WO2024094140A1 - 远程测控终端及安全控制系统 - Google Patents

远程测控终端及安全控制系统 Download PDF

Info

Publication number
WO2024094140A1
WO2024094140A1 PCT/CN2023/129419 CN2023129419W WO2024094140A1 WO 2024094140 A1 WO2024094140 A1 WO 2024094140A1 CN 2023129419 W CN2023129419 W CN 2023129419W WO 2024094140 A1 WO2024094140 A1 WO 2024094140A1
Authority
WO
WIPO (PCT)
Prior art keywords
signal
unit
controller
control
input
Prior art date
Application number
PCT/CN2023/129419
Other languages
English (en)
French (fr)
Inventor
曹德舜
李娜
杨哲
郭怡安
高新江
徐伟
孙冰
Original Assignee
中国石油化工股份有限公司
中石化安全工程研究院有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202211378784.2A external-priority patent/CN117991675A/zh
Priority claimed from CN202211379586.8A external-priority patent/CN117991001A/zh
Priority claimed from CN202211379989.2A external-priority patent/CN117991615A/zh
Priority claimed from CN202211379581.5A external-priority patent/CN117991676A/zh
Application filed by 中国石油化工股份有限公司, 中石化安全工程研究院有限公司 filed Critical 中国石油化工股份有限公司
Publication of WO2024094140A1 publication Critical patent/WO2024094140A1/zh

