WO2022142528A1 - 一种功能安全的开关量输出模块和诊断处理方法 - Google Patents

一种功能安全的开关量输出模块和诊断处理方法 Download PDF

Info

Publication number
WO2022142528A1
WO2022142528A1 PCT/CN2021/120686 CN2021120686W WO2022142528A1 WO 2022142528 A1 WO2022142528 A1 WO 2022142528A1 CN 2021120686 W CN2021120686 W CN 2021120686W WO 2022142528 A1 WO2022142528 A1 WO 2022142528A1
Authority
WO
WIPO (PCT)
Prior art keywords
output
circuit
switch
unit
cpu unit
Prior art date
Application number
PCT/CN2021/120686
Other languages
English (en)
French (fr)
Inventor
陆卫军
庞欣然
孙沈男
徐士斌
董良健
Original Assignee
浙江中控技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 浙江中控技术股份有限公司 filed Critical 浙江中控技术股份有限公司
Priority to JP2023513528A priority Critical patent/JP7509345B2/ja
Publication of WO2022142528A1 publication Critical patent/WO2022142528A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0208—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterized by the configuration of the monitoring system
    • G05B23/0213—Modular or universal configuration of the monitoring system, e.g. monitoring system having modules that may be combined to build monitoring program; monitoring system that can be applied to legacy systems; adaptable monitoring system; using different communication protocols
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/24—Pc safety
    • G05B2219/24065—Real time diagnostics

