments are merely illustrative, e.g., the division of the elements is merely a logical functional division, and there may be additional divisions when actually implemented, e.g., multiple elements or components may be combined or integrated into another device, or some features may be omitted or not performed.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the utility model may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it should be appreciated that in order to streamline the utility model and aid in understanding one or more of the various inventive aspects, various features of the utility model are sometimes grouped together in a single embodiment, figure, or description thereof in the description of exemplary embodiments of the utility model. However, the method of the present utility model should not be construed as reflecting the following intent: i.e., the claimed utility model requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this utility model.

It will be understood by those skilled in the art that all of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or units of any method or apparatus so disclosed, may be combined in any combination, except combinations where the features are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that while some embodiments described herein include some features but not others included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the utility model and form different embodiments. For example, in the claims, any of the claimed embodiments may be used in any combination.

Various component embodiments of the utility model may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that some or all of the functions of some of the modules according to embodiments of the present utility model may be implemented in practice using a microprocessor or Digital Signal Processor (DSP). The present utility model can also be implemented as an apparatus program (e.g., a computer program and a computer program product) for performing a portion or all of the methods described herein. Such a program embodying the present utility model may be stored on a computer readable medium, or may have the form of one or more signals. Such signals may be downloaded from an internet website, provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the utility model, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The utility model may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, third, etc. do not denote any order. These words may be interpreted as names.

The foregoing description is merely illustrative of specific embodiments of the present utility model and the scope of the present utility model is not limited thereto, and any person skilled in the art can easily think about variations or substitutions within the scope of the present utility model. The protection scope of the utility model is subject to the protection scope of the claims.

Claims (10)

1. A safety output control circuit, comprising:

the control unit is used for sending a first feeding dog signal or a second feeding dog signal;

the watchdog circuit is electrically connected with the control unit and is used for outputting a first power supply voltage through a first voltage output end when receiving the first feeding signal, and the watchdog circuit is used for controlling the power supply to be disconnected with the first voltage output end when receiving the second feeding signal sent by the control unit;

the first voltage input end of the power supply module circuit is electrically connected with the first voltage output end of the watchdog circuit, and the power supply module circuit is used for converting the first power supply voltage into a second power supply voltage and outputting the second power supply voltage through the second voltage output end;

the second voltage input end of the output circuit is electrically connected with the second voltage output end of the power supply module circuit;

wherein the control unit is also electrically connected with the signal input end of the power module circuit and is used for sending a first control signal or a second control signal to the power module circuit and,

the power module circuit is further configured to output the second power supply voltage to the output circuit through the second voltage output terminal when the first control signal is received, or,

the power module circuit is further configured to cause a circuit break between the first voltage input terminal and the second voltage output terminal when the second control signal is received.

2. The safety output control circuit of claim 1, wherein the watchdog circuit further comprises a watchdog unit and a relay, the watchdog unit being electrically connected to the relay, a power supply being connected to the first voltage output via the relay,

the watchdog unit is used for controlling the relay to enable a passage to be formed between the power supply and the first voltage output end when the first dog feeding signal is received, or,

and the watchdog unit is used for controlling the relay to break the circuit between the power supply and the first voltage output end when receiving the second feeding signal sent by the control unit.

3. The safety output control circuit of claim 2, wherein the relay comprises a safety relay comprising a relay coil, at least one pair of normally open nodes, and at least one pair of normally closed nodes, and wherein the output of the watchdog unit is connected to the relay coil to form a loop.

4. The safety output control circuit according to claim 3, wherein the watchdog circuit further comprises a first extraction circuit, the control unit is electrically connected to a normally closed node of the relay through the first extraction circuit, the first extraction circuit is used for collecting a switching state signal of the normally closed node and sending the switching state signal of the normally closed node to the control unit, and the control unit is used for sending the second control signal to the power supply module circuit when the switching state of the normally closed node is inconsistent with a logic state.

5. The safety output control circuit according to claim 1, wherein the output circuit includes an output unit including a first input terminal, a second input terminal, and a third input terminal as the second voltage input terminal, the first input terminal and the second input terminal being connected to the control unit, respectively.

6. The safety output control circuit of claim 5, wherein the output circuit further comprises a second extraction circuit, the control unit is electrically connected to the output of the output unit through the second extraction circuit, the control unit is configured to receive the output status signal of the output unit collected by the second extraction circuit, and send the second feeding signal to the watchdog circuit when the output status signal is inconsistent with a logic state.

7. The safety output control circuit according to claim 5, wherein the output unit includes a safety and gate including an and gate and a switching circuit, a first input terminal and a second input terminal of the and gate are connected to the first output terminal and the second output terminal of the control unit, respectively, an output terminal of the and gate is connected to the control terminal of the switching circuit, an input terminal of the switching circuit is connected to the second voltage output terminal of the power supply module circuit, and an output terminal of the switching circuit is used as the voltage output terminal of the output circuit.

8. The safety output control circuit of claim 5, wherein,

the output unit receives a first dynamic pulse signal sent by the control unit through the first input end;

the output unit receives a second dynamic pulse signal sent by the control unit through the second input end;

when the output unit receives the first dynamic pulse signal and the second dynamic pulse signal, and the power module circuit provides the second power voltage for the output unit, the output unit is a passage, otherwise, the output unit is a circuit breaker.

9. An electronic device comprising a secure output control circuit as claimed in any one of claims 1 to 8.

10. A vehicle comprising the safety output control circuit according to any one of claims 1 to 8 or the electronic device according to claim 9.