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors

Definitions

  • the present invention relates to the technical field of remote measurement and control terminals, and in particular to a remote measurement and control terminal and a safety control system.
  • Safety instrument system is mainly the alarm and interlocking part of the factory control system. It implements alarm action or adjustment or shutdown control on the detection results in the control system. It is an important part of the automatic control of factories and enterprises. Its correct operation requires a series of equipment to operate normally. It must have sensors that can detect abnormal operating conditions, such as high flow, low liquid level or wrong valve positioning.
  • the existing SIS usually has more than 30 control points and is mostly used in medium and large petrochemical plants. When the number of control points is small, its configuration cost is relatively high, and it is not suitable for small chemical plants.
  • the processing function, I/O function, communication function, safety diagnosis function, redundant fault tolerance and other functional modules of existing SIS products are all independent cards.
  • the independent cards are placed in a standard cabinet and connected to the field instrument through I/O card wiring.
  • the architecture is mature, but the overall volume is large and cumbersome and the cost is high. It is only suitable for large process industrial devices, with extremely low integration, and it is impossible to achieve digital-to-analog conversion integrated design.
  • the existing SIS products lack a small and integrated I/O channel self-diagnosis loop suitable for highly integrated systems, and cannot achieve 100% fault self-diagnosis coverage of I/O channels.
  • the Remote Terminal Unit is a special computer measurement and control unit with a modular structure designed for long communication distances and harsh industrial field environments. It is usually used in safety instrument systems. It connects the terminal detection instruments and actuators to the main computer of the remote control center. It has remote data acquisition, control and communication functions, can receive operating instructions from the main computer, and control the actions of the terminal actuators.
  • the existing RTU lacks an integrated signal self-diagnosis circuit and cannot perform fault judgment on external input signals, which may result in erroneous control signals and control safety accidents.
  • the purpose of the embodiments of the present invention is to provide a remote measurement and control terminal and a safety control system to solve the problem that when the common I/O channel of the existing RTU fails, the control signal cannot be accurately output, thereby causing a control safety accident.
  • a remote measurement and control terminal comprising: an interface module and a processing module;
  • the processing module comprises an I/O channel unit and a controller, the interface module is connected to the I/O channel unit and the controller in sequence, and the I/O channel unit comprises an analog interface unit;
  • the analog quantity interface unit includes: a signal switching unit and a first switch unit; the controller is connected to the signal switching unit and the first switch unit in sequence, the input end of the first switch unit is connected to the interface module for receiving a first analog signal input from the outside, and the output end of the first switch unit is used to send the first analog signal to the first input end and the second input end of the controller; the signal switching unit is used to control the first switch unit to disconnect when receiving a first control signal output by the controller to cut off the connection between the first analog signal and the controller, and to generate a second analog signal when receiving a second control signal output by the controller and send the second analog signal to the first input end and the second input end of the controller.
  • a safety control system comprising: an execution unit; and a remote measurement and control terminal as described above; the remote measurement and control terminal is used to generate a corresponding execution control signal according to an external input signal, and send the execution control signal to the execution unit to control the execution unit to perform a corresponding action.
  • the remote measurement and control terminal of the present invention is integrated with an analog signal self-diagnosis circuit, which can divide the externally input field signal or the generated self-test signal into two, and input them into two different input terminals of the controller respectively.
  • the controller can perform fault identification on the field signal or self-test signal input at the two different input terminals, thereby realizing fault detection of the I/O channel.
  • By switching the field signal and the self-test signal full coverage of the fault self-diagnosis of the I/O channel can be realized, thereby ensuring that the controller outputs accurate control signals, effectively improving the reliability and safety of signal transmission, and avoiding control safety accidents caused by signal processing channel failures.
  • Example 2 is a schematic diagram of the structure of a remote measurement and control terminal provided in Example 1 of the present invention.
  • FIG3 is a schematic diagram of a voting structure provided by Embodiment 1 of the present invention.
  • FIG. 4 is a schematic diagram of the structure of an analog quantity interface unit provided in Embodiment 2 of the present invention.
  • Embodiment 5 is a circuit diagram of an analog input signal acquisition channel provided by Embodiment 2 of the present invention.
  • FIG. 6 is a circuit diagram of an analog input signal self-checking channel provided by Embodiment 2 of the present invention.
  • FIG. 7 is a schematic diagram of the structure of a switch interface unit provided in Embodiment 3 of the present invention.
  • FIG. 8 is a circuit diagram of a switch output unit provided in Embodiment 3 of the present invention.
  • FIG9 is a circuit diagram of a sampling unit provided in Embodiment 3 of the present invention.
  • Example 10 is a self-diagnosis circuit diagram of a multi-channel controlled switch output signal channel provided in Example 3 of the present invention.
  • Example 12 is a circuit diagram of a digital interface unit provided in Example 4 of the present invention.
  • FIG. 13 is a schematic diagram of the structure of a safety control system provided in Example 7 of the present invention.
  • the first aspect of this embodiment provides a remote measurement and control terminal, including: an interface module, a logic voting module and at least two processing modules; the at least two processing modules are respectively connected to the interface module and the logic voting module; the at least two processing modules respectively obtain external input signals through the interface module, generate corresponding control signals according to the external input signals and send the generated control signals to the logic voting module; the logic voting module is used to determine the voting results according to the control signals generated by the at least two processing modules, generate corresponding execution control signals according to the voting results and send the execution control signals to the execution unit.
  • the remote measurement and control terminal of this embodiment has redundant signal processing channels.
  • the other signal processing channel can output accurate control signals, thereby effectively improving the reliability and safety of signal transmission and avoiding control safety accidents caused by signal processing channel failures.
  • Remote measurement and control terminal is usually used as the basic component unit for industrial data acquisition and monitoring control system. It has rich communication interfaces, supports multiple communication modes, and has long communication distances. It can adapt to various industrial sites with harsh environments.
  • the number of control points of existing safety systems that can realize control functions is usually more than 30 points, which leads to the large size and complex installation of existing RTUs. When the number of control points required is small, the configuration cost is high and it is not conducive to installation. It is not suitable for the safety control of indoor or outdoor monitoring alarms, emergency parking and other functions of some small chemical plants such as green hydrogen preparation, fine chemicals, and waste gas treatment.
  • the remote measurement and control terminal of this embodiment includes two completely identical processing modules, the two processing modules are redundant with each other, and the two-choice system formed by the two processing modules and the logic voting module can effectively ensure the safety of system control.
  • the interface module, the logic voting module and the two processing modules are integrated on the base plate, the logic voting module is arranged inside the base plate, and the interface module is used to physically or electrically isolate the external input signals input to the two processing modules.
  • the present application is based on the RTU architecture, by integrating a miniaturized I/O channel self-diagnosis loop in the processing module, and integrating redundant processing modules, interface modules and logic voting modules on the same circuit board, so that no additional external independent cards are required, and the integration and miniaturization of SIS is realized, which is suitable for small chemical plants, and solves the problem that the existing SIS relies on independent cards, the equipment is bulky and the integration is low.
  • the two processing modules of this embodiment constitute two redundant signal processing channels.
  • the redundant processing modules are connected to the external input signals of the scene through the interface module, and perform corresponding logic calculations and processing according to the external input signals to generate corresponding control signals, and send the generated control signals to the logic voting module respectively.
  • the logic voting module After the logic voting module performs 1oo2 voting according to the control signals from the two processing modules, it outputs the final execution control signal to the execution unit to control the execution unit to perform the corresponding action. For example, taking the external input signal as the temperature signal collected on site as an example, the temperature signal collected on site is divided into two after passing through the interface module and input into the two processing modules respectively.
  • the two processing modules perform corresponding logic operations according to the preset algorithm based on the received temperature signal. For example, the processing module converts the received temperature signal into a temperature value, and compares the obtained temperature value with the preset temperature threshold.
  • the processing module If the temperature value is higher than the temperature threshold, the processing module outputs 1 to the logic voting module, and the logic voting module performs 1oo2 voting on the two control signals received and outputs the corresponding execution control signal such as 1 to the cooling device to control the cooling device to cool down.
  • 1 represents a high-level signal and 0 represents a low-level signal.
  • the logic voting module is used to: when it is determined that any one of the control signals generated by at least two processing modules is abnormal, use the control signal without abnormality among the control signals generated by at least two processing modules as the execution control signal; when it is determined that the control signals generated by at least two processing modules are all normal, use any one of the control signals generated by at least two processing modules as the execution control signal; when it is determined that the control signals generated by at least two processing modules are all abnormal, generate a safety control signal as the execution control signal to control the execution unit to stop running.
  • the processing module can also make an abnormal judgment on the output control signal, for example, by sampling and reading back the output control signal, comparing the sampled value of the output control signal, such as the sampled voltage value, with a predetermined standard output voltage value to judge whether the output control signal is abnormal, for example, predetermine the range of standard output voltage values when the output is 1 or 0, sample the output voltage when the output is 1 and compare it with the predetermined standard output voltage value, if the sampled voltage value does not belong to the predetermined standard output voltage value range, then the output control signal is judged to be abnormal, and an alarm signal is generated to prompt the staff that the signal output channel is abnormal, and the logic voting module performs 1oo2 voting on the two received control signals to generate the final execution control signal.
  • a predetermined standard output voltage value for example, predetermine the range of standard output voltage values when the output is 1 or 0, sample the output voltage when the output is 1 and compare it with the predetermined standard output voltage value, if the sampled voltage value does not belong to the predetermined standard output voltage value range
  • the logic voting module can be a hardware voting circuit, for example, by connecting the output ends of the two processing modules in series or in parallel by hard wiring and then connecting them to the control loop of the controlled device to generate the final execution control signal. It can also be a software voting module. For example, it can be built into a controller for logical voting. The software voting module receives control signals output by two processing modules and fault judgment results for the control signals. For example, if the control signal received from one processing module is 1 and the fault judgment result is normal, and the control signal received from the other processing module is 0 and the fault judgment result is abnormal, then the software voting module determines 1 as the execution control signal.
  • the software voting module determines 0 as the execution control signal and controls the execution unit to enter a safe operation state or stop running.
  • the voting logic of this embodiment is shown in Table 1. If both processing module A and processing module B output normally, the logic voting module actually executes the 1oo2 voting method, and the final output result is the same as any one of A and B; if A can output normally, but B outputs abnormally, the system actually executes the 1oo1 voting method, and the final output result is the same as the output of A, thereby avoiding a channel failure causing a system failure and increasing system reliability; if B can output normally, but A outputs abnormally, the system actually executes the 1oo1 voting method, and the final output result is the same as the output of B; if both A and B output abnormally, the system automatically enters a fail-safe state and outputs a fail-safe value.
  • the system is determined to be in a safe state when the output is in a non-excitation state, that is, the system is in a safe state when the output is in a power-off state.
  • a safety control system it is to stop the device from running.
  • a voting circuit of this embodiment is shown in FIG3 .
  • the outputs of the two processing modules are respectively used to control the opening and closing of the two switch elements of the voting module.
  • the output switch elements of the two processing modules are hard-wired in parallel and then connected to the control loop of the controlled device.
  • the voting module outputs a safety value of 0 to control the controlled device to stop running; when the outputs of the two processing modules are both 1, the voting module outputs 1 to control the controlled device to run; if the outputs of the two processing modules are 0 and 1 respectively, the voting module outputs 1 to control the controlled device to run, thereby avoiding the shutdown of the controlled device when one of the inputs fails.
  • the processing module before sending a control signal, the processing module first performs a fault detection on the control signal. For example, processing module A generates a control signal 1, and processing module B generates a control signal 0. If the processing module A generates a control signal 1 and processing module B generates a control signal 0, If module A confirms that there is no abnormality in its control signal, it outputs 1 to the voting module. If it confirms that there is an abnormality, it outputs 0 to the voting module. If processing module B confirms that there is no abnormality in its control signal, it outputs 0 to the voting module. If it confirms that there is an abnormality, it also outputs 0 to the voting module.
  • the setting of the safety value can be set according to the actual application.
  • the safety value can also be 1, which is not limited here.
  • the structure of the hardware voting circuit can be set according to the specific application.
  • the output switch elements of the two processing modules can also be connected in series by hard wiring and then connected to the control loop of the controlled device. The structure of the voting circuit is the prior art and will not be repeated here.
  • the processing module includes: an I/O channel unit and a controller; the interface module is connected to the I/O channel unit and the controller in sequence; the I/O channel unit includes: an analog interface unit, a switch interface unit and a digital interface unit.
  • the two processing modules are completely identical and redundant to each other.
  • the two processing modules also communicate in full-duplex bidirectional manner through an electrically isolated serial port.
  • the two processing modules send heartbeat signals and fault self-diagnosis results to each other, so that the operating status of each other can be judged based on the heartbeat signal and the fault self-diagnosis results.
  • the current processing module When the other processing module is judged to be faulty, the current processing module generates an alarm signal to prompt the staff that the other processing module is faulty, so that when a processing module fails, such as freezing, and an alarm signal cannot be generated, the other processing module generates an alarm signal.
  • the circuit board of each processing module is integrated with the same number of controllers and I/O channels.
  • one processing module is provided with one controller and 24 I/O channels, which is not limited in this embodiment.
  • the types of I/O channels supported by the processing module include DI, AI and DO.
  • the I/O channel unit may include 10 AI interfaces, 6 DI interfaces, and 8 DO interfaces.
  • the I/O channel unit can also be expanded according to on-site needs.
  • DI is rated at 24VDC/10mA
  • DO is rated at 24VDC/500mA and has a withstand voltage of 60VDC
  • AI is better than 0.5%
  • current is 4-20mA
  • input impedance is 24VDC/250 ⁇
  • voltage is 0-10VDC
  • input impedance is not less than 100K
  • the fastest response time from input to output signal is 50ms
  • the system power supply is 24VDC ⁇ 10%.
  • the controller is a device that can execute the control logic and other functions of the RTU.
  • the controller can execute the control logic for analyzing sensor data and generating control signals for actuators.
  • the controller can also execute the function of controlling the overall operation of the RTU, such as supporting the communication with external devices or systems.
  • the controller may include at least one processing device that executes LINUX or other operating systems. Data can be transmitted between the controller and external devices or systems such as field valves, instruments, etc. via the I/O channels on the integrated processing module, and the controller can receive runtime and diagnostic data from one or more field devices via one or more I/O channels.
  • the controller can provide runtime data and historical data to other control systems such as DCS, or provide diagnostic data to the control system, and the relevant data can be stored in the controller or other locations.
  • the controller can be a CPU or MCU, etc., which is not limited here.
  • the system of this embodiment also has a time sequence recording (SOE) function of event occurrence, and the input and output signals are time stamped to facilitate the search for the cause of the accident during accident analysis, wherein the SOE time resolution is not greater than 1ms.
  • SOE time sequence recording
  • each integrated processing module is provided with a 3-position rotary switch, and the functions of the switch positions are defined as: stop - force the channel output to "0", output emergency stop or alarm signal; output invalid - force the channel output to "1", output channel bypass signal; output valid - the channel outputs normally, that is, collects input signals, processes according to user logic and outputs normally.
  • the control circuit of the rotary switch is prior art and will not be described in detail here.
  • the correct operation of SIS requires a series of devices to operate normally. It must have sensors that can detect abnormal operating conditions, such as high flow, low liquid level or incorrect valve positioning. It requires a logic operation unit to receive the input signal of the sensor, make appropriate decisions based on the nature of the signal, and change its output according to the logic defined by the user, so as to control the execution unit to control the operation process of the equipment and make it reach a safe state.
  • the logic operation unit is the processing module of the present application, which can be an electrical, electronic or programmable electronic device, such as a relay, a trip amplifier or a programmable logic controller. Among them, the transmission of signals is usually realized through I/O cards.
  • the failure of a single I/O channel cannot be identified and processed, it may have a greater impact on the safety and availability of the unit. For example, during the signal acquisition process of analog input signals such as temperature, pressure, and flow, various interferences or human wiring errors may occur in the I/O channel, resulting in inaccurate analog signal acquisition, affecting the reliability and safety of the SIS. Whether the input signal can be correctly acquired is particularly important for the functional safety of the entire SIS.
  • the analog interface unit of this embodiment includes: a signal switching unit and a first switch unit; a controller is connected to the signal switching unit and the first switch unit in sequence, and the first The input end of the switch unit is connected to the interface module for receiving a first analog signal input from the outside, and the output end of the first switch unit is used to send the first analog signal to the first input end and the second input end of the controller; the signal switching unit is used to control the first switch unit to disconnect when receiving a first control signal output by the controller to cut off the connection between the first analog signal and the controller, and to generate a second analog signal when receiving a second control signal output by the controller and send the second analog signal to the first input end and the second input end of the controller.
  • the first input terminal and the second input terminal of the controller are connected to an A/D conversion module.
  • the analog signals input to the first input terminal and the second input terminal of the controller are converted into corresponding digital signals after A/D conversion by the A/D conversion module and then transmitted to the logic processing unit of the controller to perform communication, self-test, calculation and other actions.
  • the first analog signal is a collected field signal, for example, it can be a sensor signal such as flow rate and liquid level in the safety instrument system, which can be a current signal of 4 to 20mA or a voltage signal of 0 to 10VDC, which is not limited here.
  • the collected field analog signal is also converted into a maximum voltage signal of 5VDC by a sampling circuit and then input into the first switch unit.
  • the second analog signal is a self-test signal.
  • the controller When self-test is required, the controller generates a self-test signal by controlling the signal switching unit.
  • the first switch unit is in the on state, and the collected field signal is transmitted to the two input ends of the controller through the first switch unit.
  • the controller determines whether the analog signals received at the two input ends are abnormal, so that the correct input signal can be selected as the target signal for the next calculation.
  • the controller can also determine whether the input end of the controller or the field signal input channel is faulty according to whether the analog signals received at the two input ends are abnormal.
  • the controller controls the first switch unit to disconnect by controlling the signal switching unit.
  • the self-test signal generated by the signal switching unit is input to the two input ends of the controller.
  • the controller determines whether the input end of the controller or the self-test signal input channel is faulty according to whether the self-test signals received at the two input ends are abnormal.
  • the signal switching unit includes: a first signal switching subunit, a second signal switching subunit, a first switch subunit, a second switch subunit, a switch signal generating unit and a second analog signal generating unit; the input end of the first signal switching subunit is connected to the first output end of the controller for receiving the first control signal, the output end of the first signal switching subunit is connected to the input end of the first switch subunit, the output end of the first switch subunit is connected to the switch signal generating unit and then connected to the control end of the first switch unit; the input end of the second signal switching subunit is connected to the second output end of the controller for receiving the second control signal, the output end of the second signal switching subunit is connected to the input end of the second switch subunit, the output end of the second switch subunit is connected to the analog signal generating unit and then connected to the first input end and the second input end of the controller.
  • the first switch subunit and the second switch subunit can be independent switch units or integrated in one module; the first output end of the first output end of the
  • the analog interface unit further includes: an isolation amplifier U1 and a signal conditioning amplifier U2; the output end of the first switch unit, i.e., the switch module U3, is connected to the input end of the isolation amplifier U1, the output end of the isolation amplifier U1 is connected to the input end of the signal conditioning amplifier U2, and the output end of the signal conditioning amplifier U2 is connected to the first input end and the second input end of the controller.
  • the switch module U3 is an analog switch
  • U1 is an isolation amplifier
  • U2 is a conditioning amplifier.
  • the switch module U3 also includes a voltage divider resistor R2, a diode D1, a voltage limiting diode D2, a filter resistor R5, a filter capacitor C8 and other related peripheral circuits;
  • the isolation amplifier U1 also includes filter capacitors C2, C3 and C4 of its related peripheral circuits;
  • the conditioning amplifier U2 also includes resistors R1, R4, R6, R7, R11 and R12 of its related peripheral circuits, and capacitors C1, C5, C6, C7 and C9.
  • the first analog signal, ie, the collected field signal AI0 is connected to the S terminal of the switch module U3, and the D terminal of the switch module U3 is connected to the IN terminal of the isolation amplifier U1 via the resistor R5.