Definitions

  • the present application relates to the technical field of industrial automatic control, and in particular, to a functionally safe switching value output module and a diagnostic processing method.
  • the switch output control system in the industrial field is the most important input component in industrial control systems such as DCS and SIS.
  • Most of the functional safety-related switching output modules in the related art use the 2OO3 architecture, which often requires a lot of hardware to build and implement.
  • the products designed according to this architecture are generally expensive and bulky. 2OO3 architecture products have limitations when space and cost are required.
  • the 1OO2D architecture is adopted, as shown in Figure 1.
  • dual channels and dual CPUs are used to control the output and read the diagnostic data of the channel respectively.
  • the two channels in this scheme lack the necessary information exchange.
  • one of the channels fails and the output circuit cannot be turned off.
  • the CPU unit of the faulty channel cannot obtain diagnostic information and perform shutdown-oriented safety.
  • the design of two channels that are relatively independent and lack interaction has certain hidden dangers.
  • FIG. 2 The design using the 1OO1D architecture is shown in Figure 2.
  • a diagnosis unit is added on the basis of a CPU unit controlling an output unit.
  • the diagnosis unit and the output unit control a switch respectively, and the two switches are connected in series.
  • the diagnosis unit can diagnose the output unit and send information to the CPU at the same time.
  • the switch that turns off its control is safety-oriented, but if the diagnostic unit itself fails and cannot provide reliable diagnostic information to the CPU, the entire module has a safety hazard.
  • the purpose of this application is to solve the lack of interactive design of the dual output channels of the switch output module and the failure of the diagnostic unit itself to provide reliable diagnostic information to the CPU, add measures for interactive diagnostics between the two output circuits, and increase
  • the communication between the CPU and the output circuit is turned off to turn off the output, which improves the safety performance of the module, ensures the safety of the module's orientation, and reduces the development cost and product volume while satisfying functional safety.
  • a first aspect of the present application provides a functionally safe switching value output module, comprising a CPU unit, and a first output unit and a second output unit respectively coupled to the CPU unit; the CPU unit is used for sending The first output unit or the second output unit sends communication data, and outputs fault information based on the received diagnostic data fed back by the first output unit or the second output unit, thereby controlling the first output unit or the second output unit to lead to safety; the The first output unit or the second output unit at least includes a logic circuit, a drive circuit, a back-check circuit and an output switch coupled in sequence, and a power supply voltage detection circuit coupled with the drive circuit, wherein the output switch of the first output unit SW1 and the output switch SW2 of the second output unit are connected in series; the input terminal of the logic circuit inputs the communication data sent by the CPU unit, and outputs it to the drive circuit, and is used to receive the fault output of the power supply voltage detection circuit of the other output unit signal to control the communication between the CPU unit and the drive circuit;
  • the driving circuit is used for receiving and verifying the communication data sent by the CPU unit, and after the verification is passed, the output switch is controlled to open or close according to the communication data information, and the output state of the return inspection circuit and the line diagnosis information of the output switch are collected.
  • the back-check circuit is used to detect the switch output state and send it to the drive circuit;
  • the power supply voltage detection circuit is used to detect the power supply voltage of the drive circuit and send a control signal to the logic circuit of another output unit based on the detected voltage.
  • the output unit also includes a monitoring circuit coupled with the driving circuit, the monitoring circuit is used for receiving the signal output after the data verification of the driving circuit, and outputting the control signal to control the driving circuit to output the turn-on or turn-off signal, thereby Control the output switch to open or close.
  • the pulse signal is not output to the monitoring circuit, so that the monitoring circuit is controlled to output a low-level signal to the driving circuit; if the driving circuit data verification is successful, a pulse signal is sent to the monitoring circuit, Therefore, the output state of the control and monitoring circuit remains unchanged.
  • the monitoring circuit includes but is not limited to a monostable flip-flop circuit.
  • the logic circuit includes at least a logic gate chip and a logic device; the input end of the logic gate chip inputs the communication data sent by the CPU unit, and outputs the communication data converted by the logic gate chip to the drive circuit; the logic device It is used to receive the power failure signal of the drive circuit of another output unit, so as to control the on-off of the logic gate chip of this output unit.
  • the CPU unit is also used to send an internal fault signal of the CPU unit to the logic device, so as to control and disconnect the communication between the CPU unit and the driving circuit through the logic gate chip.
  • the output switch SW1 and the output switch SW2 are switches with a load current detection function.
  • the driving circuit includes but is not limited to a logic chip CPLD.
  • a second aspect of the present application provides a method for diagnosing and processing a switch output module based on functional safety, which at least includes diagnosing processing based on output switch faults, and specifically includes:
  • step S3 specifically includes:
  • the CPU unit controls the two driving circuits to turn off the outputs of the output switch SW1 and the output switch SW2 at the same time.
  • diagnosis processing method further includes diagnosis processing based on communication faults, and specifically includes: checking the communication data between the CPU unit and the driving circuit, and controlling the output of the output switch based on the communication data information after the check is passed.
  • diagnosis processing method further includes diagnosing processing based on the internal fault of the CPU unit, specifically including: sending a fault signal to the logic circuit based on the internal software or hardware fault of the CPU unit, thereby controlling the on-off of communication.
  • diagnosis processing method further includes diagnosis processing based on a power failure, specifically including: controlling the communication between the drive circuit of another output unit and the CPU unit to be closed based on the detected power failure, thereby controlling the output of the output switch.
  • the diagnostic processing method further includes diagnostic processing based on line faults, specifically including comparing the load current detected by the output switch read back by the CPU unit with a preset threshold, and controlling the output of the output switch according to the comparison result.
  • the main control CPU unit and the two output circuits constituting the 1002 structure constitute the overall structure of the 1001D of the present application. It can achieve smaller size and lower cost while ensuring functional safety to meet applications in narrow spaces or harsh environments.
  • Figure 1 is a block diagram of the functional safety digital output circuit structure of the 1OO2D architecture
  • Figure 2 is a block diagram of a functional safety switch output module with high diagnostic coverage of the 1OO1D architecture
  • Fig. 3 is a schematic diagram of 1002 architecture
  • FIG. 4 is a schematic block diagram of a functional safety switch output module according to an embodiment of the application.
  • FIG. 5 is a schematic flowchart of a method for diagnosing and processing an output switch fault in an embodiment of the present application.
  • the 1OO2 architecture consists of two parallel channels, either of which can perform a safety function. On the premise of not affecting the performance of the safety function, it can tolerate the failure of one channel, and only when both channels have a dangerous failure, will the safety function fail. Its structure is shown in Figure 3.
  • a functionally safe switching value output module described in this embodiment includes a CPU unit, and a first output unit and a second output unit respectively coupled to the CPU unit.