  • the first switch subunit and the second switch subunit are both optocouplers, and the signal switching unit is also used to perform optocoupler isolation of the signal.
  • the first switch subunit and the second switch subunit are integrated in an optocoupler module as two control channels of the integrated optocoupler module.
  • the integrated optocoupler module is ASSR5
  • the first switch subunit and the second switch subunit are two control channels in ASSR5
  • the A1 terminal, K1 terminal, NO1 terminal and CO1 terminal of ASSR5 are the first input terminal, the second input terminal, the first output terminal and the second output terminal of the first switch subunit, respectively
  • the A2 terminal, K2 terminal, NO2 terminal and CO2 terminal of ASSR5 are the first input terminal, the second input terminal, the first output terminal and the second output terminal of the second switch subunit, respectively.
  • the first signal switching subunit includes: a switch element, wherein the switch element is a transistor Q17; a switch signal generating subunit includes: a diode D4, a resistor R14 and a resistor R8; the base of the transistor Q17 is connected to the first output terminal of the controller via a resistor R158, the emitter of the transistor Q17 is grounded, and the collector of the transistor Q17 is connected to the first output terminal of the controller via a resistor R162.
  • the K1 end of ASSR5 is connected, and the A1 end of ASSR5 is connected to a 24V power supply; the NO1 end of ASSR5 is connected to the negative end of the diode D4, the first end of the resistor R14, and the first end of the resistor R8, respectively, and then connected to the IN end of the switch module U3, the positive end of the diode D4 is grounded, the second end of the resistor R14 is connected to the first positive voltage signal, the first positive voltage signal is a +24V voltage, and the second end of the resistor R8 is connected to the CO1 end of ASSR5.
  • the first output end of the controller is set to DIAG-EN, and the connection point between the NO1 end of ASSR5 and the negative end of the diode D4, the first end of the resistor R14, and the first end of the resistor R8 is recorded as TN.
  • the second signal switching subunit includes: a switching element, wherein the switching element is a transistor Q18; the second analog signal generating unit includes: a diode D5, a resistor R10 and a resistor R16; the base of the transistor Q18 is connected to the second output terminal of the controller through a resistor R163, the emitter of the transistor Q18 is grounded, the collector of the transistor Q18 is connected to the K2 terminal of ASSR5 through a resistor R167, and the A2 terminal of ASSR5 is connected to the power supply; the NO2 terminal of ASSR5 is connected to the second positive voltage signal, wherein the second positive voltage signal is a +12V voltage, the CO2 terminal of ASSR5 is connected to the first terminal of the resistor R10, the second terminal of the resistor R10 is connected to the first terminal of the resistor R16 and the negative terminal of the second diode D5, and then connected to the IN terminal of the isolation amplifier U1 through the resistor R2, the diode D1 and the resistor R5, and then connected to
  • the controller is also used to: compare the first analog signal received by its first input terminal and the second input terminal with the preset analog signal threshold value, and generate a first fault alarm signal if the first analog signal received by the first input terminal or the second input terminal of the controller is determined to be abnormal based on the comparison result; and compare the second analog signal received by its first input terminal and the second input terminal with the preset analog signal threshold value, and generate a second fault alarm signal if the second analog signal received by the first input terminal or the second input terminal of the controller is determined to be abnormal based on the comparison result.
  • a corresponding control signal is generated according to the first analog signal without abnormality and sent to the logic voting module; if it is determined according to the comparison result that there is no abnormality in the first analog signal received by the first input terminal and the second input terminal of the controller, a corresponding control signal is generated according to any first analog signal without abnormality and sent to the logic voting module; if it is determined according to the comparison result that there are both abnormalities in the first analog signal received by the first input terminal and the second input terminal of the controller, an output fault alarm signal is generated.
  • the external field analog input signals received by the first input terminal and the second input terminal of the controller are both within the preset range, and the deviation between the two external field analog input signals received by the first input terminal and the second input terminal of the controller is also within the preset deviation range, then it is determined that both analog values are valid, and the two external field analog input signal values received by the first input terminal and the second input terminal of the controller are averaged and used as the target input signal, that is, the analog input calculation value of this analog input channel; otherwise, the analog values of both conversions are marked as invalid, and a fault alarm is generated.
  • the analog value converted by this channel is valid and used as the target input signal, that is, the analog input calculation value of this analog input channel. Since the analog value converted by the other channel is not within the preset range, the analog value converted by this channel is marked as invalid, and a fault alarm is generated.
  • the present application divides the input field signal into two and inputs them into two different input terminals of the controller.
  • the controller can effectively ensure the accuracy of the field signal used to calculate the control signal by performing abnormal diagnosis on the field signals input at the two different input terminals, thereby improving the accuracy of the control signal output by the controller; by switching the field signal and the self-test signal, full coverage of the self-diagnosis of the I/O channel can be achieved. For example, if the controller determines that the field signal is normal but the self-test signal is abnormal, the fault location can be determined to be the signal switching unit; if the controller determines that the self-test signal is normal but the field signal is abnormal, the fault location can be determined to be the interface module, the first switch unit or the field signal transmission medium.
  • the present application actually realizes two-level diagnosis of the output signal: the first-level diagnosis realizes the abnormal diagnosis of the field signal/self-test signal, ensuring the accuracy of the control signal output by the controller; the second-level diagnosis realizes the diagnosis of whether the redundant control signal itself is abnormal, ensuring the accuracy of the control signal finally output to the execution unit.
  • the existing SIS lacks a miniaturized self-diagnosis circuit and cannot achieve 100% self-diagnosis coverage of the I/O channel.
  • DIAG-EN When the system is operating normally and no self-diagnosis is performed, DIAG-EN is at a low level, transistor Q17 is not conducting, TN is at a high level, the S and D terminals of the analog switch U3 are conducting, and the external field signal AI0 is input into the RC filter circuit composed of R5 and C8 and the isolation amplifier U1 through the DS conducting terminal of U3, and then converted into an analog voltage signal within the conversion range of the A/D converter inside the controller after level shifting, active filtering and gain conversion by the signal conditioning amplifier U2; At the same time, since no self-test is performed at this time, DIAG-TEST is low level, TEST, i.e., the CO2 terminal of ASSR5, is zero level, and the voltage of the TP self-test signal is zero voltage.
  • the controller compares the two digital quantities after A/D conversion.
  • the input signal is used as the target analog input signal for the user's logic processing calculation, otherwise an alarm is generated for a large deviation of the analog input signal.
  • the first output terminal of the controller When the system is operating normally and self-diagnosis is required, the first output terminal of the controller outputs a first control signal, at which time DIAG-EN is high, Q17 is turned on, T-N is low, the S and D terminals of the analog switch U3 are cut off, and the circuit is open, and the external field signal AI0 is blocked; at the same time, the second output terminal of the controller outputs a second control signal, at which time DIAG-TEST is high, TEST is high, and a T-P self-test voltage signal is generated, which is input into the isolation amplifier U1 after being unidirectionally conducted by the diode D1, the voltage division of the resistors R2 and R5, and the RC filtering; and then the signal conditioning amplifier U2 performs level shifting, active filtering, gain conversion, etc., and converts it into an analog voltage signal within the conversion range of the A/D converter inside the controller; the analog voltage signal input through the conditioning amplifier U2 is respectively collected and converted into digital quantities by two independent A/
  • the controller is also used to: continuously obtain the first analog signal or the second analog signal received by the first input terminal and the second input terminal of the controller within a preset time period, generate a first curve representing the change trend of the first analog signal or the second analog signal obtained by the first input terminal of the controller within the preset time period, and a second curve representing the change trend of the first analog signal or the second analog signal obtained by the second input terminal of the controller within the preset time period; compare the first curve and the second curve with the preset analog signal change curve, if the deviation between the first curve or the second curve and the preset analog signal change curve is greater than the curve deviation threshold, determine that the first curve or the second curve is abnormal.
  • the external field analog input signal or self-test voltage signal For example, continuously obtain the external field analog input signal or self-test voltage signal within 3 months, and construct the first curve of the analog signal received by the first input end of the controller and the second curve of the analog signal received by the second input end of the controller within the time period. Match the first curve and the second curve with the preset analog signal change curve respectively, and determine the deviation between the first curve and the second curve and the analog signal change curve, wherein the preset analog signal change curve is the change curve of the analog signal collected and stored in the same time period in the previous operation cycle when the system is in normal working conditions, as the normal comparison curve of the current operation cycle, wherein the operation cycle can be set to 3 months.
  • the deviation between multiple points in the first curve or the second curve and the same point on the analog signal change curve is greater than the deviation threshold, it is considered that there is a circuit fault in the corresponding analog input path. Among them, the deviation between multiple points and the same point on the analog signal change curve is greater than the deviation threshold.
  • the deviations between the analog values of N consecutive monitoring points and the analog values of the same point on the analog signal change curve are all greater than the deviation threshold, or it can be that the analog values of N monitoring points within a certain interval of the first curve or the second curve and the analog values of the same point on the analog signal change curve are greater than the deviation threshold, or it can be that the analog values of N monitoring points among all the monitoring points of the first curve or the second curve and the analog values of the same point on the analog signal change curve are greater than the deviation threshold, which is not limited to this embodiment.
  • the switch interface unit includes: a switch output unit and a sampling unit; the output end of the controller is connected to the input end of the switch output unit, the input end of the sampling unit is connected to the output end of the switch output unit, the output end of the sampling unit is connected to the input end of the controller, and the output end of the switch output unit is connected to the execution unit; the switch output unit is used to generate a third control signal corresponding to the current switch signal according to the switch signal sent by the controller and send the third control signal as the control signal to the logic voting module, and generate a fourth control signal corresponding to the self-test signal according to the self-test signal sent by the controller, and the sampling unit is used to feed back the third control signal and the fourth control signal to the controller.
  • the output terminal DO of the controller outputs a switch signal
  • the switch output unit generates a corresponding third control signal according to the switch signal output by the controller to control the controlled device. For example, when the switch signal is a high-level signal, the switch output unit outputs a high-level third control signal, and when the switch signal is a low-level signal, the switch output unit outputs a low-level third control signal; the sampling unit samples the third control signal output by the switch output unit and feeds back the voltage sampling signal of the third control signal to the controller.
  • the input terminal of the controller is also connected to an A/D conversion module, and the voltage sampling signal input to the input terminal of the controller is converted into a corresponding third control signal after A/D conversion by the A/D conversion module.
  • the corresponding digital signal is then transmitted to the logic processing unit of the controller to perform communication, self-test, calculation and other actions.
  • the controller can judge whether the output signal is normal by matching the sampled voltage signal with the switch signal it outputs. For example, if the switch signal output by the controller is a high-level signal, the third control signal output by the switch output unit should also be a high-level signal.
  • the self-test signal output by the controller drives the fourth control signal output by the switch output unit, and the sampling unit feeds back the voltage sampling signal of the fourth control signal to the controller. If the controller judges that the sampled voltage signal of the fourth control signal matches the self-test signal, it means that the switch signal output channel is normal. If the controller judges that the sampled voltage signal of the fourth control signal does not match the self-test signal, it is judged that the switch signal output channel is faulty, and the controller sends an alarm message to prompt that the switch signal output channel is faulty.
  • the switch output unit includes: a first switch element and an optocoupler isolation unit; the control end of the first switch element is connected to the output end of the controller, the input end of the optocoupler isolation unit forms an isolation control loop through the first switch element, and the output end of the optocoupler isolation unit is connected to the controlled device; the first switch element controls the on and off of the isolation control loop according to the switch signal output by the controller, so as to control the output end of the optocoupler isolation unit to generate a third control signal corresponding to the current switch signal.
  • the optocoupler isolation unit ASSR1 is a solid-state relay with two channels
  • the first switch element is a transistor Q6, and the switch output unit also includes: a first resistor R118, a second resistor R120 and a first diode D61;
  • the output end DIO1 of the controller is connected to the base of the first switch element through the first resistor R118, the emitter of the first switch element is grounded, the collector of the first switch element is connected to the second input end K1 of the optocoupler isolation unit ASSR1 through the second resistor R120, and the first input end A1 of the optocoupler isolation unit ASSR1 is connected to the power supply;
  • the first output end NO1 of the optocoupler isolation unit ASSR1 is connected to the cathode end of the first diode D61, and the first diode D61 is connected to the cathode end of the first diode D61.
  • the second output terminal CO1 of the optocoupler isolation unit ASSR1 is connected to the controlled device, the first output terminal NO1, the second output terminal CO1 and the controlled device of the optocoupler isolation unit ASSR1 constitute a control loop of the controlled device; the first input terminal A1 and the second input terminal K1 of the optocoupler isolation unit ASSR1 constitute a first isolation control loop through a first switch element, and the first switch element controls the on-off of the first isolation control loop according to the switch signal output by the controller, so as to generate a third control signal corresponding to the current switch signal on the control loop of the controlled device by controlling the on-off between the first output terminal NO1 and the second output terminal CO1 of the optocoupler isolation unit ASSR1.
  • the first output terminal NO1 and the second output terminal CO1 of the optocoupler isolation unit ASSR1 and the control circuit of the controlled device form a loop.
  • the controller outputs a high-level switching signal
  • the transistor Q6 is turned on, and the first input terminal A1 and the second input terminal K1 of the optocoupler isolation unit ASSR1 are turned on, and the light-emitting diode in the loop is lit, so that the first output terminal NO1 and the second output terminal CO1 of the optocoupler isolation unit ASSR1 are turned on, and the control circuit of the controlled device is turned on and outputs a corresponding third control signal, such as a high-level third control signal, thereby realizing control of the controlled device.
  • a corresponding third control signal such as a high-level third control signal
  • the sampling unit includes: a voltage sampling unit ACPL1 and a third resistor R111, wherein the voltage sampling unit ACPL1 adopts a DC voltage sampling chip; the DC+ end of the voltage sampling unit ACPL1 is connected to the NO1 end of the optocoupler isolation unit ASSR1 and the negative end of the first diode D61 through the third resistor R111, the DC- end of the voltage sampling unit ACPL1 is connected to the CO1 end of the optocoupler isolation unit ASSR1, and is used to collect the voltage signal of the third control signal, and the output end of the voltage sampling unit ACPL1 is connected to the input end of the controller, and is used to feed back the voltage signal of the third control signal to the controller.
  • the sampling unit further includes a resistor R112 and a capacitor C129, the VCC end of the voltage sampling unit ACPL1 is connected to the first end of the resistor R112 and then connected to the input end of the controller, the second end of the resistor R112 is connected to the VO end of the voltage sampling unit ACPL1, the first end of the capacitor C129 is connected to the VCC end of the voltage sampling unit ACPL1, the second end of the capacitor C129 is connected to the GND end of the voltage sampling unit ACPL1, and the GND end of the voltage sampling unit ACPL1 is grounded.
  • the above circuit constitutes an optical isolation readback voltage sampling circuit.
  • the self-test signal is a narrow pulse signal
  • the controller is also used to: generate a corresponding narrow pulse signal according to the current switch quantity signal, including: if the current switch quantity signal is a high level signal, generate a narrow pulse signal that is first low level and then high level; if the current switch quantity signal is a low level signal, generate a narrow pulse signal that is first high level and then low level.
  • the self-test program can be started in each switch quantity output cycle, and the CPU outputs a microsecond narrow pulse self-test signal that is opposite to the normal output switch quantity signal.
  • the third control signal is a high level signal
  • the normal output of the solid-state relay ASSR1 is contact closure, and the NO1 terminal is connected to the CO1 terminal
  • the output narrow pulse self-test signal is a low level-high level narrow pulse signal, so that the corresponding contacts of the solid-state relay ASSR1 are instantly opened and then closed; conversely, if the normal output of the solid-state relay ASSR1 is When the contact is open, the narrow pulse self-test signal causes the solid-state relay ASSR1 contact to close instantly and then open, and is output to the site after being isolated by the optically isolated solid-state relay ASSR1.
  • the CPU reads back the voltage waveform of the output contact state of the solid-state relay ASSR1 through the optically isolated readback voltage sampling unit, and compares it with the output narrow pulse self-test signal waveform. If they are inconsistent, an alarm is triggered. Since the output narrow pulse self-test signal is in the microsecond level, the change in the state of the switch output contact will not cause the action of the on-site actuator, so that the self-diagnosis with 100% coverage of the switch output signal channel can be achieved.
  • the switch output signal channel self-diagnosis circuit of this embodiment can also be expanded to control multiple controlled devices.
  • the circuit also includes: a voltage sampling unit ACPL2, a diode D63, a capacitor C131, a resistor R117, a resistor R116, a resistor R123, a resistor R125 and a transistor Q8.
  • the VCC end of the voltage sampling unit ACPL2 is connected to the first end of the fifth resistor R117 and then to the input end of the controller.
  • the second end of the resistor R117 is connected to the VO end of the voltage sampling unit ACPL2.
  • the first end of the capacitor C131 is connected to the VCC end of the voltage sampling unit ACPL2.
  • the second end of the capacitor C131 is connected to the GND end of the voltage sampling unit ACPL2.
  • the GND end of the voltage sampling unit ACPL2 is grounded.
  • the DC+ end of the voltage sampling unit ACPL2 is connected to the NO2 end of the optocoupler isolation unit ASSR1 and the cathode end of the diode D63 through the resistor R116.
  • the DC- end of the voltage sampling unit ACPL2 is connected to the CO2 end of the optocoupler isolation unit ASSR1.
  • the NO2 end of the optocoupler isolation unit ASSR1 is connected to the cathode end of the diode D63.
  • the anode end of the diode D63 and the CO2 end of the optocoupler isolation unit ASSR1 are connected to the control circuit of the second controlled device, forming a control loop of the controlled device.
  • the output terminal DIO0 of the controller is connected to the base of the transistor Q8 through the resistor R123, the emitter of the transistor Q8 is grounded, the collector of the transistor Q8 is connected to the fourth input terminal K2 of the optocoupler isolation unit ASSR1 through the resistor R12, and the third input terminal A2 of the optocoupler isolation unit ASSR1 is connected to the power supply.
  • the controller is also used to: match the current switch signal with the third control signal, and if the current switch signal does not match the third control signal, generate a first fault alarm signal; and match the self-test signal with the fourth control signal, and if the self-test signal does not match the fourth control signal, generate a second fault alarm signal.
  • the switch signal output by the controller is a high-level signal, but the voltage signal of the sampled third control signal is a low-level signal, it indicates that the output is abnormal, and at this time, it is judged that the switch signal output channel may be faulty, and a first fault alarm signal is generated, and the logic voting module performs voting on the switch signal output by the processing module A and the processing module B according to the predetermined voting logic and generates an execution control signal; similarly, during self-test, if the self-test signal output by the controller is a high-level-low-level signal, but the voltage signal of the sampled fourth control signal is not a high-level-low-level signal, it indicates that the output is abnormal, and at this time, it is judged that the switch signal output channel may be faulty, and a second fault alarm signal is generated. It can be understood that the controller can generate a self-test signal once in each switch cycle to perform a self-test of the switch signal output channel.
  • the controller is also used to: continuously obtain the third control signal or the fourth control signal within a preset time period through the sampling unit signal, generate a first curve representing the voltage change trend of the third control signal or generate a second curve representing the voltage change trend of the fourth control signal; compare the first curve or the second curve with the preset voltage change curve, and if the deviation between the first curve or the second curve and the preset voltage change curve is greater than the curve deviation threshold, determine that the first curve or the second curve is abnormal.
  • the preset voltage change curve can be a trend curve obtained according to the change of the theoretical voltage of the switch output signal over time in at least one switch output cycle, or the preset voltage change curve can be a trend curve obtained according to the change of the theoretical voltage of the self-test signal over time in at least one switch output cycle. It can be understood that in each switch output cycle, the output of the switch is fixed.
  • the sampled voltage signal of the switch quantity output signal of N switch quantity output cycles is continuously obtained to obtain the first curve, and the first curve is compared with the preset voltage change curve. If the deviation between the multiple sampling points in the first curve and the same point on the preset voltage change curve is greater than the voltage deviation threshold, it is considered that the switch quantity output channel is faulty.
  • the deviation between the multiple sampling points and the same point on the preset voltage change curve is greater than the voltage deviation threshold, which can be that the voltage values of the consecutive N sampling points and the voltage values of the same point on the preset voltage change curve are all greater than the voltage deviation threshold, or the voltage values of the N sampling points in a certain interval of the first curve and the voltage values of the same point on the preset voltage change curve are greater than the voltage deviation threshold, or the voltage values of the N sampling points in all the sampling points of the first curve and the voltage values of the same point on the preset voltage change curve are greater than the voltage deviation threshold, which is not limited in this embodiment. It can be understood that this embodiment can also determine whether the output channel is faulty by continuously monitoring the self-test signal. By collecting the narrow pulse waveform signal of the self-test signal over a period of time and continuously comparing the trend change of the pulse waveform over a period of time, the degradation performance of the circuit components can be continuously monitored to achieve circuit fault prediction.
  • the digital interface unit includes: a second switch unit, a first signal isolation unit and an output judgment unit; the second switch unit is connected in series to the input end loop of the first signal isolation unit, the controller is connected to the second switch unit and the input end loop of the first signal isolation unit, the output judgment unit is connected to the output end loop of the first signal isolation unit, the output end loop of the first signal isolation unit is connected to the first input end and the second input end of the controller, and the input end loop of the first signal isolation unit is also used to access the external input digital input signal; the controller is used to send a self-test signal to the input end loop of the first signal isolation unit, and send a switch control signal to the second switch unit to control the second switch unit to be turned on or off, the input end loop of the first signal isolation unit is turned on when the second switch unit is turned on, and is turned off when the second switch unit is turned off; the output judgment unit is used
  • At least two input terminals of the controller are preferably the first input terminal and the second input terminal of the controller.
  • the first input terminal and the second input terminal of the controller are connected to an A/D conversion module, and the analog signals input to the first input terminal and the second input terminal of the controller are converted into corresponding digital signals after A/D conversion by the A/D conversion module and transmitted to the logic processing unit of the controller for communication, self-checking, calculation and other actions.
  • the controller controls the conduction of the second switch unit by sending a control signal to the second switch unit. At this time, the input terminal loop of the first signal isolation unit is in a pass state, wherein the first signal isolation unit can be an optical coupler.
  • the actual 0/24VDC digital signal from the field is input into the input circuit of the first signal isolation unit, and the output circuit of the first signal isolation unit outputs a corresponding judgment signal according to the digital signal on site.
  • the digital signal on site is a 24VDC signal
  • the input circuit of the first signal isolation unit is energized, and the light-emitting diode inside it lights up, controlling the output circuit of the first signal isolation unit to be turned on.
  • the output circuit of the first signal isolation unit outputs a low-level judgment signal; if the digital signal on site is a 0VDC signal, the light-emitting diode inside the first signal isolation unit will not be turned on, and the output circuit of the first signal isolation unit will be disconnected.
  • the output circuit of the first signal isolation unit outputs a high-level judgment signal under the action of the output judgment unit, thereby converting the digital input signal into a standard analog voltage signal within the A/D conversion range.
  • the judgment signal output by the output circuit of the first signal isolation unit is transmitted to the first input terminal and the second input terminal of the controller respectively, and then collected and converted into digital quantity by two A/D converters at the same time; the controller compares the digital quantity converted by two channels with the preset value, and compares the result after two operations to obtain the final judgment signal for logic processing calculation.
  • the signal is used as the final input signal for user logic processing calculation, otherwise an alarm is issued due to the large deviation of the input signal.
  • the controller When self-test is required, the controller outputs the I/O control signal through the self-test control program, controls the second switch unit to turn on after optical coupling isolation, and inputs the self-test signal to the first signal isolation unit, switches the actual signal on site to the self-test voltage signal, thereby injecting the detection voltage into the digital quantity input channel.
  • the controller determines whether the input channel of the digital input signal is faulty according to whether the self-test signals received at the two input terminals are abnormal, thereby realizing 100% fault self-diagnosis of the digital input signal acquisition channel.
  • the self-test signal can also be a 0/24VDC self-test signal.
  • the second switch unit includes: a second switch element and a fourth resistor R110; the first output end of the controller is connected to the control end of the second switch element through the fourth resistor R110, and the controller sends a switch control signal through the first output end of the controller.
  • the first signal isolation unit includes: an optical coupling unit U44; the first input end of the optical coupling unit U44 is connected to the second output end of the controller and connected to the digital input signal, the second input end of the optical coupling unit U44 is grounded through an open element, and the controller sends a self-test signal through the second output end of the controller; the first output end of the optical coupling unit U44 is connected to at least two input ends of the controller and the output judgment unit, and the second output end is grounded.
  • the second switch element is a transistor Q5, and the optocoupler unit U44 adopts an optocoupler device of model FOD817.
  • the first output end of the controller is connected to the base of the transistor Q5 through the fourth resistor R110, the emitter of the transistor Q5 is grounded, the collector of the transistor Q5 is connected to the negative terminal of the optocoupler unit U44, and the positive terminal of the optocoupler unit U44 is connected to the second output end of the controller and the digital quantity signal input on site.
  • the collector of the optocoupler unit U44 is connected to the first input end and the second input end of the controller, the emitter is grounded, and the output judgment unit is connected to the collector of the optocoupler unit U44.
  • the switch control signal T-N output from the first output end of the controller is transmitted to the base of the transistor Q5 through the fourth resistor R110, thereby controlling the collector and emitter of the transistor Q5 to be turned on, and the input end loop of the optocoupler unit U44 is in a pass state.
  • the digital quantity interface unit also includes: a second signal isolation module and a fifth resistor R114; the second signal isolation module is connected to the first input end of the optocoupler unit U44 through the fifth resistor R114; the second output end of the controller is connected to the fifth resistor R114 through the second signal isolation module, and the digital quantity input signal is transmitted to the first input end of the optocoupler unit U44 through the second signal isolation module; the second isolation module is used to isolate the digital quantity input signal and the self-test signal.
  • the second signal isolation module includes: a second diode D3 and a third diode D4; the cathode end of the second diode D3 is connected to the anode end of the optocoupler unit U44 through the fifth resistor R114, and the anode end of the second diode D3 is connected to the field digital input signal; the cathode end of the third diode D4 is connected to the anode end of the optocoupler unit U44 through the fifth resistor R114, and the anode end of the third diode D4 is connected to the second output end of the controller, which is used to receive the self-test signal TEST output by the controller.
  • the field digital input signal is connected to the emitter of the transistor Q5 through the transmission interface, and the transmission interface can be an interface of any digital input signal, which is not limited here. As shown in Figure 10, the field digital input signal is recorded as DI2.
  • the output judgment unit includes: a sixth resistor R113 and a seventh resistor R115; the first end of the sixth resistor R113 is connected to a 5V regulated power supply, the second end of the sixth resistor R113 is connected to the first end of the seventh resistor R115 and the collector end of the optocoupler unit U44, and then connected to the first input end and the second input end of the controller; the second end of the seventh resistor R115 is grounded.
  • the sixth resistor R113 and the seventh resistor R115 are connected in parallel to the collector end of the optocoupler unit U44, and output the analog voltage signal CHAN2, i.e., the judgment signal, which is ultimately used for user logic processing calculations, to the first input end and the second input end of the controller.
  • the controller uses the collected analog voltage signal CHAN2 for diagnosis and fault prediction through A/D conversion inside.
  • the digital quantity interface unit further includes: a third signal isolation module, wherein the third signal isolation module is an optical coupler; and the first output terminal of the controller is connected to the fourth resistor R110 through the third signal isolation module.
  • the TEST signal is at a low level, that is, the controller has no self-test signal input, and the T-N control signal is at a high level, and the transistor Q5 is turned on.
  • DI2 turns on the second diode D3 and the fifth resistor R114 to control the input end of the optocoupler U44, and the internal light-emitting diode at the input end of the optocoupler U44 is turned on to emit light, and the output end of the optocoupler U44 receives the light-emitting signal at the input end and is connected to the ground, and the output analog voltage signal CHAN2 sent to the controller is at a low level of 0V; if the digital input external signal DI2 is at a low level of 0V at this time, the second diode D3 and the fifth resistor R114 are in a cut-off state, the input end of the optocoupler U44 is cut off and does not emit light, and the output end of the optocoupler U44 does not receive the light-emitting signal at the input end and is also cut off, and the output analog voltage signal CHAN2 sent to the controller is at a high
  • the TEST signal When the system needs to perform self-diagnosis during normal operation, if the TEST signal is high and the TN control signal is high, the transistor Q5 is turned on. At this time, it is in an unsafe state. If the digital input external signal DI2 is not energized and is low level 0V, the TEST signal turns on the second diode D3 and the fifth resistor R114 to control the input end of the optocoupler U44.
  • the optocoupler The input end of U44 is turned on to emit light, and the output end of the optocoupler U44 receives the light-emitting signal from the input end and is turned on and grounded, and the output analog voltage signal CHAN2 sent to the controller is a low level 0V.
  • the transistor Q5 When the system needs to perform self-diagnosis during normal operation, if the TEST signal is low and the T-N control signal is high, the transistor Q5 is turned on. At this time, it is in an unsafe state. If the digital input external signal DI2 is not energized, that is, DI2 is low level 0V, the second diode D3 and the fifth resistor R114 are in the cut-off state, the input end of the optocoupler U44 is cut off and does not emit light, and the output end of the optocoupler U44 does not receive the light-emitting signal from the input end and is also cut off.
  • the output analog voltage signal CHAN2 sent to the CPU is high level under the action of the pull-up resistor R113 and the 5V power supply, and is displayed as 5V.
  • the transistor Q5 When the system needs to perform self-diagnosis during normal operation, if the TEST signal is high and the T-N control signal is high, the transistor Q5 is turned on. At this time, it is in a safe state. If the digital input external signal DI2 is energized, that is, the DI2 input is 24V high, DI2 turns on the second diode D3 and the fifth resistor R114 to control the input end of the optocoupler U44. The input end of the optocoupler U44 is turned on to emit light, and the output end of the optocoupler U44 receives the light-emitting signal of the input end and is grounded, and the output analog voltage signal CHAN2 sent to the control money is low level 0V.
  • the transistor Q5 When self-diagnosis is required during normal operation, if the TEST signal is low and the T-N control signal is high, the transistor Q5 is turned on. At this time, it is in a safe state, the digital input external signal DI2 is energized, and the DI2 input is 24V high level, then DI2 turns on the second diode D3 and the fifth resistor R114 to control the input end of the optocoupler U44, the input end of the optocoupler U44 is turned on to emit light, the output end of the optocoupler U44 receives the light-emitting signal of the input end, and is grounded, and the output analog voltage signal CHAN2 sent to the CPU is low level 0V.
  • the transistor Q5 When the system needs to perform self-diagnosis during normal operation, if the T-N control signal is at a low level, the transistor Q5 is cut off. Regardless of whether the TEST signal is at a high or low level, the input end of the optocoupler U44 is disconnected and cut off, and the output end of U44 is cut off because it cannot receive the luminous signal from the input end.
  • the output analog voltage signal CHAN2 sent to the controller is at a high level under the action of the pull-up resistor R113 and the 5V power supply, and is displayed as 5V.
  • the output analog voltage signal CHAN2 corresponding to the external field digital input signal can also be continuously collected to the A/D converter inside the controller.
  • the drift and degradation trends of the optocoupler U44 and the sixth resistor R113 and the seventh resistor R115 can be continuously monitored to predict faults. It can be understood that since the resistance values of the sixth resistor R113 and the seventh resistor R115 are known, the voltage values of the sixth resistor R113 and the seventh resistor R115 can be calculated by collecting the voltage value of the output analog voltage signal CHAN2. The calculation process is a prior art and is not limited here.
  • the input end circuit of the first signal isolation unit receives an external digital input signal, and outputs a first judgment signal corresponding to the digital input signal to the first input end and the second input end of the controller through the output end circuit of the first signal isolation unit.
  • the controller is also used to: perform analog-to-digital conversion on the first judgment signal received at its first input end and the second input end, and compare them with the digital signal threshold value respectively; if it is determined according to the comparison result that the first judgment signal received at any input end of the controller is abnormal, a first fault alarm signal is generated; and during self-test, a self-test signal is sent to the input end circuit of the first signal isolation unit, and a second judgment signal corresponding to the self-test signal is output to the first input end and the second input end of the controller through the output end circuit of the first signal isolation unit; the second judgment signal received at the first input end and the second input end is performed analog-to-digital conversion on the second judgment signal received at its first input end and the second input end, and compare them with the digital signal
  • the 0/24VDC digital signal from the site is isolated by an optical coupler and converted into a standard analog voltage signal within the A/D conversion range; it is then simultaneously collected and converted into a digital quantity by the two A/D converters of the controller; the controller compares the two converted digital quantities with the preset digital signal threshold, and compares the results after two operations to obtain the final judgment signal for logical processing calculations.
  • the signal is used as the final analog input signal for user logical processing calculations; otherwise, an alarm is triggered due to the large deviation of the analog input signal.
  • the difference between the first judgment signal received by any input end of the controller and the digital signal threshold is greater than the preset difference range, it is determined that the first judgment signal received by the corresponding input end of the controller is abnormal; if the difference between the second judgment signal received by any input end of the controller and the digital signal threshold is greater than the preset difference range, it is determined that the second judgment signal received by the corresponding input end of the controller is abnormal.
  • the controller For example, if the difference between the digital quantity of a judgment signal of the first input end and the second input end of the controller after A/D conversion and the preset digital signal threshold is greater than the preset difference range, it can be determined that the judgment signal of the input is abnormal, then the input value of the input is invalid, and the value cannot be used as the target value of the controller for logical calculation, and the controller generates a fault alarm.
  • the controller is also used to: continuously obtain the judgment signal received by any input terminal of the controller within a preset time period, and generate a voltage change trend of the judgment signal obtained by the corresponding input terminal of the controller within the preset time period. a curve; if the deviation between the first curve and the standard voltage change curve is greater than the curve deviation threshold, it is determined that the first curve is abnormal.
  • the judgment signal is continuously obtained within a period of time, such as within 3 months, and the voltage value corresponding to the judgment signal is obtained through the two input terminals of the controller, and the first curve of the voltage value received by the first input terminal of the controller and the first curve of the voltage value received by the second input terminal of the controller in the time period are respectively constructed.
  • the first curve corresponding to the first input terminal of the controller and the first curve corresponding to the second input terminal of the controller are respectively matched with the preset standard voltage change curve to determine the deviation between each first curve and the standard voltage change curve, wherein the standard voltage change curve is the voltage change curve of the judgment signal under an ideal state.
  • the deviations of multiple points from the same points on the standard voltage change curve that are greater than the deviation threshold can be that the deviations of the voltage values of N consecutive monitoring points from the voltage values of the same point on the standard voltage change curve are all greater than the deviation threshold, or that the deviations of the voltage values of N monitoring points within a certain interval of the first curve from the voltage value of the same point on the standard voltage change curve are greater than the deviation threshold, or that the voltage values of N monitoring points among all the monitoring points on the first curve from the voltage value of the same point on the standard voltage change curve are greater than the deviation threshold, which is not limited to this embodiment.
  • the controller is further used for: if it is determined according to the comparison result that the first judgment signal received by the first input terminal or the second input terminal of the controller is normal, a corresponding control signal is generated according to the first judgment signal without abnormality; if it is determined according to the comparison result that the first judgment signals received by all input terminals of the controller are normal, a corresponding control signal is generated according to any first judgment signal without abnormality; if it is determined according to the comparison result that the first judgment signals received by all input terminals of the controller are abnormal, an output fault alarm signal is generated and sent to the logic voting module.
  • the logic voting module performs voting according to the control signal or alarm signal generated by the processing module A and the processing module B and generates an execution control signal.
  • the I/O channel unit of this embodiment includes the analog interface unit of Example 2, the switch interface unit of Example 3 and the digital interface unit of Example 4.
  • the RTU of the present application adopts a heterogeneous redundant channel design.
  • the relevant peripheral circuits and controllers can use components with the same functions but different specifications and models, thereby constructing a heterogeneous redundant channel to reduce the common cause failure rate and improve the reliability of the redundant system.
  • This application uses the FMEA model to calculate the common cause failure rate of redundant channels. Specifically, first, according to the diagnostic test, the total contribution of each measure is divided into two categories, X and Y.
  • the ratio of X:Y for each measure indicates the extent to which the diagnostic measure can improve the effect of the measure in resisting common cause failure.
  • X indicates that the diagnostic test can increase its common cause failure characteristics
  • Y indicates that the diagnostic test cannot increase the effect of overcoming common cause failure.
  • S X + Y
  • S D X (Z + 1) + Y; wherein, the values of X and Y can be determined according to the test results and the preset standards, and the value of Z can be determined according to the frequency and coverage of the diagnostic test.
  • the sum of X and Y is calculated respectively.
  • the ⁇ and ⁇ D coefficient scores are determined by looking up the table, thereby calculating the common cause failure value. Among them, ⁇ represents the coefficient of undetected faults, and ⁇ D represents the coefficient of detected faults.
  • the redundant channel structure adopts the same hardware design, and the diagnostic test contribution statistics of its electronic components are as follows:
  • a safety control system including: an execution unit; and a remote measurement and control terminal as described above; the remote measurement and control terminal is used to generate a corresponding execution control signal according to an external input signal, and send the execution control signal to the execution unit to control the execution unit to perform a corresponding action.
  • the safety control system may include several remote measurement and control terminals, namely RTUs, distributed in one or more areas.
  • RTU can be used as a device or system that provides localized control and data access at a site far away from other control systems such as DCS.
  • RTU can be located at or near the device or tank site.
  • RTU can be connected to other control systems via wired and wireless networks, such as microwave, cellular or other radio frequency communications.
  • RTU also communicates and interacts with one or more industrial field devices.
  • the field device may include a monitoring unit such as a sensor that measures one or more characteristics of a process, an execution unit such as an actuator that changes one or more characteristics of a process, or other industrial field devices.
  • RTU communicates with field devices such as valves, instruments, etc. via a wired connection.
  • the wired connection may include a serial connection such as an RS458 connection, an Ethernet connection, an industrial protocol connection, or other wired connections.
  • RTU can be used as a safety control device for the disproportionate feed heating furnace in the aromatics complex.
  • the flow sensor and pressure sensor installed in the heating furnace collect the disproportionate feed flow rate and fuel gas main pressure value of the heating furnace in real time, and transmit them to the two processing modules of RTU through wired or wireless network.
  • RTU By controlling the on-site valve to cut off the fuel gas feed, it is prevented that the fuel gas in the heating furnace will accumulate due to the flameout of the heating furnace, which may lead to explosion when exposed to open flames; when the feed flow rate of the heating furnace is too low, the RTU controls to cut off the fuel gas feed to avoid dry burning of the furnace tube and damage to the furnace tube, thereby achieving safe control of the heating furnace.
  • the logic voting module of the RTU votes on the output signals of the two processing modules of the RTU through a preset logic voting structure to ensure that when one of the output signals indicates that the monitoring value is too low, the safety control value is output and the fuel gas feed is cut off.
  • the RTU can also be connected to one or more human-machine interfaces (HMIs), such as display screens or control consoles.
  • HMIs human-machine interfaces
  • the HMI can both display the operating status of the RTU and control it through data transmission.
  • Security cameras can capture still or video images and provide the images to remote locations such as security centers via the RTU.
  • Radio equipment can be used to support wireless communication between the RTU and remote access points, which communicate with other control systems via the network.
  • the SIS of this embodiment is also provided with an engineer station and an operator station.
  • the engineer station is a PC that can write user applications and download user applications to an SD card, wherein the SD card is installed in the SD slot of the module.
  • the operator station communicates with the system through a standard communication protocol, monitors the system operation status, collects and records input and output status, diagnostic and alarm information, and SOE information. To ensure information security, the communication between the operator station and the system is one-way, read-only and not write-only, and SOE historical data is stored in the operator station.
  • the system diagnosis coverage DC of this embodiment is greater than 90%
  • the system safety failure factor SFF is greater than 90%
  • the fault response time is less than 30 seconds
  • the mean recovery time MTTR is less than 48 hours, which can effectively improve the reliability of the system.
  • the remote measurement and control terminal of the present invention has redundant signal processing channels.
  • the other signal processing channel can output an accurate control signal, thereby effectively improving the reliability and safety of signal transmission and avoiding control safety accidents caused by signal processing channel failures.
  • the present invention integrates DI, AI and DO interface units including diagnostic circuits in the processing module, which can be controlled by the controller, shield the field signal and generate a self-test signal when self-test is required, and realize the switching of the field signal and the self-test signal, which is suitable for integration with the controller and meets the needs of miniaturization.
  • the combination of the redundant processing module, the interface unit of the processing module, and the logical voting of the control signal output by the controller of the present application actually realizes the two-level security protection of the I/O channel.
  • the first level is to divide the field signal or the self-test signal into two input ends of the two-way input controller for fault diagnosis, realizing the fault diagnosis of the interface module-controller end;
  • the second level is to perform logical voting after abnormal judgment on the control signal output by the redundant controller to ensure the output of the correct control signal;
  • the full coverage diagnosis of the I/O channel fault and the positioning of the fault position can be realized by switching the field signal and the self-test signal, thereby realizing 100% fault self-diagnosis of the digital input channel, the analog input channel and the switch output channel, and the diagnosis result only alarms without directly changing the system output result.
  • the present invention can monitor the performance degradation trend of the device of the digital input channel, the analog input channel and the switch output channel for a long time,
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