  • the CPU unit is configured to send communication data to the first output unit or the second output unit, and output fault information based on the received diagnostic data fed back by the first output unit or the second output unit, thereby controlling the first output unit or the second output unit Output unit guide safety.
  • the first output unit or the second output unit at least includes a logic circuit, a drive circuit, a back-check circuit and an output switch coupled in sequence, and a power supply voltage detection circuit coupled with the drive circuit, wherein the output switch of the first output unit SW1 and the output switch SW2 of the second output unit are connected in series.
  • the input terminal of the logic circuit inputs the communication data sent by the CPU unit, and outputs it to the drive circuit, and is used to receive the fault signal output by the power supply voltage detection circuit of another output unit, and control the communication between the CPU unit and the drive circuit.
  • the drive circuit is used to receive and verify the communication data sent by the CPU unit, and after the verification is passed, it controls the output switch to open or close according to the communication data information, and collects the output state of the check circuit and the line diagnosis information of the output switch;
  • the detection circuit is used to detect the switch output state and send it to the driving circuit;
  • the power supply voltage detection circuit is used to detect the power supply voltage of the driving circuit and send a control signal to the logic circuit of another output unit based on the detected voltage.
  • the first output unit includes a driving circuit 1 , a back-checking circuit 1 , a monitoring circuit 1 , a power supply voltage detection circuit 1 and an output switch SW1, one end of the output switch SW1 is coupled to +24V, the other end is connected in series with one end of the output switch SW2 of the second output unit, and the other end of the output switch SW2 is used to output the switch value and is coupled to the load.
  • the safe state of the system should be that the output state is off, and the output switches SW1 and/or SW2 need to be turned off.
  • the CPU unit transmits control data including switching quantity information to the drive circuit 1 .
  • the driving circuit 1 performs communication verification on the received control data, and if the verification is passed, the output switch SW1 is controlled to be open or closed according to the control data sent by the CPU unit.
  • the driving circuit 1 also collects the output state of the output switch SW1 through the back-checking circuit 1, and directly reads the line state fed back by the output switch SW1.
  • the output switch SW1 has its own line fault diagnosis function, and can feedback fault information to the drive circuit in case of failure.
  • the CPU unit reads the back-checking data from the drive circuit 1 in a unified manner, and can analyze it uniformly according to the back-checking data of the first output unit and the second output unit.
  • the power supply voltage detection circuit 1 sends a VCC1_Check fault signal to the logic device 2 of the second output unit, and the logic device 2 receives the VCC1_Check fault signal of the second output unit, and
  • the control logic gate chip IC2 closes the communication between the driver circuit 2 and the CPU unit, so the driver circuit 2 will not send a pulse signal to the monitoring circuit 2.
  • the monitoring circuit 2 outputs a low level signal to the driver circuit 2. Make the drive circuit 2 turn off the corresponding output switch SW2 to make the module guide safely.
  • the driving circuit is generally programmed by using a logic chip such as a CPLD to realize the functions of data verification and outputting control signals to the output switches.
  • the monitoring circuit generally adopts a monostable flip-flop circuit, and the trigger pulse time is 1.6s.
  • the present application also proposes a method for diagnosing and processing a switch quantity output module based on the above-mentioned functional safety.
  • the schematic flowchart of this embodiment is shown in FIG. 5 , which at least includes diagnosing processing based on the fault of the output switch, and specifically includes:
  • Output switch fault diagnosis processing In some embodiments, the output switch has failure modes such as open circuit and short circuit.
  • the fault diagnosis processing of the output switch is mainly aimed at the possible failure modes such as open circuit and short circuit of the output switch SW1 and the output switch SW2.
  • the CPU unit periodically controls the states of the output switch SW1 and the output switch SW2 sequentially according to the preset states in the table below, according to a total of 4 states 1-4.
  • the CPU unit compares the 4 actual back-check results in one cycle with the 4 expected results. If the actual back-check results are inconsistent with the expected results, it is considered that the output switch SW1 or the output switch SW2 is faulty, and the CPU unit is at this time. Control the drive circuit 1 and the drive circuit 2 to turn off the outputs of the output switch SW1 and the output switch SW2 at the same time, leading to safety. In order to avoid the load malfunction, the pulse width of the diagnosis should be smaller than the load response time, the typical value is 2ms.
  • Communication Failure Diagnosis Process there is a communication failure between the CPU unit and the drive circuit.
  • the specific steps of communication data diagnosis are explained with the CPU unit in FIG. 4 and the drive circuit 1.
  • the CPU unit sends communication information including control information to the drive circuit 1, and the drive circuit 1 receives the communication information and starts the internal communication data calibration. test.
  • the driving circuit 1 will send a pulse signal to the monitoring circuit 1 to keep the output state of the monitoring circuit 1 unchanged, so that the output of the monitoring circuit 1 does not affect the output state of the driving circuit 1 to the output switch SW1.
  • the communication between the CPU and the drive circuit 1 fails, the communication data inside the drive circuit 1 cannot be verified, and the drive circuit 1 will not send a pulse signal to the monitoring circuit 1.
  • the output status Inversion occurs, a low-level signal is output to the drive circuit 1, and the corresponding output switch SW1 is forced to output OFF, so that the module is guided safely.
  • the internal software and hardware of the CPU may fail.
  • an external independent circuit is often required to ensure that the system is in a safe state.
  • the fault indication signal ERROR is sent to the logic device 1, and the logic device 1 receives the fault indication signal ERROR and controls the IC1 to stop working, thereby cutting off the communication between the CPU unit and the drive circuit 1.
  • the driving circuit 1 since the driving circuit 1 cannot receive the communication data sent by the CPU unit, it will not send a pulse signal to the monitoring circuit 1. Finally, the monitoring circuit 1 sends a low-level signal to the driving circuit 1 because of the timeout, so that the driving circuit controls the output switch SW1. The output is OFF to make the module lead to a safe signal.
  • the power supply of the driving circuit may have faults such as overvoltage and undervoltage.
  • the power supply voltage detection circuit 1 will detect the fault, but due to the At this time, the drive circuit 1 is already in a state of abnormal power supply, and it cannot be guaranteed that it can turn off the output. Therefore, the power supply voltage detection circuit 1 will send a signal to the logic device 2 to turn off IC2, thereby closing the communication between the CPU unit and the drive circuit 2. , use the normally working drive circuit 2 to turn off the output switch SW2, so that the output is safe; similarly, when the power supply of the drive circuit 2 fails, the output switch SW1 can be turned off by the normally working drive circuit 1 to make the module lead to safety.
  • Line fault diagnosis processing since the output switch SW1 and the output switch SW2 have a load current detection function. When the load current does not meet the preset threshold requirements, that is, when the line is faulty and short-circuited, it is greater than the preset threshold value, or when the line is open-circuited and smaller than the preset threshold value, the signal of the indicator pin of the chip of the output switch SW1 is reversed.
  • the CPU unit can read back the line fault information indicated by the output switch SW1 together with the output status information through the drive circuit 1 .