提供一种远程测控终端及安全控制系统。终端包括：接口模块及处理模块；处理模块包括I/O通道单元及控制器，I/O通道单元包括模拟量接口单元；模拟量接口单元包括：信号切换单元及第一开关单元；第一开关单元的输入端与接口模块连接，用于接入外部输入的第一模拟信号，第一开关单元的输出端用于将第一模拟信号发送至控制器的第一输入端和第二输入端；信号切换单元用于在接收到控制器输出的第一控制信号时控制第一开关单元断开，以及在接收到控制器输出的第二控制信号时产生第二模拟信号并将第二模拟信号发送至控制器的第一输入端和第二输入端。远程测控终端有效提高了信号传输的可靠性和安全性。

Description

远程测控终端及安全控制系统 技术领域
本发明涉及远程测控终端技术领域，具体地涉及一种远程测控终端及一种安全控制系统。
背景技术
安全仪表系统(SIS)主要为工厂控制系统中报警和联锁部分，对控制系统中检测的结果实施报警动作或调节或停机控制，是工厂企业自动控制中的重要组成部分，其正确运行需要一系列的设备来正常运作，它必须有能够检测到异常操作条件的传感器，如高流量、低液位或错误的阀门定位。现有的SIS通常控制点数在30点以上，多用于中大型石化装置，当需要控制点数较少时其配置成本较为高昂，不适用于小型化工装置使用。且现有SIS产品的处理功能、I/O功能、通讯功能、安全诊断功能、冗余容错等功能模块均为独立卡件，独立卡件集中放置于标准机柜，通过I/O卡件接线连接现场仪表，架构成熟但整体体积庞大繁琐而且造价高，只适用于大型流程工业装置，集成度极低，无法实现数模转换一体化设计。同时，现有SIS产品缺乏适用于高度集成系统的小型化集成化的I/O通道自诊断回路，无法实现对I/O通道的100％故障自诊断的覆盖。
远程终端单元(RemoteTerminalUnit，RTU)是一种针对通信距离较长和工业现场环境恶劣而设计的具有模块化结构的、特殊的计算机测控单元，通常应用于安全仪表系统，它将末端检测仪表和执行机构与远程调控中心的主计算机连接起来，具有远程数据采集、控制和通信功能，能接收主计算机的操作指令，控制末端的执行机构动作。现有的RTU缺乏集成化的信号自诊断电路，无法对外部输入信号进行故障判断，从而可能导致产生错误的控制信号而导致控制安全事故。
发明内容
本发明实施方式的目的是提供一种远程测控终端及一种安全控制系统，以解决现有RTU通常的I/O通道故障时无法保证准确输出控制信号，从而导致控制安全事故的问题。
为了实现上述目的，在本发明的第一方面，提供一种远程测控终端，包括：接口模块及处理模块；所述处理模块包括I/O通道单元及控制器，所述接口模块与所述I/O通道单元及所述控制器依次连接，所述I/O通道单元包括模拟量接口单元；
所述模拟量接口单元包括：信号切换单元及第一开关单元；所述控制器与所述信号切换单元及所述第一开关单元依次连接，所述第一开关单元的输入端与所述接口模块连接，用于接入外部输入的第一模拟信号，所述第一开关单元的输出端用于将所述第一模拟信号发送至所述控制器的第一输入端和第二输入端；所述信号切换单元用于在接收到所述控制器输出的第一控制信号时控制所述第一开关单元断开，以切断所述第一模拟信号与所述控制器之间的连接，以及在接收到所述控制器输出的第二控制信号时产生第二模拟信号并将所述第二模拟信号发送至所述控制器的第一输入端和第二输入端。
在本发明的第二方面，提供一种安全控制系统，包括：执行单元；以及如上述的远程测控终端；所述远程测控终端用于根据外部输入信号生成对应的执行控制信号，并将所述执行控制信号发送至所述执行单元，以控制所述执行单元执行对应的动作。
本发明的远程测控终端集成有模拟量信号自诊断电路，能够将外部输入的现场信号或产生的自检信号一分为二，分别输入控制器的两个不同输入端，控制器可以通过对两个不同输入端输入的现场信号或自检信号进行故障识别，从而实现对I/O通道的故障检测，通过对现场信号和自检信号进行切换，能够实现对I/O通道的故障自诊断的全覆盖，从而能够保证控制器输出准确的控制信号，有效提高了信号传输的可靠性和安全性，避免了因信号处理通道故障而导致控制安全事故。
本发明实施例的其它特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
附图是用来提供对本发明实施例的进一步理解，并且构成说明书的一部分，与下面的具 体实施方式一起用于解释本发明实施例，但并不构成对本发明实施例的限制。在附图中：
图1是本发明实施例1提供的远程测控终端的示意框图；
图2是本发明实施例1提供的远程测控终端的结构示意图；
图3是本发明实施例1提供的一种表决结构示意图；
图4是本发明实施例2提供的模拟量接口单元的结构示意图；
图5是本发明实施例2提供的模拟量输入信号采集通道的电路图；
图6是本发明实施例2提供的模拟量输入信号自检通道的电路图；
图7是本发明实施例3提供的开关量接口单元的结构示意图；
图8是本发明实施例3提供的开关量输出单元电路图；
图9是本发明实施例3提供的采样单元电路图；
图10是本发明实施例3提供的多路控制的开关量输出信号通道自诊电路图；
图11是本发明实施例4提供的数字量接口单元的结构示意图；
图12是本发明实施例4提供的数字量接口单元的电路图；
图13是本发明实施例7提供的一种安全控制系统结构示意图。
具体实施方式
以下结合附图对本发明的具体实施方式进行详细说明。应当理解的是，此处所描述的具体实施方式仅用于说明和解释本发明，并不用于限制本发明。
实施例1
如图1所示，本实施例第一方面提供一种远程测控终端，包括：接口模块、逻辑表决模块及至少两个处理模块；至少两个处理模块分别与接口模块及逻辑表决模块连接；至少两个处理模块分别通过接口模块获取外部输入信号，根据外部输入信号生成对应的控制信号并将生成的控制信号发送至逻辑表决模块；逻辑表决模块用于根据至少两个处理模块生成的控制信号确定表决结果，依据表决结果生成对应的执行控制信号并将执行控制信号发送至执行单元。
如此，本实施例的远程测控终端具有冗余的信号处理通道，当其中任一信号处理通道故障时，另一路信号处理通道能够输出准确的控制信号，从而有效提高了信号传输的可靠性和安全性，避免了因信号处理通道故障而导致控制安全事故。
远程测控终端即RTU通常作为控制工业数据采集与监视控制系统的基本组成单元，具有通信接口丰富、支持多种通信方式、通信距离长的特点，能够适应各种环境恶劣的工业现场。现有的能够实现控制功能的安全系统的控制点数通常在30点以上，导致现有RTU的尺寸较大、安装复杂，当需要的控制点数较少时，配置成本较高，且不利于安装，不适用于一些小型化工装置如绿氢制备、精细化工、废气处理等装置的室内或室外监测报警、紧急停车等功能的安全控制。
具体的，为了解决现有技术存在的问题，本实施例的远程测控终端包括两个完全相同的处理模块，两个处理模块互为冗余，其与逻辑表决模块构成的二选一系统能够有效保障系统控制的安全性。如图2所示，接口模块、逻辑表决模块及两个处理模块集成于底板上，逻辑表决模块设置在底板内部，接口模块用于对输入两个处理模块的外部输入信号进行物理或电气隔离，这样，本申请基于RTU架构，通过在处理模块集成适用于小型化的I/O通道自诊断回路，以及将冗余的处理模块、接口模块及逻辑表决模块集成于同一电路板上，从而无需额外外接独立卡件，实现了SIS的集成化和小型化，适用于小型化工装置，解决了现有SIS依赖于独立卡件，设备体积庞大、集成化低的问题。本实施例的两个处理模块构成了两个冗余的信号处理通道，冗余的处理模块通过接口模块接入现场的外部输入信号，并根据外部输入信号执行相应的逻辑计算、处理后生成对应的控制信号，并分别将生成的控制信号发送至逻辑表决模块，逻辑表决模块根据来自两个处理模块的控制信号执行1oo2表决后，输出最终的执行控制信号至执行单元，以控制执行单元执行相应的动作。例如，以外部输入信号为现场采集的温度信号为例，现场采集到的温度信号经接口模块后一分为二，分别输入至两个处理模块中，两个处理模块根据接收到的温度信号，按照预设算法执行对应的逻辑运算，例如，处理模块将接收到的温度信号转化为温度值，将得到的温度值与预设温度阈值进行比较， 若温度值高于温度阈值，则处理模块输出1至逻辑表决模块，逻辑表决模块对接收到的两路控制信号进行1oo2表决后输出对应的执行控制信号如1至降温设备，以控制降温设备进行降温。其中，1表示高电平信号，0表示低电平信号。
其中，逻辑表决模块用于：在确定至少两个处理模块生成的控制信号中的任一者异常的情况下，以至少两个处理模块生成的控制信号中无异常的控制信号作为执行控制信号；在确定至少两个处理模块生成的控制信号均无异常的情况下，以至少两个处理模块生成的控制信号中的任一者作为执行控制信号；在确定至少两个处理模块生成的控制信号均异常的情况下，生成安全控制信号作为执行控制信号，以控制执行单元停止运行。
本实施例中，处理模块还可以对输出的控制信号进行异常判断，例如，通过对输出的控制信号进行采样回读，将输出的控制信号的采样值如采样电压值与预先确定的标准输出电压值进行比较从而判断输出的控制信号是否异常，例如，预先确定输出为1或0时的标准输出电压值的范围，当输出为1时对输出电压进行采样并与预确定的标准输出电压值进行比较，若采样电压值不属于预确定的标准输出电压值范围，则判断输出的控制信号异常，生成告警信号以提示工作人员该路信号输出通道异常，逻辑表决模块对接收到的两路控制信号进行1oo2表决后生成最终的执行控制信号。可以理解的，逻辑表决模块可以是硬件表决电路，例如通过将两个处理模块的输出端采用硬接线进行串联或并联后接入受控设备的控制回路，以生成最终的执行控制信号。也可以是软件表决模块，例如，其可内置于用于逻辑表决的控制器中，软件表决模块通过接收两个处理模块输出的控制信号及针对该控制信号的故障判断结果，例如，若接收到一个处理模块输出的控制信号为1，故障判断结果为正常，另一个处理模块输出的控制信号为0，故障判断结果为异常，则软件表决模块确定1为执行控制信号；又例如，若接收到一个处理模块输出的控制信号为1，故障判断结果为异常，另一个处理模块输出的控制信号为0，故障判断结果也为异常，则软件表决模块确定0为执行控制信号，控制执行单元进入安全运行状态或停止运行。
本实施例的表决逻辑如表1所示，若处理模块A与处理模块B皆正常输出，则逻辑表决模块实际执行1oo2表决方式，最终输出结果与A、B中任一结果相同即可；若A能正常输出，而B输出异常，则系统实际执行1oo1表决方式，最终输出结果与A的输出相同，从而避免某一通道故障导致系统故障，增加系统可靠性；若B能正常输出，而A输出异常，则系统实际执行1oo1表决方式，最终输出结果与B的输出相同；若A与B皆输出异常，则系统自动进入故障安全状态，输出故障安全值。本实施例中，输出是非励磁状态时确定系统处于安全状态，即输出为失电状态时系统处于安全状态，对于安全控制系统，即为使装置停止运行。
表1
具体的，本实施例的一种表决电路如图3所示，两个处理模块的输出分别用于控制表决模块的两个开关元件的断开和闭合，将两个处理模块的输出端开关元件采用硬接线进行并联后接入受控设备的控制回路，当两个处理模块的输出均为0时，表决模块输出安全值0，控制受控设备停止运行；当两个处理模块的输出均为1时，表决模块输出1，控制受控设备运行；若两个处理模块的输出分别为0和1时，表决模块输出1，控制受控设备运行，从而避免在其中一路输入失效时受控设备停机。例如，处理模块在发送控制信号之前，先对控制信号进行故障检测，例如，处理模块A生成控制信号1，处理模块B生成控制信号0，若处理 模块A确认其控制信号无异常，则向表决模块输出1，若确认其异常，则向表决模块输出0；若处理模块B确认其控制信号无异常，则向表决模块输出0，若确认异常，也向表决模块输出0，这样，当两个处理模块输出均正常时，按照正常表决逻辑表决即可，当其中一个输出异常时，则可以准确输出正常的控制信号，实现了对处理模块输出的控制信号本身的故障诊断，有效提高了最终确定的执行控制信号的准确率，降低了安全控制事故发生的概率。其中，安全值的设定可以根据实际应用设定，例如，根据具体安全控制过程的不同，安全值也可以为1，此处对此不作限定。可以理解的，硬件表决电路的结构可以根据具体应用进行设置，例如，还可以将其两个处理模块的输出端开关元件采用硬接线进行串联后接入受控设备的控制回路，表决电路的结构是现有技术，此处不再赘述。
本实施例中，处理模块包括：I/O通道单元及控制器；接口模块与I/O通道单元及控制器依次连接；I/O通道单元包括：模拟量接口单元、开关量接口单元及数字量接口单元。
本实施例中，两个处理模块完全相同，且互为冗余，两个处理模块之间还通过电气隔离的串行口全双工双向通讯，两个处理模块质检相互发送心跳信号和故障自诊断结果，从而能够根据心跳信号和故障自诊断结果相互判断对方的运行状态，当判断对方处理模块故障时，当前处理模块产生告警信号，以提示工作人员对方处理模块故障，从而能够在某一处理模块故障如死机，而无法产生告警信号时，由另一处理模块产生告警信号。每个处理模块的电路板上都集成有相同数量的控制器与I/O通道，例如，1个处理模块中设置有1个控制器与24个I/O通道，本实施例对此不作限定。其中，处理模块支持I/O通道的类型包括DI、AI和DO三种。以系统规模定义为24个I/O点的小型系统为例，I/O通道单元可包括10个AI接口、6个DI接口、8个DO接口，I/O通道单元还可以根据现场需要进行扩容。本实施例中，DI为额定24VDC/10mA，DO为额定24VDC/500mA且耐压60VDC，AI优于0.5％，电流4～20mA，输入阻抗24VDC/250Ω，电压0～10VDC，输入阻抗不低于100K，输入到输出信号的最快响应时间为50ms，系统供电为24VDC±10％。
控制器为可以执行RTU的控制逻辑和其他功能的器件。例如，控制器可以执行分析传感器数据以及生成用于执行器的控制信号的控制逻辑，控制器还可以执行控制RTU的整体操作的功能，如支持与外部设备或系统的通信的功能。在一些实施例中，控制器可以包括执行LINUX或其他操作系统的至少一个处理设备。数据可以经由集成的处理模块上的I/O通道在控制器与外部设备或系统如现场阀门、仪表等设备之间传输，控制器可以经由一个或多个I/O通道从一个或多个现场设备接收运行时和诊断数据。同时，控制器可以向其他控制系统如DCS提供运行时数据和历史数据，或者向控制系统提供诊断数据，相关数据可以被存储在控制器或其他位置中。本实施例中，控制器可以为CPU或MCU等，此处对此不作限定。本实施例的系统还具有事件发生时间顺序记录(SOE)功能，输入、输出信号带有时间戳，便于事故分析时查找事故原因，其中，SOE时间分辨率不大于1ms。
本实施例中，每个一体化处理模块上均设有一个3位旋转开关，开关位置的功能定义为：停止——强制该通道输出为“0”，输出紧急停车或报警信号；输出无效——强制该通道输出为“1”，输出通道旁通信号；输出有效——该通道正常输出，即采集输入信号，按用户逻辑处理后正常输出。旋转开关的控制电路为现有技术，此处对此不作赘述。
实施例2
SIS的正确运行需要一系列的设备来正常运作，它必须有能够检测到异常操作条件的传感器，如高流量、低液位或错误的阀门定位。其需要逻辑运算单元来接收传感器的输入信号，根据信号的性质做出适当的决定，并根据用户定义的逻辑改变其输出，从而控制执行单元对设备运行过程进行控制，使其达到安全状态。逻辑运算单元即本申请的处理模块，其可以为电气、电子或可编程电子设备，如继电器、跳闸放大器或可编程逻辑控制器。其中，信号的传输通常通过I/O卡件实现，若单个I/O通道的故障不能进行识别和处理，可能对机组的安全及可用性造成较大影响。例如，温度、压力、流量等模拟量输入信号在信号采集过程中，I/O通道可能会出现各种干扰或者人为接线错误等情况，从而导致模拟量信号采集不准确，影响安SIS的可靠性和安全性，该输入信号能否正确采集对整个SIS的功能安全尤为重要。
为了解决上述问题，如图4所述，在实施例1的基础上，本实施例的模拟量接口单元包括：信号切换单元及第一开关单元；控制器与信号切换单元及第一开关单元依次连接，第一 开关单元的输入端与接口模块连接，用于接入外部输入的第一模拟信号，第一开关单元的输出端用于将第一模拟信号发送至控制器的第一输入端和第二输入端；信号切换单元用于在接收到控制器输出的第一控制信号时控制第一开关单元断开，以切断第一模拟信号与控制器之间的连接，以及在接收到控制器输出的第二控制信号时产生第二模拟信号并将第二模拟信号发送至控制器的第一输入端和第二输入端。
具体的，控制器的第一输入端和第二输入端连接有A/D转换模块，输入控制器第一输入端和第二输入端的模拟信号经A/D转换模块进行A/D变换后，转化为对应的数字信号后传输至控制器的逻辑处理单元，以进行通信、自检、计算等动作。其中，第一模拟信号为采集的现场信号，例如可以是安全仪表系统中的流量、液位等传感器信号，其可以是4～20mA的电流信号或0～10VDC的电压信号，此处对此不作限定，其中，采集到的现场模拟信号还经采样电路转变为最大5VDC的电压信号后输入第一开关单元。第二模拟信号为自检信号，在需要自检时，控制器通过控制信号切换单元产生自检信号。正常工作时，第一开关单元处于导通状态，采集到的现场信号通过第一开关单元传输至控制器的两个输入端，控制器判断两个输入端接收到的模拟信号是否异常，从而能够选择正确的输入信号作为用于下一步计算的目标信号，同时，控制器还可以根据两个输入端接收到的模拟信号是否异常来判断控制器的输入端或现场信号输入通道是否故障；需要自检时，控制器通过控制信号切换单元来控制第一开关单元断开，此时，现场信号与控制器之间为断路，信号切换单元产生的自检信号输入至控制器的两个输入端，控制器根据两个输入端接收到的自检信号是否异常来判断控制器的输入端或自检信号输入通道是否故障。
其中，信号切换单元包括：第一信号切换子单元、第二信号切换子单元、第一开关子单元、第二开关子单元、开关信号生成单元及第二模拟信号生成单元；第一信号切换子单元的输入端与控制器的第一输出端连接，用于接收第一控制信号，第一信号切换子单元的输出端与第一开关子单元的输入端连接，第一开关子单元的输出端与开关信号生成单元连接后与第一开关单元的控制端连接；第二信号切换子单元的输入端与控制器的第二输出端连接，用于接收第二控制信号，第二信号切换子单元的输出端与第二开关子单元的输入端连接，第二开关子单元的输出端与模拟信号生成单元连接后与控制器的第一输入端和第二输入端连接。可以理解的，第一开关子单元与第二开关子单元可以是独立的开关单元，也可以集成在一个模块中；控制器的第一输出端用于输出第一控制信号，控制器的第二输出端用于输出第二控制信号。
如图5所示，本实施例中，模拟量接口单元还包括：隔离放大器U1及信号调理放大器U2；第一开关单元即开关模块U3的输出端与隔离放大器U1的输入端连接，隔离放大器U1的输出端与信号调理放大器U2的输入端连接，信号调理放大器U2的输出端与控制器的第一输入端和第二输入端连接。其中，开关模块U3为模拟开关，U1为隔离放大器，U2为调理放大器。可以理解的，开关模块U3还包括分压电阻R2、二极管D1、限压二极管D2、滤波电阻R5、滤波电容C8等组成的相关外围电路；隔离放大器U1还包括其相关外围电路的滤波电容C2、C3及C4；调理放大器U2还包括和其相关外围电路的电阻R1、R4、R6、R7、R11及R12，以及电容C1、C5、C6、C7及C9。第一模拟信号，即采集的现场信号AI0与开关模块U3的S端连接，开关模块U3的D端经电阻R5与隔离放大器U1的IN端连接。
如图6所示，本实施例中，第一开关子单元及第二开关子单元均为光耦，信号切换单元还用于进行信号的光耦隔离。具体的，在本实施例中，第一开关子单元及第二开关子单元集成在一个光耦模块中，作为集成光耦模块的两个控制通道。例如，在一个具体实例中，集成光耦模块为ASSR5，第一开关子单元及第二开关子单元分别为ASSR5中的两个控制通道，ASSR5的A1端、K1端、NO1端及CO1端分别为第一开关子单元的第一输入端、第二输入端、第一输出端及第二输出端，ASSR5的A2端、K2端、NO2端及CO2端分别为第二开关子单元的第一输入端、第二输入端、第一输出端及第二输出端。
具体的，第一信号切换子单元包括：开关元件，其中，开关元件为三极管Q17；开关信号生成子单元包括：二极管D4、电阻R14及电阻R8；三极管Q17的基极经电阻R158与控制器的第一输出端连接，三极管Q17的发射极接地，三极管Q17的集电极经电阻R162与 ASSR5的K1端连接，ASSR5的A1端与24V电源连接；ASSR5的NO1端与二极管D4的负极端、电阻R14的第一端及电阻R8的第一端分别连接后与开关模块U3的IN端连接，二极管D4的正极端接地，电阻R14的第二端接第一正电压信号，第一正电压信号为+24V电压，电阻R8的第二端与ASSR5的CO1端连接。本实施例中，令控制器的第一输出端为DIAG-EN，ASSR5的NO1端与二极管D4的负极端、电阻R14的第一端及电阻R8的第一端的连接点记为T-N。
第二信号切换子单元包括：开关元件，其中，开关元件为三极管Q18；第二模拟信号生成单元包括：二极管D5、电阻R10及电阻R16；三极管Q18的基极通过电阻R163与控制器的第二输出端连接，三极管Q18的发射极接地，三极管Q18的集电极通过电阻R167与ASSR5的K2端连接，ASSR5的A2端与电源连接；ASSR5的NO2端接第二正电压信号，其中第二正电压信号为+12V电压，ASSR5的CO2端与电阻R10的第一端连接，电阻R10的第二端与电阻R16的第一端及第二二极管D5的负极端连接后，经电阻R2、二极管D1及电阻R5后与隔离放大器U1的IN端连接，再经隔离放大器U1及信号调理放大器U2与控制器的第一输入端和第二输入端连接，第四电阻R16的第二端与二极管D5的正极端连接后接地。本实施例中，令控制器的第二输出端为DIAG-TEST，电阻R10的第二端与电阻R16的第一端及二极管D5的负极端的连接点记为T-P。
其中，控制器还用于：将其第一输入端和第二输入端接收到的第一模拟信号分别与预设模拟量信号阈值进行比较，若依据比较结果确定控制器的第一输入端或第二输入端接收到的第一模拟信号异常，生成第一故障报警信号；以及将其第一输入端和第二输入端接收到的第二模拟信号分别与预设模拟量信号阈值进行比较，若依据比较结果确定控制器的第一输入端或第二输入端接收到的第二模拟信号异常，生成第二故障报警信号。
若依据比较结果确定控制器的第一输入端或第二输入端接收到的第一模拟信号无异常，根据该无异常的第一模拟信号生成对应的控制信号，并发送至逻辑表决模块；若依据比较结果确定控制器的第一输入端和第二输入端接收到的第一模拟信号均无异常，根据任一无异常的第一模拟信号生成对应的控制信号，并发送至逻辑表决模块；若依据比较结果确定控制器的第一输入端和第二输入端接收到的第一模拟信号均异常，生成输出故障的告警信号。
其中，若控制器的第一输入端及第二输入端接收到的外部现场模拟量输入信号均在预设范围内，且控制器的第一输入端及第二输入端接收到的两路外部现场模拟量输入信号之间的偏差也在预设偏差范围内，则判定两路模拟量值均有效，则对控制器的第一输入端和第二输入端接收到的两路外部现场模拟量输入信号值求平均后，作为目标输入信号，即此模拟量输入通道的模拟量输入计算值；否则，标记两路转换的模拟量值均无效，并产生故障报警。若只有控制器的第一输入端或第二输入端中的一路接收到的外部现场模拟量输入信号在预设范围内，则此路转换的模拟量值有效，作为目标输入信号，即此模拟量输入通道的模拟量输入计算值。另一路转换的模拟量值因不在预设范围内，标记此路转换的模拟量值无效，并产生故障报警。
本申请通过将输入的现场信号一分为二，输入控制器的两个不同输入端，控制器通过对两个不同输入端输入的现场信号进行异常诊断，能够有效保证用于计算控制信号的现场信号的准确性，从而提高控制器输出的控制信号的准确率；通过对现场信号和自检信号进行切换，能够实现对I/O通道自诊断的全覆盖。例如，若控制器判断现场信号无异常，但自检信号异常，则可确定故障位置为信号切换单元；若控制器判断自检信号无异常，但现场信号异常，则可确定故障位置为接口模块、第一开关单元或现场信号传输介质。这样，本申请实际上实现了对输出信号的两级诊断：第一级诊断实现了对现场信号/自检信号的异常诊断，保证了控制器输出的控制信号的准确性；第二级诊断实现了对冗余的控制信号本身是否异常的诊断，保证了最终输出到执行单元的控制信号的准确性。从而解决了现有SIS缺乏小型化自诊断回路，无法实现对I/O通道100％自诊断覆盖的技术问题。
在系统正常运行未进行自诊断时，DIAG-EN为低电平，三极管Q17不导通，T-N为高电平，模拟开关U3的S端和D端导通，外部现场信号AI0通过U3的D-S导通端输入由R5、C8构成的阻容滤波电路和隔离放大器U1，再经过信号调理放大器U2进行电平偏移、有源滤波及增益变换后，转换为在控制器内部的A/D转换器变换范围内的模拟电压信号； 同时，由于此时未进行自检，DIAG-TEST为低电平，TEST即ASSR5的CO2端为零电平，T-P自检信号的电压为零电压，这样利用二极管D1的反向阻断特性，不会影响外部的现场信号AI0。通过调理放大器U2输入的模拟电压信号由控制器内部两路独立的A/D转换器分别采集变换为数字量后，控制器将两路经A/D转换后的数字量进行比较，当转换后的数字量值均在预先设定的范围内，且两路数字量值的偏差在预先设定的范围内时，将输入信号作为最终用于用户逻辑处理计算的目标模拟量输入信号，否则产生模拟量输入信号偏差大的报警。
在系统正常运行且需要进行自诊断的时候，控制器的第一输出端输出第一控制信号，此时DIAG-EN为高电平，Q17导通，T-N为低电平，模拟开关U3的S端和D端截止，为断路，外部现场信号AI0被阻断；同时，控制器的第二输出端输出第二控制信号，此时DIAG-TEST为高电平，TEST为高电平，产生T-P自检电压信号，经过二极管D1单向导通，电阻R2和R5的分压以及经阻容滤波后，输入隔离放大器U1；再经过信号调理放大器U2进行电平偏移、有源滤波、增益变换等，转换成在控制器内部的A/D转换器变换范围内的模拟电压信号；通过调理放大器U2输入的模拟电压信号由控制器内部两路独立的A/D转换器分别采集变换为数字量，之后控制器将两路A/D转换后的数字量进行比较，当偏差在预先设定的范围外时，产生模拟量输入信号偏差大的报警。
其中，控制器还用于：持续获取预设时间段内，控制器的第一输入端及第二输入端接收到的第一模拟信号或第二模拟信号，生成表征控制器的第一输入端在预设时间段内获取到的第一模拟信号或第二模拟信号的变化趋势的第一曲线，以及表征控制器的第二输入端在预设时间段内获取到的第一模拟信号或第二模拟信号的变化趋势的第二曲线；将第一曲线及第二曲线与预设模拟量信号变化曲线进行比较，若第一曲线或第二曲线与预设模拟量信号变化曲线的偏差大于曲线偏差阈值，确定第一曲线或第二曲线异常。
例如，持续获取3个月内的外部现场模拟量输入信号或自检电压信号，分别构建该时间段内，控制器的第一输入端接收到的模拟信号的第一曲线及控制器的第二输入端接收到的模拟信号的第二曲线。分别将第一曲线及第二曲线与预设的模拟量信号变化曲线进行匹配，确定第一曲线及第二曲线与模拟量信号变化曲线的偏差，其中，预设的模拟量信号变化曲线是在前一个运行周期，系统处于正常工况下，在相同时间段采集存储的模拟量信号的变化曲线，作为本运行周期的正常对比曲线，其中，运行周期可以设为3个月。可以理解的，若第一曲线或第二曲线中的多个点位与模拟量信号变化曲线上同点位的偏差大于偏差阈值，则认为对应模拟量输入通路存在电路故障。其中，多个点位与模拟量信号变化曲线上同点位的偏差大于偏差阈值可以是连续N个监测点位的模拟量值与模拟量信号变化曲线上同点位的模拟量值偏差均大于偏差阈值，也可以是第一曲线或第二曲线的某一区间内的N个监测点位的模拟量值与模拟量信号变化曲线上同点位的模拟量值偏大于偏差阈值，还可以是第一曲线或第二曲线的所有监测点位中的N个监测点位的模拟量值与模拟量信号变化曲线上同点位的模拟量值偏大于偏差阈值，对此本实施例不作限定。
实施例3
如图7所示，在实施例1的基础上，为了实现对I/O通道中开关量接口的自诊断，开关量接口单元包括：开关量输出单元及采样单元；控制器的输出端与开关量输出单元的输入端连接，采样单元的输入端与开关量输出单元的输出端连接，采样单元的输出端与控制器的输入端连接，开关量输出单元的输出端与执行单元连接；开关量输出单元用于根据控制器发送的开关量信号，生成与当前开关量信号对应的第三控制信号并以第三控制信号作为控制信号发送至逻辑表决模块，以及根据控制器发送的自检信号，生成与自检信号对应的第四控制信号，采样单元用于将第三控制信号及第四控制信号反馈至控制器。
正常工作时，控制器的输出端DO输出开关量信号，开关量输出单元根据控制器输出的开关量信号生成对应的第三控制信号以控制受控设备，例如，当开关量信号为高电平信号时，开关量输出单元输出高电平的第三控制信号，当开关量信号为低电平信号时，开关量输出单元输出低电平的第三控制信号；采样单元对开关量输出单元输出的第三控制信号进行采样并将第三控制信号的电压采样信号反馈至控制器，可以理解的，控制器的输入端还连接有A/D转换模块，输入控制器输入端的电压采样信号经A/D转换模块进行A/D变换后，转化为对 应的数字信号后传输至控制器的逻辑处理单元，以进行通信、自检、计算等动作。这样，控制器能够通过将采样电压信号与其输出的开关量信号进行匹配以判断输出信号是否正常，例如，控制器输出的开关量信号为高电平信号，经开关量输出单元输出的第三控制信号也应该为高电平信号，若采样单元反馈的采样电压信号为低电平信号，则说明输出的控制信号异常，则控制器发送告警信息以提示输出信号异常或开关量信号输出通道故障。同理，自检时，控制器输出的自检信号驱动开关量输出单元输出的第四控制信号，采样单元将第四控制信号的电压采样信号反馈至控制器，若控制器判断第四控制信号的采样电压信号与自检信号匹配，则说明开关量信号输出通道正常，若控制器判断第四控制信号的采样电压信号与自检信号不匹配，则判断开关量信号输出通道故障，控制器发送告警信息以提示开关量信号输出通道故障。
如图8所示，本实施例中，开关量输出单元包括：第一开关元件及光耦隔离单元；第一开关元件的控制端与控制器的输出端连接，光耦隔离单元的输入端通过第一开关元件构成隔离控制回路，光耦隔离单元的输出端与受控设备连接；第一开关元件根据控制器输出的开关量信号控制隔离控制回路的通断，以控制光耦隔离单元的输出端生成与当前开关量信号对应的第三控制信号。
其中，光耦隔离单元ASSR1为含两个通道的固态继电器，第一开关元件为三极管Q6，开关量输出单元还包括：第一电阻R118、第二电阻R120及第一二极管D61；控制器的输出端DIO1通过第一电阻R118与第一开关元件的基极连接，第一开关元件的发射极接地，第一开关元件的集电极通过第二电阻R120与光耦隔离单元ASSR1的第二输入端K1连接，光耦隔离单元ASSR1的第一输入端A1与电源连接；光耦隔离单元ASSR1的第一输出端NO1与第一二极管D61的负极端连接，第一二极管D61的正极端与受控设备连接，光耦隔离单元ASSR1的第二输出端CO1与受控设备连接，光耦隔离单元ASSR1的第一输出端NO1、第二输出端CO1及受控设备构成受控设备的控制回路；光耦隔离单元ASSR1的第一输入端A1及第二输入端K1通过第一开关元件构成第一隔离控制回路，第一开关元件根据控制器输出的开关量信号控制第一隔离控制回路的通断，以通过控制光耦隔离单元ASSR1的第一输出端NO1及第二输出端CO1之间的通断在受控设备的控制回路上生成与当前开关量信号对应的第三控制信号。例如，光耦隔离单元ASSR1的第一输出端NO1、第二输出端CO1与受控设备的控制电路构成回路，当控制器输出高电平的开关量信号时，三极管Q6导通，光耦隔离单元ASSR1的第一输入端A1与第二输入端K1回路导通，其回路中的发光二极管点亮，从而令光耦隔离单元ASSR1的第一输出端NO1与第二输出端CO1导通，则受控设备的控制电路导通，输出对应的第三控制信号如高电平的第三控制信号，从而实现对受控设备的控制。
如图9所示，采样单元，包括：电压采样单元ACPL1及第三电阻R111，其中电压采样单元ACPL1采用直流电压采样芯片；电压采样单元ACPL1的DC+端通过第三电阻R111与光耦隔离单元ASSR1的NO1端及第一二极管D61的负极端连接，电压采样单元ACPL1的DC-端与光耦隔离单元ASSR1的CO1端连接，用于采集第三控制信号的电压信号，电压采样单元ACPL1的输出端与控制器的输入端连接，用于将第三控制信号的电压信号反馈至控制器。优选的，采样单元还包括电阻R112级电容C129，电压采样单元ACPL1的VCC端与电阻R112的第一端连接后与控制器的输入端连接，电阻R112的第二端与电压采样单元ACPL1的VO端连接，电容C129的第一端与电压采样单元ACPL1的VCC端连接，电容C129的第二端与电压采样单元ACPL1的GND端连接，电压采样单元ACPL1的GND端接地。上述电路构成了光隔离回读电压采样电路。
本实施例中，自检信号为窄脉冲信号，控制器还用于：根据当前开关量信号生成对应的窄脉冲信号，包括：若当前开关量信号为高电平信号，生成先低电平再高电平的窄脉冲信号；若当前开关量信号为低电平信号，生成先高电平再低电平的窄脉冲信号。具体的，可以在每个开关量输出周期启动自检程序，CPU输出一个微秒级的与正常输出开关量信号相反的窄脉冲自检信号，例如若第三控制信号为高电平信号，固态继电器ASSR1的正常输出为触点闭合，NO1端与CO1端导通，则输出的窄脉冲自检信号为低电平-高电平的窄脉冲信号，以使固态继电器ASSR1的对应触点瞬间断开然后闭合；反之如固态继电器ASSR1正常输出为 触点打开，则窄脉冲自检信号使固态继电器ASSR1触点瞬间闭合然后断开，经光隔离固态继电器ASSR1隔离后输出到现场，CPU通过光隔离的回读电压采样单元将固态继电器ASSR1输出触点状态的电压波形回读，并与输出的窄脉冲自检信号波形对比，如果不一致则报警。由于输出的窄脉冲自检信号为微秒级，对开关量输出触点的状态改变不会引起现场执行机构的动作，这样可以实现开关量输出信号通道的覆盖率100％的自诊断。
如图10所示，本实施例的开关量输出信号通道自诊电路还可扩展为对多路受控设备进行控制，例如，电路还包括：电压采样单元ACPL2、二极管D63、电容C131、电阻R117、电阻R116、电阻R123、电阻R125及三极管Q8。
电压采样单元ACPL2的VCC端与第五电阻R117的第一端连接后与控制器的输入端连接，电阻R117的第二端与电压采样单元ACPL2的VO端连接，电容C131的第一端与电压采样单元ACPL2的VCC端连接，电容C131的第二端与电压采样单元ACPL2的GND端连接，电压采样单元ACPL2的GND端接地。电压采样单元ACPL2的DC+端通过电阻R116与光耦隔离单元ASSR1的NO2端及二极管D63的负极端连接，电压采样单元ACPL2的DC-端与光耦隔离单元ASSR1的CO2端连接，光耦隔离单元ASSR1的NO2端与二极管D63的负极端连接连接，二极管D63的正极端及光耦隔离单元ASSR1的CO2端与第二路受控设备的控制电路连接，构成受控设备的控制回路。
控制器的输出端DIO0通过电阻R123与三极管Q8的基极连接，三极管Q8的发射极接地，三极管Q8的集电极通过电阻R12与光耦隔离单元ASSR1的第四输入端K2连接，光耦隔离单元ASSR1的第三输入端A2与电源连接。
本实施例中，控制器还用于：将当前开关量信号与第三控制信号进行匹配，若当前开关量信号与第三控制信号不匹配，生成第一故障报警信号；以及将自检信号与第四控制信号进行匹配，若自检信号与第四控制信号不匹配，生成第二故障报警信号。例如，控制器输出的开关量信号为高电平信号，但采样到的第三控制信号的电压信号表现为低电平信号，则表明输出异常，此时判断开关量信号输出通道可能故障，生成第一故障报警信号，逻辑表决模块根据预先确定的表决逻辑对处理模块A及处理模块B输出的开关量信号执行表决并产生执行控制信号；同理，在自检时，若控制器输出的自检信号为高电平-低电平信号，但采样到的第四控制信号的电压信号并不为高电平-低电平信号，则表明输出异常，此时判断开关量信号输出通道可能故障，生成第二故障报警信号。可以理解的，控制器可以在每个开关量周期产生一次自检信号，以执行一次开关量信号输出通道自检。
以下通过具体实例对本实施例的方法进行说明：
在正常运行未进行自诊断的时候，当DIO1为高电平时，Q6导通，ASSR1第一个光隔离固态继电器输出触点NO1和CO1闭合，导致R111上产生电压变化；CPU通过光隔离电压采集芯片ACPL1回读R111电压变化信号，再与DIO1输出信号的高低电平进行比较，当不一致时产生报警。
在正常运行未进行自诊断的时候，当DIO1为低电平时，Q6不导通，ASSR1第一个光隔离固态继电器输出触点NO1和CO1断开，从而在R111上产生电压变化；CPU通过光隔离电压采集芯片ACPL1，回读R111电压变化信号，再与DIO1输出信号的高低电平进行比较，当不一致时产生报警。
在正常运行需要进行自诊断的时候，当当前开关量信号为高电平，即DIO1为高电平时，ASSR1的第一个光隔离固态继电器输出触点NO1和CO1闭合，此时CPU令DIO1产生一个微秒级的低电平窄脉冲自检信号，瞬时断开NO1和CO1触点；从而在R111上产生电压变化，CPU通过光隔离电压采集芯片ACPL1，回读R111电压变化信号，再与DIO1输出的自检信号的高低电平进行比较，当不一致时产生报警。
在正常运行需要进行自诊断的时候，当DIO1为低电平时，ASSR1第一个光隔离固态继电器输出触点NO1和CO1断开，此时CPU令DIO1产生一个微秒级的高电平窄脉冲自检信号，瞬时闭合NO1和CO1触点，此时会在R111上产生电压变化，CPU通过光隔离电压采集芯片ACPL1回读R111的电压变化信号，再与DIO1输出自检信号高和低电平进行比较，当不一致时产生报警。
其中，控制器还用于：通过采样单元持续获取预设时间段内的第三控制信号或第四控制 信号，生成表征第三控制信号的电压变化趋势的第一曲线或生成表征第四控制信号的电压变化趋势的第二曲线；将第一曲线或第二曲线与预设电压变化曲线进行比较，若第一曲线或第二曲线与预设电压变化曲线的偏差大于曲线偏差阈值，确定第一曲线或第二曲线异常。其中，预设电压变化曲线可以为根据至少1个开关量输出周期的开关量输出信号的理论电压随时间的变化情况得到的趋势曲线，或者预设电压变化曲线可以为根据至少1个开关量输出周期的自检信号的理论电压随时间的变化情况得到的趋势曲线，可以理解的，每个开关量输出周期中，开关量的输出是固定的。
以对开关量信号进行监测为例，持续获取N个开关量输出周期的开关量输出信号的采样电压信号，得到第一曲线，将第一曲线与预设电压变化曲线进行比较，若第一曲线中的多个采样点与预设电压变化曲线上同点位的偏差大于电压偏差阈值，则认为对开关量输出通道故障。其中，多个采样点与预设电压变化曲线上同点位的偏差大于电压偏差阈值可以是连续N个采样点位的电压值与预设电压变化曲线上同点位的电压值偏差均大于电压偏差阈值，也可以是第一曲线某一区间内的N个采样点位的电压值与预设电压变化曲线上同点位的电压值偏差大于电压偏差阈值，还可以是第一曲线的所有采样点位中的N个采样点位的电压值与预设电压变化曲线上同点位的电压值偏大于电压偏差阈值，对此本实施例不作限定。可以理解的，本实施例还可以通过对自检信号进行持续监测以判断输出通道是否故障。通过采集一段时间内的自检信号的窄脉冲波形信号，连续比对一段时间内脉冲波形的趋势变化，可对电路器件的退化性能进行连续监测，实现电路故障预测。
实施例4
如图11所示，在实施例1的基础上，为了实现对I/O通道中数字量接口的自诊断，数字量接口单元，包括：第二开关单元、第一信号隔离单元及输出判断单元；第二开关单元串联在第一信号隔离单元的输入端回路上，控制器与第二开关单元及第一信号隔离单元的输入端回路连接，输出判断单元连接在第一信号隔离单元的输出端回路上，第一信号隔离单元的输出端回路与控制器的第一输入端及第二输入端连接，第一信号隔离单元的输入端回路还用于接入外部输入的数字量输入信号；控制器用于向第一信号隔离单元的输入端回路发送自检信号，以及向第二开关单元发送开关控制信号以控制第二开关单元导通或断开，第一信号隔离单元的输入端回路在第二开关单元导通时导通，在第二开关单元断开时断开；输出判断单元用于在第一信号隔离单元的输入端回路断开时通过第一信号隔离单元的输出端回路输出高电平的判断信号，第一信号隔离单元的输出端回路在第一信号隔离单元的输入端回路导通且数字量输入信号或自检信号为高电平信号时输出低电平的判断信号。
本实施例中，控制器的至少两个输入端优选为控制器的第一输入端和第二输入端。其中，控制器的第一输入端和第二输入端连接有A/D转换模块，输入控制器的第一输入端和第二输入端的模拟信号经A/D转换模块进行A/D变换后，转化为对应的数字信号后传输至控制器的逻辑处理单元，以进行通信、自检、计算等动作。控制器通过向第二开关单元发送控制信号来控制第二开关单元导通，此时，第一信号隔离单元的输入端回路处于通路状态，其中，第一信号隔离单元可以为光耦。来自现场的0/24VDC实际数字量信号输入第一信号隔离单元的输入端回路，第一信号隔离单元的输出端回路根据现场数字量信号输出对应的判断信号，例如，现场的数字量信号为24VDC信号时，第一信号隔离单元的输入端回路得电，其内部的发光二极管点亮，控制第一信号隔离单元的输出端回路导通，此时第一信号隔离单元的输出端回路输出低电平的判断信号；若现场的数字量信号为0VDC信号，则第一信号隔离单元内部的发光二极管不会被点亮，第一信号隔离单元的输出端回路断开，此时第一信号隔离单元的输出端回路在输出判断单元的作用下输出高电平的判断信号，从而将数字量输入信号转换成在A/D变换范围内的标准模拟电压信号。第一信号隔离单元的输出端回路输出的判断信号分别传输至控制器的第一输入端及第二输入端，再由两路A/D转换器同时采集变换为数字量；控制器通过两路转换的数字量与预先设定值的比较，经过两次运算进行结果比较，获得最终用于逻辑处理计算的判断信号，当偏差在预先设定的范围内时，该信号作为最终用于用户逻辑处理计算的输入信号，否则由于输入信号偏差大而报警。需要自检时，控制器通过自检控制程序输出I/O控制信号，经光耦隔离后控制第二开关单元导通，并向第一信号隔离单元输入自检信号，将现场实际信号切换为自检电压信号，从而对数字量输入通道注入检 测信号，控制器根据两个输入端接收到的自检信号是否异常来判断数字量输入信号的输入通道是否故障，从而实现对数字量输入信号采集通道的100％故障自诊断。其中，自检信号也可以为0/24VDC的自检信号。
如图12所示，本实施例中，第二开关单元包括：第二开关元件及第四电阻R110；控制器的第一输出端通过第四电阻R110与第二开关元件的控制端连接，控制器通过控制器的第一输出端发送开关控制信号。第一信号隔离单元包括：光耦单元U44；光耦单元U44的第一输入端与控制器的第二输出端连接并接数字量输入信号，光耦单元U44的第二输入端通过开元件接地，控制器通过控制器的第二输出端发送自检信号；光耦单元U44的第一输出端与控制器至少两个输入端及输出判断单元连接，第二输出端接地。
其中，第二开关元件为三极管Q5，光耦单元U44采用型号为FOD817的光耦器件。控制器的第一输出端通过第四电阻R110与三极管Q5的基极连接，三极管Q5的发射极与接地，三极管Q5的集电极与光耦单元U44的负极端连接，光耦单元U44的正极端与控制器的第二输出端连接及现场输入的数字量信号连接。光耦单元U44的集电极端控制器的第一输入端及第二输入端连接，发射极接地，且输出判断单元连接在光耦单元U44的集电极上。控制器的第一输出端输出的开关控制信号T-N经第四电阻R110至三极管Q5的基极，从而控制三极管Q5集电极和发射极导通，光耦单元U44的输入端回路为通路状态。
可选地，数字量接口单元还包括：第二信号隔离模块及第五电阻R114；第二信号隔离模块通过第五电阻R114与光耦单元U44的第一输入端连接；控制器的第二输出端通过第二信号隔离模块与第五电阻R114连接，数字量输入信号通过第二信号隔离模块传输至光耦单元U44的第一输入端；第二隔离模块用于隔离数字量输入信号及自检信号。
具体的，第二信号隔离模块包括：第二二极管D3及第三二极管D4；第二二极管D3的负极端通过第五电阻R114与光耦单元U44的正极端连接，第二二极管D3的正极端与现场数字量输入信号连接；第三二极管D4的负极端通过第五电阻R114与光耦单元U44的正极端连接，第三二极管D4的正极端与控制器的第二输出端连接，用于接收控制器输出的自检信号TEST，通过第二二极管D3及第三二极管D4的作用，能够有效避免现场数字量输入信号与自检信号的相互干扰。可以理解的，现场数字量输入信号通过传输接口与三极管Q5的发射极连接，传输接口可以为任一数字量输入信号的接口，此处对此不作限定，如图10所示，现场数字量输入信号记为DI2。
可选地，输出判断单元包括：第六电阻R113及第七电阻R115；第六电阻R113的第一端接5V稳压供电电源，第六电阻R113的第二端与第七电阻R115的第一端及光耦单元U44的集电极端连接后与控制器的第一输入端及第二输入端连接；第七电阻R115的第二端接地。
第六电阻R113及第七电阻R115并联后与光耦单元U44的集电极端连接，并输出最终用于用户逻辑处理计算的模拟量电压信号CHAN2即判断信号至控制器的第一输入端及第二输入端，控制器内部通过A/D变换将采集的模拟电压信号CHAN2用于诊断与故障预测。
本实施例中，数字量接口单元还包括：第三信号隔离模块，其中第三信号隔离模块为光耦；控制器的第一输出端通过第三信号隔离模块与第四电阻R110连接。
本实施例的工作原理如下：
在系统正常运行未进行自诊断时，由于无需自诊断，TEST信号为低电平，即控制器无自检信号输入，T-N控制信号为高电平，此时三极管Q5导通。如果此时外部的数字量输入信号DI2输入为24V高电平，则DI2导通第二二极管D3和第五电阻R114控制光耦U44的输入端，光耦U44输入端的内部发光二极管被导通发光，光耦U44输出端接收输入端的发光信号导通接地，发送给控制器的输出模拟电压信号CHAN2为低电平0V；如果此时数字量输入外部信号DI2输入为0V低电平，则第二二极管D3和第五电阻R114处于截止状态，光耦U44输入端被截止不发光，光耦U44输出端接收不到输入端的发光信号也截止，发送给控制器的输出模拟电压信号CHAN2在上拉电阻R113和5V电源的作用下为高电平，显示为5V。
在系统正常运行需要进行自诊断的时候，若TEST信号为高电平，T-N控制信号为高电平，此时三极管Q5导通。此时处于不安全状态，若数字量输入外部信号DI2不带电，为低电平0V，则TEST信号导通第二二极管D3和第五电阻R114控制光耦U44输入端，光耦 U44输入端被导通发光，光耦U44输出端接收输入端的发光信号导通接地，发送给控制器的输出模拟电压信号CHAN2为低电平0V。
在系统正常运行需要进行自诊断的时候，若TEST信号为低电平，T-N控制信号为高电平，此时三极管Q5导通。此时处于不安全状态，若数字量输入外部信号DI2不带电，即DI2为低电平0V，则第二二极管D3和第五电阻R114处于截止状态，光耦U44输入端被截止不发光，光耦U44输出端接收不到输入端的发光信号也截止，发送给CPU的输出模拟电压信号CHAN2在上拉电阻R113和5V电源的作用下为高电平，显示为5V。
在系统正常运行需要进行自诊断的时候，若TEST信号为高电平，T-N控制信号为高电平，此时三极管Q5导通。此时处于安全状态，若数字量输入外部信号DI2带电，即DI2输入为24V高电平，则DI2导通第二二极管D3和第五电阻R114控制光耦U44输入端，光耦U44输入端被导通发光，光耦U44输出端接收输入端的发光信号导通接地，发送给控制好钱的输出模拟电压信号CHAN2为低电平0V。
在正常运行需要进行自诊断的时候，若TEST信号为低电平，T-N控制信号为高电平，此时三极管Q5导通。此时处于安全状态，数字量输入外部信号DI2带电，DI2输入为24V高电平，则DI2导通第二二极管D3和第五电阻R114控制光耦U44输入端，光耦U44输入端被导通发光，光耦U44输出端接收输入端的发光信号导通接地，发送给CPU的输出模拟电压信号CHAN2为低电平0V。
在系统正常运行需要进行自诊断的时候，若T-N控制信号为低电平，此时三极管Q5截止。则无论TEST信号为高、低电平时，光耦U44输入端断路截止不发光，U44输出端接收不到输入端的发光信号也截止，发送给控制器的输出模拟电压信号CHAN2在上拉电阻R113和5V电源的作用下为高电平，显示为5V。
同时，还可以通过持续采集外部现场数字量输入信号对应的输出模拟电压信号CHAN2至控制器内部的A/D转换器，例如，通过3个月的运转，持续监测光耦U44及第六电阻R113和第七电阻R115漂移和退化趋势，可以进行故障预测。可以理解的，由于第六电阻R113和第七电阻R115的阻值已知，通过采集输出模拟电压信号CHAN2的电压值即可计算得到第六电阻R113和第七电阻R115的电压值，其计算过程为现有技术，此处不做限定。
本实施例中，第一信号隔离单元的输入端回路接收外部输入的数字量输入信号，并通过第一信号隔离单元的输出端回路输出与数字量输入信号对应的第一判断信号至控制器的第一输入端及第二输入端，控制器还用于：将其第一输入端及第二输入端接收到的第一判断信号进行模数转换后分别与数字量信号阈值进行比较，若依据比较结果确定控制器的任一输入端接收到的第一判断信号异常，生成第一故障报警信号；以及自检时，向第一信号隔离单元的输入端回路发送自检信号，并通过第一信号隔离单元的输出端回路输出与自检信号对应的第二判断信号至控制器的第一输入端及第二输入端，将其第一输入端及第二输入端接收到的第二判断信号进行模数转换后分别与数字量信号阈值进行比较，若依据比较结果确定控制器的任一输入端接收到的第二判断信号异常，生成第二故障报警信号。
具体的，来自现场的0/24VDC数字量信号经过光耦隔离，转换成在A/D变换范围内的标准模拟电压信号；再由控制器的两路A/D转换器同时采集变换为数字量；控制器通过两路转换的数字量与预先设定的数字量信号阈值进行比较，经过两次运算进行结果比较，获得最终用于逻辑处理计算的判断信号，当偏差在预先设定的范围内时，该信号作为最终用于用户逻辑处理计算的模拟量输入信号，否则由于产生模拟量输入信号偏差大而报警。
其中，若控制器的任一入端接收到的第一判断信号与数字量信号阈值的差值大于预设差值范围，确定控制器对应输入端接收到的第一判断信号异常；若控制器的任一入端接收到的第二判断信号与数字量信号阈值的差值大于预设差值范围，确定控制器对应输入端接收到的第二判断信号异常。例如，若控制器的第一输入端及第二输入端中某一路判断信号经A/D转换的数字量与预设的数字量信号阈值的差值大于预设差值范围，则可确定该路输入的判断信号异常，则该路的输入值无效，该值不能作为控制器用于逻辑计算的目标值，控制器产生故障报警。
本实施例中，控制器还用于：持续获取预设时间段内，控制器的任一输入端接收到的判断信号，生成表征控制器对应输入端在预设时间段内获取到的判断信号的电压变化趋势的第 一曲线；若第一曲线与标准电压变化曲线的偏差大于曲线偏差阈值，确定第一曲线异常。
具体的，持续获取一段时间内如3个月内的判断信号，通控制器的两个输入端得到判断信号对应的电压值，分别构建该时间段内，控制器的第一输入端接收到的电压值的第一曲线及控制器的第二输入端接收到的电压值的第一曲线。分别将控制器的第一输入端对应的第一曲线及控制器的第二输入端对应的第一曲线与预设的标准电压变化曲线进行匹配，确定每一第一曲线与标准电压变化曲线的偏差，其中，标准电压变化曲线为理想状态下，判断信号的电压变化曲线。可以理解的，若第一曲线中的多个点位与标准电压变化曲线上同点位的偏差大于偏差阈值，则认为对应数字量输入通路存在电路故障。其中，多个点位与标准电压变化曲线上同点位的偏差大于偏差阈值可以是连续N个监测点位的电压值与标准电压变化曲线上同点位的电压值偏差均大于偏差阈值，也可以是第一曲线的某一区间内的N个监测点位的电压值与标准电压变化曲线上同点位的电压值偏差大于偏差阈值，还可以是第一曲线的所有监测点位中的N个监测点位的电压值与标准电压变化曲线上同点位的电压值偏大于偏差阈值，对此本实施例不作限定。
其中，控制器还用于：若依据比较结果确定控制器的第一输入端或第二输入端接收到的第一判断信号无异常，根据该无异常的第一判断信号生成对应的控制信号；若依据比较结果确定控制器的所有输入端接收到的第一判断信号均无异常，根据任一无异常的第一判断信号生成对应的控制信号；若依据比较结果确定控制器的所有输入端接收到的第一判断信号均异常，生成输出故障的告警信号并发送至逻辑表决模块。逻辑表决模块根据处理模块A及处理模块B生成的控制信号或告警信号执行表决并生成执行控制信号。
实施例5
在实施例1的基础上，为了对所有DI、AI和DO通道进行故障监测，本实施例的I/O通道单元包括实施例2的模拟量接口单元、实施例3的开关量接口单元及实施例4的数字量接口单元。
实施例6
在实施例1的基础上，本申请的RTU采用异构冗余通道设计，例如，冗余的处理模块A及处理模块B中，相关外围电路及控制器可以采用具有相同功能，但不同规格、型号的元器件，从而构建异构的冗余通道，以降低共因失效率，提升冗余系统的可靠性。
本申请采用FMEA模型计算冗余通道的共因失效率。具体的，首先根据诊断测试，将每种措施的总贡献分为X、Y两类，每种措施的X:Y的比值，表示了诊断措施能提高该措施抗共因失效的作用的程度。其中，X表示通过诊断测试能增加其克服共因失效特性；Y表示不能通过诊断测试增加克服共因失效的效果。则，S＝X+Y；SD＝X(Z+1)+Y；其中，X、Y的值可根据测试结果，依据预设标准确定，Z的值可根据诊断测试的频率和覆盖率确定。确定各项测试下X、Y的值后，分别计算X、Y的和值，根据预设标准，如IEC61508-6，根据X、Y的和值，通过查表确定β、βD系数评分，从而计算共因失效值。其中，β表示未检测到的故障的系数，βD表示检测到的故障的系数。
其中，对本申请电子元件的诊断测试贡献统计如下表：