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Electronic Switches (AREA)
  • Test And Diagnosis Of Digital Computers (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

一种功能安全的开关量输出模块，包括：CPU单元和分别与CPU单元耦接的第一/第二输出单元；第一/第二输出单元包括依次耦接的逻辑电路、驱动电路、回检电路和输出开关，以及与驱动电路耦接的电源电压检测电路；一种基于上述功能安全的开关量输出模块的诊断处理方法，可以基于输出开关故障诊断、通信诊断、CPU单元内部故障诊断、电源故障诊断以及线路故障诊断结果控制输出开关的输出。

Description

一种功能安全的开关量输出模块和诊断处理方法
相关申请
本申请要求2020年12月29日申请的，申请号为202011587822.6，发明名称为“一种功能安全的开关量输出模块和诊断处理方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及工业自动控制技术领域，特别是涉及一种功能安全的开关量输出模块和诊断处理方法。
背景技术
工业现场的开关量输出控制系统，是DCS、SIS等工业控制系统中最主要的一个输入组件。相关技术中大部分功能安全相关的开关量输出模块采用2OO3架构，此架构往往需要大量的硬件来构建实现，根据此架构设计出的产品一般成本较高并且体积较大，当实际应用中对安装空间和成本有要求时，2OO3架构产品会具有局限性。
随着技术的日渐成熟，SIS产品设计正在朝向更小体积以及更低成本的方向迈进，更多的设计开始采用1OO2D、1OO2或1OO1D等架构。
采用1OO2D的架构，如图1所示。该设计中采用双通道、双CPU分别控制输出并分别读取本通道诊断数据，而该方案当中的两个通道缺少必要的信息交互，假设其中一路通道发生故障且无法关断输出电路，未出现故障的通道的CPU单元是无法获取诊断信息并执行关断导向安全的，两通道相对独立且缺少交互的设计是存在一定的隐患的。
采用1OO1D架构的设计，如图2所示。该设计在一个CPU单元控制一个输出单元的基础上加上了一个诊断单元，诊断单元和输出单元分别控制一个开关，两个开关串联，诊断单元可诊断输出单元同时将信息发给CPU，还可以在发生故障时关断其控制的开关导向安全，但是如果诊断单元本身发生故障并无法向CPU提供可靠的诊断信息时，整个模块就存在安全隐患了。
发明内容
本申请的目的在于解决开关量输出模块的双输出通道缺少交互设计以及诊断单元本 身发生故障无法向CPU提供可靠的诊断信息，在两路输出电路之间增加交互诊断的措施，并且增加了通过关断CPU与输出电路之间的通信来关断输出，提高了模块的安全性能，确保模块的导向安全，在满足功能安全的同时降低开发成本并减小产品体积。
本申请的第一个方面提供了一种功能安全的开关量输出模块，包括，CPU单元，以及，分别与CPU单元耦接的第一输出单元和第二输出单元；所述CPU单元用于向第一输出单元或第二输出单元发送通信数据，并基于接收的第一输出单元或第二输出单元反馈的诊断数据输出故障信息，从而控制第一输出单元或第二输出单元导向安全；所述第一输出单元或第二输出单元至少包括依次耦接的逻辑电路、驱动电路、回检电路和输出开关，以及，与驱动电路耦接的电源电压检测电路，其中，第一输出单元的输出开关SW1和第二输出单元的输出开关SW2串联；所述逻辑电路的输入端输入CPU单元发送的通信数据，并输出至驱动电路，以及，用于接收另一个输出单元的电源电压检测电路输出的故障信号，控制CPU单元与驱动电路之间的通信通断；
所述驱动电路用于接收和校验CPU单元发送的通信数据，并在校验通过后依据通信数据信息控制输出开关断开或闭合，以及采集回检电路的输出状态和输出开关的线路诊断信息；所述回检电路用于检测开关输出状态并将其发送至驱动电路；所述电源电压检测电路用于检测驱动电路的电源电压并基于检测电压发送控制信号至另一输出单元的逻辑电路。
进一步的，所述输出单元还包括与驱动电路耦接的监控电路，所述监控电路用于接收驱动电路数据校验后输出的信号，并输出控制信号控制驱动电路输出开通或关断信号，从而控制输出开关断开或闭合。
进一步的，若所述驱动电路数据校验失败不输出脉冲信号至监控电路，从而控制监控电路输出低电平信号至驱动电路；若所述驱动电路数据校验成功后发送脉冲信号至监控电路，从而控制监控电路输出状态保持不变。
进一步的，所述监控电路包括但不限于单稳态触发器电路。
进一步的，所述逻辑电路至少包括逻辑门芯片和逻辑器件；所述逻辑门芯片的输入端输入CPU单元发送的通信数据，输出经逻辑门芯片转换后的通信数据至驱动电路；所述逻辑器件用于接收另一个输出单元的驱动电路的电源故障信号，从而控制本输出单元的逻辑门芯片通断。
进一步的，所述CPU单元还用于发出CPU单元内部故障信号至逻辑器件，从而通过逻辑门芯片控制断开CPU单元与驱动电路之间的通信。