根据上述测试项目评分，计算得到本申请的相关参数如下表：
作为对比，本申请提供的对比例中，冗余通道结构采用相同的硬件设计，对其电子元件的诊断测试贡献统计如下表：

根据上述测试项目评分，计算得到对比例的相关参数如下表：
上述可知，与采用同构冗余通道结构设计的对比例相比，本申请的系数β相比对比例更小，危险共因失效引起的总失效率为：λ＝λDUβ+λDDβD，其中，λDU为未检测到故障的单一通道的失效率，λDD为检测到故障的单一通道的失效率，因此，经计算，本申请的异构冗余通道相比对比例具有更小的共因失效率。
实施例7
如图13所示，在实施例5的基础上，提供一种安全控制系统，包括：执行单元；以及如上述的远程测控终端；远程测控终端用于根据外部输入信号生成对应的执行控制信号，并将执行控制信号发送至执行单元，以控制执行单元执行对应的动作。
其中，安全控制系统可以包括分布在一个或多个区域中的若干远程测控终端即RTU。RTU可以作为一种在远离其他控制系统如DCS的站点处提供局部化控制和数据访问的设备或系统，例如，RTU可以位于装置或者储罐现场处或附近。RTU可通过有线及无线网络与其他控制系统连接，例如微波、蜂窝或其他射频通信。RTU还与一个或多个工业现场设备进行通信和交互。该现场设备可以包括监测单元如测量过程的一个或多个特性的传感器、执行单元如改变过程的一个或多个特性的执行器或其他工业现场设备。本实施例中，RTU通过有线连接与现场设备如阀门、仪表等进行通信。其中，有线连接可以包括串行连接如RS458连接、以太网连接、工业协议连接或其他有线连接。
例如，RTU可以作为芳烃联合装置中的歧化进料加热炉的安全控制设备，通过设置在加热炉中的流量传感器及压力传感器实时采集加热炉的歧化进料流量及燃料气总管压力值，并通过有线或无线网络传输至RTU的两个处理模块中。当燃料气总管压力过低时，RTU通 过控制现场阀门切断燃料气进料，防止因加热炉熄火而出现加热炉内燃料气积聚而导致的遇明火爆炸；当加热炉进料流量过低时，RTU控制切断燃料气进料，以避免出现炉管干烧而损坏炉管，从而实现对加热炉的安全控制。为了避免对加热炉的安全控制失效，RTU的逻辑表决模块通过预设的逻辑表决结构对RTU的两个处理模块的输出信号进行表决处理，以保证在其中一路输出信号表示监测值过低时，即输出安全控制值，切断燃料气进料。
RTU还可以连接一个或多个人机接口(HMI)，如显示屏或控制台。HMI既可以显示RTU的运行状态，又可以通过数据传输对其进行控制。安全摄像机可以捕获静止或视频图像并经由RTU将该图像提供给远程位置如安全中心。无线电设备可以被用来支持RTU与远程接入点之间的无线通信，该远程接入点经由网络与其他控制系统通信。
本实施例的SIS还设置有工程师站和操作员站。工程师站为PC机，能够执行用户应用程序的编写并将用户应用程序下载到SD卡中，其中SD卡安装在模块的SD插槽内。操作员站与系统通过标准通讯协议进行通讯，监视系统运行状况，采集记录输入、输出状态、诊断和报警信息，SOE信息。为确保信息安全，操作员站与系统的通讯为单向，只读不写，SOE历史数据储存在操作员站。
通过对应用本实施例的RTU的系统进行验证，本实施例的系统诊断覆盖率DC大于90％，系统安全失效因子SFF大于90％，故障响应时间小于30秒，平均恢复时间MTTR小于48小时，能有效提高系统的可靠性。
综上，本发明的远程测控终端具有冗余的信号处理通道，当其中任一信号处理通道故障时，另一路信号处理通道能够输出准确的控制信号，从而有效提高了信号传输的可靠性和安全性，避免了因信号处理通道故障而导致控制安全事故。同时，本发明在处理模块中集成了包括诊断电路的DI、AI和DO接口单元，能够受控制器的控制，在需要自检时屏蔽现场信号并产生自检信号，实现对现场信号和自检信号进行切换，适于与控制器进行集成，满足小型化的需求。同时，本申请的冗余处理模块、处理模块的接口单元、对控制器输出的控制信号进行逻辑表决等技术特征的结合，实际上实现了对I/O通道的两级安全保障，第一级为将现场信号或自检信号分为两路输入控制器的两个输入端进行故障诊断，实现了接口模块-控制器端的故障诊断；第二级为将冗余控制器输出的控制信号进行异常判断后逻辑表决，确保输出正确的控制信号；同时，在第一级安全保障中，通过现场信号和自检信号的切换可实现对I/O通道故障的全覆盖诊断，以及故障位置的定位，从而实现数字量输入通道、模拟量输入通道及开关量输出通道的100％故障自诊断，诊断结果只报警而不直接改变系统输出结果。同时，本发明可长期监测数字量输入通道、模拟量输入通道及开关量输出通道的器件性能退化趋势，实现故障预测，并具有电路结构简单、可靠、器件少的优点。
以上结合附图详细描述了本发明的可选实施方式，但是，本发明实施方式并不限于上述实施方式中的具体细节，在本发明实施方式的技术构思范围内，可以对本发明实施方式的技术方案进行多种简单变型，这些简单变型均属于本发明实施方式的保护范围。另外需要说明的是，在上述具体实施方式中所描述的各个具体技术特征，在不矛盾的情况下，可以通过任何合适的方式进行组合。为了避免不必要的重复，本发明实施方式对各种可能的组合方式不再另行说明。本领域技术人员可以理解实现上述实施方式的方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得单片机、芯片或处理器(processor)执行本发明各个实施方式方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
此外，本发明的各种不同的实施方式之间也可以进行任意组合，只要其不违背本发明实施方式的思想，同样应当视为本发明实施方式所公开的内容。

Claims (24)

  1. 一种远程测控终端，其特征在于，包括：
    接口模块及处理模块；所述处理模块包括I/O通道单元及控制器，所述接口模块与所述I/O通道单元及所述控制器依次连接，所述I/O通道单元包括模拟量接口单元；
    所述模拟量接口单元包括：
    信号切换单元及第一开关单元；
    所述控制器与所述信号切换单元及所述第一开关单元依次连接，所述第一开关单元的输入端与所述接口模块连接，用于接入外部输入的第一模拟信号，所述第一开关单元的输出端用于将所述第一模拟信号发送至所述控制器的第一输入端和第二输入端；所述信号切换单元用于在接收到所述控制器输出的第一控制信号时控制所述第一开关单元断开，以切断所述第一模拟信号与所述控制器之间的连接，以及在接收到所述控制器输出的第二控制信号时产生第二模拟信号并将所述第二模拟信号发送至所述控制器的第一输入端和第二输入端。
  2. 根据权利要求1所述的远程测控终端，其特征在于，所述远程测控终端包括至少两个处理模块，所述远程测控终端还包括：
    逻辑表决模块；
    所述至少两个处理模块分别与所述接口模块及所述逻辑表决模块连接；
    所述至少两个处理模块分别通过所述接口模块获取外部输入信号，根据所述外部输入信号生成对应的控制信号并将生成的控制信号发送至所述逻辑表决模块；
    所述逻辑表决模块用于：
    在确定所述至少两个处理模块生成的控制信号中的任一者异常的情况下，以所述至少两个处理模块生成的控制信号中无异常的控制信号作为执行控制信号；
    在确定所述至少两个处理模块生成的控制信号均无异常的情况下，以所述至少两个处理模块生成的控制信号中的任一者作为执行控制信号；
    在确定所述至少两个处理模块生成的控制信号均异常的情况下，生成安全控制信号作为执行控制信号，以控制执行单元停止运行。
  3. 根据权利要求2所述的远程测控终端，其特征在于，所述I/O通道单元还包括：
    开关量接口单元及数字量接口单元。
  4. 根据权利要求2所述的远程测控终端，其特征在于，所述信号切换单元包括：
    第一信号切换子单元、第二信号切换子单元、第一开关子单元、第二开关子单元、开关信号生成子单元及第二模拟信号生成子单元；
    所述第一信号切换子单元的输入端与所述控制器的第一输出端连接，用于接收所述第一控制信号，所述第一信号切换子单元的输出端与所述第一开关子单元的输入端连接，所述第一开关子单元的输出端与所述开关信号生成子单元连接后与所述第一开关单元的控制端连接；
    所述第二信号切换子单元的输入端与所述控制器的第二输出端连接，用于接收所述第二控制信号，所述第二信号切换子单元的输出端与所述第二开关子单元的输入端连接，所述第二开关子单元的输出端与所述第二模拟信号生成子单元连接后与所述控制器的第一输入端和第二输入端连接；
    所述第一开关子单元及所述第二开关子单元均为光耦。
  5. 根据权利要求2所述的远程测控终端，其特征在于，所述控制器还用于：
    将其第一输入端和第二输入端接收到的第一模拟信号分别与预设模拟量信号阈值进行比较，若依据比较结果确定所述控制器的第一输入端或第二输入端接收到的第一模拟信号异常，生成第一故障报警信号；以及
    将其第一输入端和第二输入端接收到的第二模拟信号分别与所述预设模拟量信号阈值进行比较，若依据比较结果确定所述控制器的第一输入端或第二输入端接收到的第二模拟信号异常，生成第二故障报警信号。
  6. 根据权利要求5所述的远程测控终端，其特征在于，所述控制器还用于：
    若依据比较结果确定所述控制器的第一输入端或第二输入端接收到的第一模拟信号无异常，根据该无异常的第一模拟信号生成对应的控制信号；
    若依据比较结果确定所述控制器的第一输入端和第二输入端接收到的第一模拟信号均无异常，根据任一无异常的第一模拟信号生成对应的控制信号。
  7. 根据权利要求2所述的远程测控终端，其特征在于，所述控制器还用于：
    持续获取预设时间段内，所述控制器的第一输入端及第二输入端接收到的第一模拟信号或第二模拟信号，生成表征所述控制器的第一输入端在所述预设时间段内获取到的第一模拟信号或第二模拟信号的变化趋势的第一曲线，以及表征所述控制器的第二输入端在所述预设时间段内获取到的第一模拟信号或第二模拟信号的变化趋势的第二曲线；
    将所述第一曲线及所述第二曲线与预设模拟量信号变化曲线进行比较，若所述第一曲线或所述第二曲线与所述预设模拟量信号变化曲线的偏差大于曲线偏差阈值，确定所述第一曲线或所述第二曲线异常。
  8. 根据权利要求3所述的远程测控终端，其特征在于，所述开关量接口单元包括：
    开关量输出单元及采样单元；
    所述控制器的输出端与所述开关量输出单元的输入端连接，所述采样单元的输入端与所述开关量输出单元的输出端连接，所述采样单元的输出端与所述控制器的输入端连接，所述开关量输出单元的输出端与所述执行单元连接；
    所述开关量输出单元用于根据所述控制器发送的开关量信号，生成与当前开关量信号对应的第三控制信号并以所述第三控制信号作为控制信号发送至所述逻辑表决模块，以及根据所述控制器发送的自检信号，生成与所述自检信号对应的第四控制信号，所述采样单元用于将所述第三控制信号及所述第四控制信号反馈至所述控制器。
  9. 根据权利要求8所述的远程测控终端，其特征在于，所述开关量输出单元包括：
    第一开关元件及光耦隔离单元；
    所述第一开关元件的控制端与所述控制器的输出端连接，所述光耦隔离单元的输入端通过所述第一开关元件构成隔离控制回路，所述光耦隔离单元的输出端与所述逻辑表决模块连接；
    所述第一开关元件根据所述控制器输出的开关量信号控制所述隔离控制回路的通断，以控制所述光耦隔离单元的输出端生成与当前开关量信号对应的第三控制信号。
  10. 根据权利要求9所述的远程测控终端，其特征在于，所述第一开关元件为三极管，所述开关量输出单元还包括：
    第一电阻、第二电阻及第一二极管；
    所述控制器的输出端通过所述第一电阻与所述第一开关元件的基极连接，所述第一开关元件的发射极接地，所述第一开关元件的集电极通过所述第二电阻与所述光耦隔离单元的第二输入端连接，所述光耦隔离单元的第一输入端与电源连接；
    所述光耦隔离单元的第一输出端与所述第一二极管的负极端连接，所述第一二极管的正极端通过所述逻辑表决模块与所述执行单元连接，所述光耦隔离单元的第二输出端与所述执行单元连接，所述光耦隔离单元的第一输出端、第二输出端、逻辑表决模块及执行单元构成所述执行单元的控制回路；
    所述光耦隔离单元的第一输入端及第二输入端通过所述第一开关元件构成第一隔离控制回路，所述第一开关元件根据所述控制器输出的开关量信号控制所述第一隔离控制回路的通断，以通过控制所述光耦隔离单元的第一输出端及第二输出端之间的通断在所述执行单元的控制回路上生成与当前开关量信号对应的第三控制信号。
  11. 根据权利要求9所述的远程测控终端，其特征在于，所述采样单元包括：
    电压采样单元及第三电阻；
    所述电压采样单元的输入端通过所述第三电阻与所述光耦隔离单元的输出端连接，用于采集所述第三控制信号的电压信号，所述电压采样单元的输出端与所述控制器的输入端连接，用于将所述第三控制信号的电压信号反馈至所述控制器。
  12. 根据权利要求10所述的远程测控终端，其特征在于，所述自检信号为窄脉冲信号，所述控制器还用于根据当前开关量信号生成对应的窄脉冲信号，包括：
    若当前开关量信号为高电平信号，生成先低电平再高电平的窄脉冲信号；
    若当前开关量信号为低电平信号，生成先高电平再低电平的窄脉冲信号。
  13. 根据权利要求8所述的远程测控终端，其特征在于，所述控制器还用于：
    将当前开关量信号与所述第三控制信号进行匹配，若当前开关量信号与所述第三控制信号不匹配，生成第一故障报警信号；以及
    将所述自检信号与所述第四控制信号进行匹配，若所述自检信号与所述第四控制信号不匹配，生成第二故障报警信号。
  14. 根据权利要求8所述的远程测控终端，其特征在于，所述控制器还用于：
    通过所述采样模块持续获取预设时间段内的第三控制信号或第四控制信号，生成表征所述第三控制信号的电压变化趋势的第一曲线或生成表征所述第四控制信号的电压变化趋势的第二曲线；
    将所述第一曲线或所述第二曲线与预设电压变化曲线进行比较，若所述第一曲线或所述第二曲线与所述预设电压变化曲线的偏差大于曲线偏差阈值，确定所述第一曲线或所述第二曲线异常。
  15. 根据权利要求3所述的远程测控终端，其特征在于，所述数字量接口单元，包括：
    第二开关单元、第一信号隔离单元及输出判断单元；
    所述第二开关单元串联在所述第一信号隔离单元的输入端回路上，所述控制器与所述第二开关单元及所述第一信号隔离单元的输入端回路连接，所述输出判断单元连接在所述第一信号隔离单元的输出端回路上，所述第一信号隔离单元的输出端回路与所述控制器的第一输入端及第二输入端连接，所述第一信号隔离单元的输入端回路还用于接入外部输入的数字量输入信号；
    所述控制器用于向所述第一信号隔离单元的输入端回路发送自检信号，以及向所述第二开关单元发送开关控制信号以控制所述第二开关单元导通或断开，所述第一信号隔离单元的输入端回路在所述第二开关单元导通时导通，在所述第二开关单元断开时断开；
    所述输出判断单元用于在所述第一信号隔离单元的输入端回路断开时通过所述第一信号隔离单元的输出端回路输出高电平的判断信号，所述第一信号隔离单元的输出端回路在所述第一信号隔离单元的输入端回路导通且所述数字量输入信号或所述自检信号为高电平信号时输出低电平的判断信号。
  16. 根据权利要求15所述的远程测控终端，其特征在于，所述第二开关单元包括：
    第二开关元件及第四电阻；
    所述控制器的第一输出端通过所述第四电阻与所述第二开关元件的控制端连接，所述控制器通过所述控制器的第一输出端发送所述开关控制信号。
  17. 根据权利要求16所述的远程测控终端，其特征在于，所述第一信号隔离单元包括：
    光耦单元；
    所述光耦单元的第一输入端与所述控制器的第二输出端连接并接所述数字量输入信号，所述光耦单元的第二输入端通过所述第二开关元件接地，所述控制器通过所述控制器的第二输出端发送所述自检信号；
    所述光耦单元的第一输出端与所述控制器第一输入端、第二输入端及所述输出判断单元连接，所述光耦单元的第二输出端接地。
  18. 根据权利要求17所述的远程测控终端，其特征在于，所述数字量接口单元还包括：
    第二信号隔离单元及第五电阻；
    所述第二信号隔离单元通过所述第五电阻与所述光耦单元的第一输入端连接；
    所述控制器的第二输出端通过所述第二信号隔离单元与所述第五电阻连接，所述数字量输入信号通过所述第二信号隔离单元传输至所述光耦单元的第一输入端；
    所述第二信号隔离单元用于隔离所述数字量输入信号及所述自检信号。
  19. 根据权利要求18所述的远程测控终端，其特征在于，所述第二信号隔离单元包括：
    第二二极管及第三二极管；
    所述第二二极管的负极端通过所述第五电阻与所述光耦单元的第一输入端连接，所述第二二极管的正极端用于接入所述数字量输入信号；
    所述第三二极管的负极端通过所述第五电阻与所述光耦单元的第一输入端连接，所述第三二极管的正极端与所述控制器的第二输出端连接。
  20. 根据权利要求17所述的远程测控终端，其特征在于，所述输出判断单元包括：
    第六电阻及第七电阻；
    所述第六电阻的第一端接电源，所述第六电阻的第二端与所述第七电阻的第一端及所述光耦单元的第一输出端连接后与所述控制器的第一输入端及第二输入端连接；
    所述第七电阻的第二端接地。
  21. 根据权利要求15所述的远程测控终端，其特征在于，所述第一信号隔离单元的输入端回路接收外部输入的数字量输入信号，并通过所述第一信号隔离单元的输出端回路输出与所述数字量输入信号对应的第一判断信号至所述控制器的第一输入端及第二输入端，所述控制器还用于：
    将其第一输入端及第二输入端接收到的第一判断信号进行模数转换后分别与数字量信号阈值进行比较，若依据比较结果确定所述控制器的任一输入端接收到的第一判断信号异常，生成第一故障报警信号；以及
    自检时，向所述第一信号隔离单元的输入端回路发送自检信号，并通过所述第一信号隔离单元的输出端回路输出与所述自检信号对应的第二判断信号至所述控制器的第一输入端及第二输入端，将其第一输入端及第二输入端接收到的第二判断信号进行模数转换后分别与所述数字量信号阈值进行比较，若依据比较结果确定所述控制器的任一输入端接收到的第二判断信号异常，生成第二故障报警信号。
  22. 根据权利要求15所述的远程测控终端，其特征在于，所述控制器还用于：
    持续获取预设时间段内，所述控制器的任一输入端接收到的判断信号，生成表征所述控制器对应输入端在所述预设时间段内获取到的判断信号的电压变化趋势的第一曲线；
    若所述第一曲线与标准电压变化曲线的偏差大于曲线偏差阈值，确定所述第一曲线异常。
  23. 根据权利要求15所述的远程测控终端，其特征在于，所述控制器还用于：
    若依据比较结果确定所述控制器的第一输入端或第二输入端接收到的第一判断信号无异常，根据该无异常的第一判断信号生成对应的控制信号；
    若依据比较结果确定所述控制器的所有输入端接收到的第一判断信号均无异常，根据任一无异常的第一判断信号生成对应的控制信号。
  24. 一种安全控制系统，其特征在于，包括：
    执行单元；以及
    如权利要求1-23中任一项权利要求所述的远程测控终端；
    所述远程测控终端用于根据外部输入信号生成对应的执行控制信号，并将所述执行控制信号发送至所述执行单元，以控制所述执行单元执行对应的动作。
PCT/CN2023/129419 2022-11-04 2023-11-02 远程测控终端及安全控制系统 WO2024094140A1 (zh)

Applications Claiming Priority (8)

Application Number Priority Date Filing Date Title
CN202211378784.2A CN117991675A (zh) 2022-11-04 2022-11-04 开关量输出信号通道自诊电路及方法
CN202211379586.8A CN117991001A (zh) 2022-11-04 2022-11-04 模拟量输入信号诊断装置及方法
CN202211379989.2A CN117991615A (zh) 2022-11-04 2022-11-04 远程测控终端及安全控制系统
CN202211379581.5 2022-11-04
CN202211379989.2 2022-11-04
CN202211378784.2 2022-11-04
CN202211379581.5A CN117991676A (zh) 2022-11-04 2022-11-04 数字量输入信号诊断装置及方法
CN202211379586.8 2022-11-04

Publications (1)

Publication Number Publication Date
WO2024094140A1 true WO2024094140A1 (zh) 2024-05-10

Family

ID=90929797

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/129419 WO2024094140A1 (zh) 2022-11-04 2023-11-02 远程测控终端及安全控制系统

Country Status (1)

Country Link
WO (1) WO2024094140A1 (zh)

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102096401A (zh) * 2010-12-22 2011-06-15 北京昊图科技有限公司 基于现场总线和arm处理器的冗余容错安全仪表系统
US20130262064A1 (en) * 2012-03-27 2013-10-03 General Electric Company Systems and methods for improved reliability operations
CN105137966A (zh) * 2015-10-20 2015-12-09 浙江中控技术股份有限公司 一种开关量输出通道检测方法和结构
CN112631256A (zh) * 2020-12-29 2021-04-09 浙江中控技术股份有限公司 一种功能安全的开关量输出模块和诊断处理方法
CN113343484A (zh) * 2021-06-28 2021-09-03 国家工业信息安全发展研究中心 一种化工生产过程仿真系统及方法
CN113655707A (zh) * 2021-07-29 2021-11-16 浙江中控技术股份有限公司 安全仪表系统的表决控制方法、装置和电子装置
CN114185291A (zh) * 2021-12-02 2022-03-15 杭州和利时自动化有限公司 一种输出控制系统
CN114726327A (zh) * 2022-03-16 2022-07-08 北京易路创新科技有限公司 控制器信号输入电路
CN114995354A (zh) * 2022-06-24 2022-09-02 浙江正泰中自控制工程有限公司 用于sis安全系统的四方表决电路、故障诊断方法及存储介质
CN115237064A (zh) * 2021-04-23 2022-10-25 中国石油化工股份有限公司 安全控制方法、系统及装置

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102096401A (zh) * 2010-12-22 2011-06-15 北京昊图科技有限公司 基于现场总线和arm处理器的冗余容错安全仪表系统
US20130262064A1 (en) * 2012-03-27 2013-10-03 General Electric Company Systems and methods for improved reliability operations
CN105137966A (zh) * 2015-10-20 2015-12-09 浙江中控技术股份有限公司 一种开关量输出通道检测方法和结构
CN112631256A (zh) * 2020-12-29 2021-04-09 浙江中控技术股份有限公司 一种功能安全的开关量输出模块和诊断处理方法
CN115237064A (zh) * 2021-04-23 2022-10-25 中国石油化工股份有限公司 安全控制方法、系统及装置
CN113343484A (zh) * 2021-06-28 2021-09-03 国家工业信息安全发展研究中心 一种化工生产过程仿真系统及方法
CN113655707A (zh) * 2021-07-29 2021-11-16 浙江中控技术股份有限公司 安全仪表系统的表决控制方法、装置和电子装置
CN114185291A (zh) * 2021-12-02 2022-03-15 杭州和利时自动化有限公司 一种输出控制系统
CN114726327A (zh) * 2022-03-16 2022-07-08 北京易路创新科技有限公司 控制器信号输入电路
CN114995354A (zh) * 2022-06-24 2022-09-02 浙江正泰中自控制工程有限公司 用于sis安全系统的四方表决电路、故障诊断方法及存储介质

Similar Documents

Publication Publication Date Title
JP5914481B2 (ja) ガス遮断バルブアセンブリを介してガスフローを制御するための方法および装置
CA2443376C (en) System to manually initiate an emergency shutdown test and collect diagnostic data in a process control environment
US7590511B2 (en) Field device for digital process control loop diagnostics
CN107069954B (zh) 变电站设备云维护系统和监控系统
US10599134B2 (en) Portable field maintenance tool configured for multiple process control communication protocols
US10505585B2 (en) Portable field maintenance tool with a bus for powering and communicating with a field device
CN114721352B (zh) Dcs系统的状态监测与故障诊断方法及系统
CN106872886A (zh) 一种智能开关设备检测调试装置、系统及联调方法
CN109031223A (zh) 基于arm与fpga架构的t/r组件控制与监测方法
CN108919783A (zh) 一种驱动机构故障诊断装置及方法
WO2024094140A1 (zh) 远程测控终端及安全控制系统
CN110426628B (zh) 用于在线校验气体密度继电器的变送器及系统
CN211929386U (zh) 具有自诊断功能的数字式气体密度继电器及监测装置
CN109599946A (zh) 一种配电自动化开关的高效故障诊断方法
CN117991615A (zh) 远程测控终端及安全控制系统
CN213025417U (zh) 重水反应堆保护系统
CN212648127U (zh) 具有接点接线诊断功能的气体密度继电器及监测装置
CN101170251B (zh) 用于充油电力设备中的电子式速动油压继电器装置
CN117991001A (zh) 模拟量输入信号诊断装置及方法
CN110426313B (zh) 一种具有线路诊断功能的气体密度继电器及监测系统
CN209471144U (zh) 一种水电厂机组转速节点校验装置
CN209327834U (zh) 一种功能安全压力变送器
CN105680569A (zh) 一种网管式远程停送电操作监控系统
CN117991675A (zh) 开关量输出信号通道自诊电路及方法
CN109725176A (zh) 一种水电厂机组转速节点校验装置及校验方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23885065

Country of ref document: EP

Kind code of ref document: A1