进一步的，所述输出开关SW1和输出开关SW2为具有负载电流检测功能的开关。
进一步的，所述驱动电路包括但不限于逻辑芯片CPLD。
本申请的第二个方面提供了一种基于功能安全的开关量输出模块的诊断处理方法，至少包括基于输出开关故障进行诊断处理，具体包括：
S1，根据预设状态周期性控制输出开关SW1和输出开关SW2的输出状态；
S2，回读回检电路检测的输出状态；
S3，将一个周期内回读的实际回检结果与预设的回检结果进行比较，并基于比较结果判断是否关断输出开关SW1和输出开关SW2的输出。
进一步的，所述步骤S3具体包括：
S31，若CPU单元的实际回检结果与预设的回检结果相同，则重复步骤S1-S3诊断开关输出状态；
S32，若CPU单元实际回检结果与预设的回检结果不一致，则CPU单元控制两个驱动电路同时关断输出开关SW1和输出开关SW2的输出。
进一步的，诊断处理方法还包括基于通信故障诊断处理，具体包括：基于CPU单元与驱动电路之间通信数据校验，并基于检验通过后的通信数据信息控制输出开关的输出。
进一步的，诊断处理方法还包括基于CPU单元内部故障诊断处理，具体包括：基于CPU单元内部软件或硬件故障发出故障信号至逻辑电路，从而控制通信的通断。
进一步的，诊断处理方法还包括基于电源故障诊断处理，具体包括：基于检测的电源故障，控制另一个输出单元的驱动电路和CPU单元之间关闭通信，从而控制输出开关的输出。
进一步的，诊断处理方法还包括基于线路故障诊断处理，具体包括，CPU单元回读的输出开关检测的负载电流与预设阈值比较，根据比较结果控制输出开关的输出。
本申请的有益技术效果是：
1、主控CPU单元以及两路构成1OO2架构的输出电路构成本申请1OO1D的整体架构。可以在保证满足功能安全的同时实现更小体积、更低成本，以满足狭小空间或恶劣环境中的应用。
2、通过两路输出电路之间增加交互诊断的措施，在一路通道发生故障且无法关断输出开关时，确保了另一路可以关断输出开关，进一步提升了产品的安全性能。
3、增加了通过关断CPU单元与输出单元之间的通信，然后由监控电路关断输出的导向安全的机制，确保了CPU无法直接控制输出时仍然能够关断输出。
4、具有对模块中多个部件失效的诊断处理，方法简单易实现，满足了功能安全。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为1OO2D架构的功能安全数字量输出电路结构框图；
图2为1OO1D架构的高诊断覆盖率的功能安全开关量输出模块结构框图；
图3为1OO2架构示意图；
图4为本申请实施例的功能安全开关量输出模块原理框图；
图5为本申请实施例中输出开关故障诊断处理方法流程示意图。
具体实施方式
为了进一步理解本申请，下面结合实施例对本申请优选实施方案进行描述，但是应当理解，这些描述只是为进一步说明本申请的特征和优点，而不是对本申请权利要求的限制。
在描述本申请之前，首先对专有名词进行解释：
1OO2架构：1OO2架构包含两个并列的通道，任何一个都能执行安全功能。在不影响安全功能执行的前提下，它能容许一个通道发生失效，只有当两个通道都发生危险失效时，才会导致安全功能的失效。其架构示意如图3所示。
基于上述解释，以下是对本申请的技术方案进行详细描述。
如图4所示，本实施例所述的一种功能安全的开关量输出模块，包括CPU单元，以及，分别与CPU单元耦接的第一输出单元和第二输出单元。其中，CPU单元用于向第一输出单元或第二输出单元发送通信数据，并基于接收的第一输出单元或第二输出单元反馈的诊断数据输出故障信息，从而控制第一输出单元或第二输出单元导向安全。第一输出单元或第二输出单元至少包括依次耦接的逻辑电路、驱动电路、回检电路和输出开关，以及，与驱动电路耦接的电源电压检测电路，其中，第一输出单元的输出开关SW1和第二输出单元的输出开关SW2串联。逻辑电路的输入端输入CPU单元发送的通信数据，并输出至驱动电路，以及，用于接收另一个输出单元的电源电压检测电路输出的故障信号，控制CPU单元与驱动电路之间的通信通断。驱动电路用于接收和校验CPU单元发送的通信数据，并在校验通过后依据通信数据信息控制输出开关断开或闭合，以及采集回检电路的输出状态和输出开关的线路诊断信息；回检电路用于检测开关输出状态并将其发送至驱动电路；电源电压检测电路用于检测驱动电路的电源电压并基于检测电压发送控制信号至另一输出单元的逻辑电路。
在本申请实施例的开关量输出模块中，以图4中的第一输出单元为例，第一输出单元包括驱动电路1、回检电路1、监控电路1、电源电压检测电路1和输出开关SW1，输出 开关SW1的一端耦接+24V，另一端和第二输出单元的输出开关SW2的一端串联，输出开关SW2的另一端用于输出开关量并和负载耦接。
在本申请实施例中，作为可选实施方式，认为系统的安全状态应该为输出状态为off，需要输出开关SW1和/或SW2断开。CPU单元向驱动电路1发送包括开关量信息的控制数据。驱动电路1对接收的控制数据进行通信校验，如果校验通过，则根据CPU单元发送的控制数据控制输出开关SW1断开还是闭合状态。驱动电路1还通过回检电路1采集输出开关SW1的输出状态，以及直接读取输出开关SW1反馈的线路状态。输出开关SW1自带线路故障诊断功能，在发生失效情况下，可反馈故障信息至驱动电路。CPU单元从驱动电路1中统一读取回检数据，并可根据第一输出单元和第二输出单元的回检数据统一分析。
若驱动电路1的电源VCC1发生过压、欠压等故障，则电源电压检测电路1发送VCC1_Check故障信号至第二输出单元的逻辑器件2，逻辑器件2接收第二输出单元的VCC1_Check故障信号，并控制逻辑门芯片IC2关闭驱动电路2和CPU单元之间的通信，驱动电路2因此不会向监控电路2发送脉冲信号，监控电路2在1.6s超时以后，向驱动电路2输出低电平信号，使驱动电路2关断对应的输出开关SW2，使模块导向安全。
在本申请实施例中，作为可选实施方案，驱动电路一般采用CPLD等逻辑芯片进行编程，实现数据校验和输出控制信号至输出开关的功能。监控电路一般采用单稳态触发器电路，触发脉冲时间为1.6s。
本申请还提出了一种基于上述功能安全的开关量输出模块的诊断处理方法，本实施例的流程示意图如图5所示，至少包括基于输出开关故障进行诊断处理，具体包括：
S1，根据预设状态周期性控制输出开关SW1和输出开关SW2的输出状态；
S2，回读回检电路检测的输出状态；
S3，将一个周期内回读的实际回检结果与预设的回检结果进行比较，并基于比较结果判断是否关断输出开关SW1和输出开关SW2的输出。
下面结合图3中对本实施例中示出的多个故障诊断处理方法进行分别说明，以便本领域技术人员能够更好地理解本申请的技术方案。
输出开关故障诊断处理：在一些实施例中，输出开关存在开路、短路等失效模式。输出开关故障诊断处理主要针对输出开关SW1和输出开关SW2可能的开路、短路等失效模式。
CPU单元周期性，按照下表的预设状态，按照1-4共4种状态循环，顺序地控制输出开关SW1和输出开关SW2的状态。
预设状态 SW1状态 SW2状态 预期回检结果
1 ON ON ON
2 ON OFF OFF
3 OFF ON OFF
4 OFF OFF OFF
以一个周期为例，CPU单元在一个周期的4个实际回检结果与4个预期结果比较，如果实际回检结果与预期结果不一致，则认为输出开关SW1或输出开关SW2故障，此时CPU单元控制驱动电路1和驱动电路2同时关断输出开关SW1和输出开关SW2的输出，导向安全。为了避免负载误动作，诊断的脉宽应该小于负载的响应时间，典型值为2ms。
通信故障诊断处理：在一些实施例中，CPU单元与驱动电路之间存在通信故障。以图4中的CPU单元与驱动电路1之间说明通信数据诊断的具体步骤，CPU单元发送包括控制信息在内的通信信息至驱动电路1，驱动电路1接收通信信息并开始内部的通信数据校验。当数据校验通过时，驱动电路1会向监控电路1发送一个脉冲信号，维持监控电路1的输出状态不变，从而监控电路1的输出不影响驱动电路1输出至输出开关SW1的状态。
当CPU与驱动电路1之间的通信出现故障时，驱动电路1内部的通信数据无法校验通过，驱动电路1不会向监控电路1发送脉冲信号，监控电路1在1.6s超时以后，输出状态发生反转，向驱动电路1输出低电平信号，强制对应的输出开关SW1输出OFF，使模块导向安全。
CPU单元内部故障诊断处理：CPU内部软、硬件有可能出现故障，在一些实施例中，当CPU单元内部发生故障以后，往往需要一个外部的独立电路来保证系统处于安全状态。CPU单元内部发生故障后，发出故障指示信号ERROR至逻辑器件1，逻辑器件1接收故障指示信号ERROR，并控制IC1停止工作，从而切断CPU单元与驱动电路1之间的通信。
同时，由于驱动电路1收不到CPU单元发送的通信数据，所以不会向监控电路1发送脉冲信号，最终监控电路1因为超时向驱动电路1发出低电平信号，从而驱动电路控制输出开关SW1输出OFF，使模块导向安全的信号。
电源故障诊断处理：在一些实施例中，驱动电路的电源可能发生过压、欠压等故障。为保证系统处于安全状态，以图4中所示的第一输出单元为例，当驱动电路1的电源VCC1出现过压或欠压等故障时，电源电压检测电路1会检测到故障，但由于此时的驱动电路1已经处于供电异常的状态，无法保证其一定能关断输出，因此电源电压检测电路1会向逻辑器件2发送信号关闭IC2，从而关闭CPU单元与驱动电路2之间的通信，利用正常工作 的驱动电路2来关断输出开关SW2，从而输出导向安全；同理，当驱动电路2的电源出现故障时，可以通过正常工作的驱动电路1来关断输出开关SW1来使模块导向安全。
线路故障诊断处理：在一些实施例中，由于输出开关SW1和输出开关SW2带有负载电流检测功能。当负载电流不满足预设阈值需求，即在线路发生故障短路时大于预设的阈值，或者在线路发生开路时小于预设的阈值时，输出开关SW1的芯片的指示引脚的信号发生翻转，CPU单元可以通过驱动电路1将输出开关SW1指示的线路故障信息以及输出状态信息一同回读。
以上实施例的说明只是用于帮助理解本申请的方法及其核心思想。应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以对本申请进行若干改进和修饰，这些改进和修饰也落入本申请权利要求的保护范围内。

Claims (15)

  1. 一种功能安全的开关量输出模块，其特征在于，所述开关量输出模块包括：
    CPU单元，以及，分别与所述CPU单元耦接的第一输出单元和第二输出单元；
    所述CPU单元用于向所述第一输出单元或所述第二输出单元发送通信数据，并基于接收的所述第一输出单元或第二输出单元反馈的诊断数据输出故障信息，从而控制所述第一输出单元或第二输出单元导向安全；
    所述第一输出单元或第二输出单元至少包括依次耦接的逻辑电路、驱动电路、回检电路和输出开关，以及，与所述驱动电路耦接的电源电压检测电路，其中，所述第一输出单元的输出开关SW1和所述第二输出单元的输出开关SW2串联；
    所述逻辑电路的输入端输入所述CPU单元发送的通信数据，并输出至所述驱动电路，以及，用于接收另一个输出单元的电源电压检测电路输出的故障信号，控制所述CPU单元与所述驱动电路之间的通信通断；
    所述驱动电路用于接收和校验所述CPU单元发送的通信数据，并在校验通过后依据所述通信数据信息控制所述输出开关断开或闭合，以及采集所述回检电路的输出状态和所述输出开关的线路诊断信息；
    所述回检电路用于检测开关输出状态并将其发送至所述驱动电路；
    所述电源电压检测电路用于检测所述驱动电路的电源电压并基于检测电压发送控制信号至另一输出单元的逻辑电路。
  2. 如权利要求1所述的开关量输出模块，其特征在于，所述输出单元还包括与所述驱动电路耦接的监控电路，所述监控电路用于接收所述驱动电路数据校验后输出的信号，并输出控制信号控制所述驱动电路输出开通或关断信号，从而控制所述输出开关断开或闭合。
  3. 如权利要求2所述的开关量输出模块，其特征在于，若所述驱动电路数据校验失败不输出脉冲信号至所述监控电路，从而控制所述监控电路输出低电平信号至所述驱动电路；若所述驱动电路数据校验成功后发送脉冲信号至所述监控电路，从而控制所述监控电路输出状态保持不变。
  4. 如权利要求2所述的开关量输出模块，其特征在于，所述监控电路包括单稳态触发器电路。
  5. 如权利要求1所述的开关量输出模块，其特征在于，所述逻辑电路至少包括逻辑门芯片和逻辑器件；所述逻辑门芯片的输入端输入所述CPU单元发送的通信数据，输出经所述逻辑门芯片转换后的通信数据至所述驱动电路；
    所述逻辑器件用于接收另一个输出单元的驱动电路的电源故障信号，从而控制本输出 单元的逻辑门芯片通断。
  6. 如权利要求5所述的开关量输出模块，其特征在于，所述CPU单元还用于发出CPU单元内部故障信号至所述逻辑器件，从而通过所述逻辑门芯片控制断开CPU单元与所述驱动电路之间的通信。
  7. 如权利要求1所述的开关量输出模块，其特征在于，所述输出开关SW1和所述输出开关SW2为具有负载电流检测功能的开关。
  8. 如权利要求1-7任一所述的开关量输出模块，其特征在于，所述驱动电路包括逻辑芯片CPLD。
  9. 一种基于权利要求1-8任一所述的开关量输出模块的诊断处理方法，其特征在于，至少包括基于输出开关故障进行诊断处理，包括：
    S1，根据预设状态周期性控制所述输出开关SW1和所述输出开关SW2的输出状态；
    S2，回读所述回检电路检测的输出状态；
    S3，将一个周期内回读的实际回检结果与预设的回检结果进行比较，并基于比较结果判断是否关断所述输出开关SW1和所述输出开关SW2的输出。
  10. 如权利要求9所述的诊断处理方法，其特征在于，所述步骤S3包括：
    S31，若所述CPU单元的实际回检结果与预设的回检结果相同，则重复步骤S1-S3诊断开关输出状态；S32，若CPU单元的实际回检结果与预设的回检结果不一致，则所述CPU单元控制两个驱动电路同时关断所述输出开关SW1和所述输出开关SW2的输出。
  11. 如权利要求9所述的诊断处理方法，其特征在于，所述诊断处理方法还包括基于通信故障诊断处理，包括：基于所述CPU单元与所述驱动电路之间通信数据校验，并基于检验通过后的通信数据信息控制所述输出开关的输出。
  12. 如权利要求9所述的诊断处理方法，其特征在于，所述诊断处理方法还包括基于所述CPU单元内部故障诊断处理，包括：基于所述CPU单元内部软件或硬件故障发出故障信号至所述逻辑电路，从而控制通信的通断。
  13. 如权利要求9所述的诊断处理方法，其特征在于，所述诊断处理方法还包括基于电源故障诊断处理，包括：基于检测的电源故障，控制另一个输出单元的驱动电路和所述CPU单元之间关闭通信，从而关断所述输出开关的输出以导向安全。
  14. 如权利要求9所述的诊断处理方法，其特征在于，所述诊断处理方法还包括基于线路故障诊断处理，包括：所述CPU单元回读的所述输出开关检测的负载电流与预设阈值比较，根据比较结果控制所述输出开关的输出。
  15. 如权利要求9-14任一所述的诊断处理方法，其特征在于，所述一个周期的时间小 于负载的响应时间。
PCT/CN2021/120686 2020-12-29 2021-09-26 一种功能安全的开关量输出模块和诊断处理方法 WO2022142528A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
JP2023513528A JP7509345B2 (ja) 2020-12-29 2021-09-26 機能が安全なスイッチ量出力モジュール及び診断処理方法

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011587822.6A CN112631256B (zh) 2020-12-29 2020-12-29 一种功能安全的开关量输出模块和诊断处理方法
CN202011587822.6 2020-12-29

Publications (1)

Publication Number Publication Date
WO2022142528A1 true WO2022142528A1 (zh) 2022-07-07

Family

ID=75285773

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/120686 WO2022142528A1 (zh) 2020-12-29 2021-09-26 一种功能安全的开关量输出模块和诊断处理方法

Country Status (3)

Country Link
JP (1) JP7509345B2 (zh)
CN (1) CN112631256B (zh)
WO (1) WO2022142528A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112631256B (zh) * 2020-12-29 2022-03-18 浙江中控技术股份有限公司 一种功能安全的开关量输出模块和诊断处理方法
CN113156297A (zh) * 2021-04-22 2021-07-23 广西柳工机械股份有限公司 开关量输出电路故障诊断方法、装置及芯片
CN113541672B (zh) * 2021-07-02 2024-04-23 浙江中控技术股份有限公司 风险降级装置和风险降级方法
CN113805518B (zh) * 2021-11-19 2022-03-08 华智生物技术有限公司 一种数字农业执行终端的故障防护系统及方法
CN114545829B (zh) * 2022-02-28 2024-03-29 徐州徐工挖掘机械有限公司 信号输出装置及信号输出控制方法、工程机械
WO2024094140A1 (zh) * 2022-11-04 2024-05-10 中国石油化工股份有限公司 远程测控终端及安全控制系统

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4868826A (en) * 1987-08-31 1989-09-19 Triplex Fault-tolerant output circuits
US7800875B2 (en) * 2007-07-16 2010-09-21 Honeywell Int Inc Multi-level electronic protection system providing safe fault recovery for multiple digital control outputs
CN102375426A (zh) * 2010-08-09 2012-03-14 深圳市合信自动化技术有限公司 一种plc数字量输出控制装置及其控制方法
CN105137966A (zh) * 2015-10-20 2015-12-09 浙江中控技术股份有限公司 一种开关量输出通道检测方法和结构
CN105988365A (zh) * 2015-03-23 2016-10-05 西门子公司 用于失效保险系统的安全架构
CN106354121A (zh) * 2016-10-19 2017-01-25 交控科技股份有限公司 一种安全控制电路、多路控制电路和控制方法
CN110376932A (zh) * 2018-04-13 2019-10-25 沈阳中科博微科技股份有限公司 一种高诊断覆盖率的功能安全开关量输出模块
CN110647102A (zh) * 2019-10-21 2020-01-03 河南思维轨道交通技术研究院有限公司 一种智能化安全输出模块
CN111781891A (zh) * 2020-06-10 2020-10-16 杭州凯尔达机器人科技股份有限公司 机器人安全逻辑控制系统
CN112631256A (zh) * 2020-12-29 2021-04-09 浙江中控技术股份有限公司 一种功能安全的开关量输出模块和诊断处理方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4314027B2 (ja) * 2002-12-27 2009-08-12 Ｉｄｅｃ株式会社 教示ペンダントのイネーブル装置
DE10320522A1 (de) 2003-05-02 2004-11-25 Pilz Gmbh & Co. Verfahren und Vorrichtug zum Steuern eines sicherheitskritischen Prozesses
CN103941718B (zh) * 2014-02-13 2017-07-11 浙江网新中控信息技术有限公司 一种二取二故障安全输出结构检测系统
CN104270126A (zh) * 2014-09-10 2015-01-07 国家电网公司 一种开关量输出电路、控制方法及监测方法
CN106130537B (zh) * 2016-06-20 2019-09-03 北京安控科技股份有限公司 一种1oo2d功能安全数字量输出电路

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4868826A (en) * 1987-08-31 1989-09-19 Triplex Fault-tolerant output circuits
US7800875B2 (en) * 2007-07-16 2010-09-21 Honeywell Int Inc Multi-level electronic protection system providing safe fault recovery for multiple digital control outputs
CN102375426A (zh) * 2010-08-09 2012-03-14 深圳市合信自动化技术有限公司 一种plc数字量输出控制装置及其控制方法
CN105988365A (zh) * 2015-03-23 2016-10-05 西门子公司 用于失效保险系统的安全架构
CN105137966A (zh) * 2015-10-20 2015-12-09 浙江中控技术股份有限公司 一种开关量输出通道检测方法和结构
CN106354121A (zh) * 2016-10-19 2017-01-25 交控科技股份有限公司 一种安全控制电路、多路控制电路和控制方法
CN110376932A (zh) * 2018-04-13 2019-10-25 沈阳中科博微科技股份有限公司 一种高诊断覆盖率的功能安全开关量输出模块
CN110647102A (zh) * 2019-10-21 2020-01-03 河南思维轨道交通技术研究院有限公司 一种智能化安全输出模块
CN111781891A (zh) * 2020-06-10 2020-10-16 杭州凯尔达机器人科技股份有限公司 机器人安全逻辑控制系统
CN112631256A (zh) * 2020-12-29 2021-04-09 浙江中控技术股份有限公司 一种功能安全的开关量输出模块和诊断处理方法

Also Published As

Publication number Publication date
JP2023539613A (ja) 2023-09-15
CN112631256B (zh) 2022-03-18
JP7509345B2 (ja) 2024-07-02
CN112631256A (zh) 2021-04-09

Similar Documents

Publication Publication Date Title
WO2022142528A1 (zh) 一种功能安全的开关量输出模块和诊断处理方法
US8355837B2 (en) System and method for testing the integrity of a vehicle testing/diagnostic system
CN112217702B (zh) 级联式主从模块的自动编址方法及主控模块、从控模块
CN102880523B (zh) 看门狗电路及其故障监测方法
EP0241270A1 (en) Self-testing monitoring circuit
CN114123731A (zh) 一种多并联ipm故障保护装置、系统以及方法
CN111813088B (zh) Di通道的诊断电路及方法
US8289030B2 (en) Reliable signaling of fault conditions in battery systems with series-connected cells
CN110376932B (zh) 一种高诊断覆盖率的功能安全开关量输出模块
CN116149301A (zh) 一种故障诊断的装置、方法及车辆
CN210793215U (zh) 电源控制电路和具有其的用于道岔的控制装置
CN108519891B (zh) 一种核电站设备结构优选装置及处理方法
CN202917396U (zh) 高可靠性的单片机控制继电器装置
CN108958228B (zh) 一种带状态诊断及反馈的中继器及其故障诊断方法
CN114545829B (zh) 信号输出装置及信号输出控制方法、工程机械
US20230401119A1 (en) Two-sided Time-sharing Driving and Acquisition System Based on Dry Contacts and System Fault Detection Method Therefor
CN217214796U (zh) 一种基于功能安全开发的氢燃料电池控制系统
JPS5854407A (ja) 流量制御装置
CN220359142U (zh) 一种对inter x86平台fusa信号快速可靠的响应电路
CN115159281A (zh) 二通道抱闸控制电路
CN113928367B (zh) 道岔控制系统
CN117171082B (zh) 低功耗芯片和电子设备
CN215376129U (zh) 电子设备及应用于电子设备的控制电路
CN115159280A (zh) 三通道电梯制动器安全控制电路
CN116774666A (zh) 一种高安全完整性测控设备io诊断方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913273

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023513528

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 202317036654

Country of ref document: IN

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 523441403

Country of ref document: SA

122 Ep: pct application non-entry in european phase

Ref document number: 21913273

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 523441403

Country of ref document: SA