Control system of safety controller, safety controller and subsea Christmas tree

Abstract

The invention discloses a control system of a safety controller, the safety controller and a subsea Christmas tree, and relates to the technical field of electronic information. The control system of the safety controller at least comprises a first control board card, a second control board card, a first CAN communication channel and a second CAN communication channel, information interaction is carried out between the first control board card and the second control board card through the first CAN communication channel and the second CAN communication channel; the first control board card and the second control board card have the same structure; the first control board card comprises a first control module, a second control module and a dual-channel isolation module; the first control module and the second control module are electrically connected through the dual-channel isolation module, and data comparison verification and information synchronization are carried out between the first control module and the second control module through the dual-channel isolation module. And a reliable control board card can be provided for underwater operation of the safety controller. And a redundant control board card is provided, so that the reliability of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of electronic information technology, and in particular to a control system of a safety controller, a safety controller and an underwater Christmas tree. Background Art

[0002] The safety controller is a key technology of the underwater Christmas tree. It can provide safety protection for the equipment during the start-up, stop, process disturbance and normal maintenance operations of the production device. Once the equipment is in a dangerous situation, the safety controller can immediately respond and output the correct signal to put the equipment in a safe state or shut down. It is widely used in various industrial manufacturing industries. The control board is a safety controller module that can complete application logic processing, safety comparison of logic operation results, and safety processing of input and output data. It mainly provides various communication interfaces, data processing, event recording, fault diagnosis and other functions.

[0003] At present, the country is constantly promoting the development of underwater production systems. However, due to the late start of domestic research on underwater oil tree electronic control systems, there is currently no stable and reliable domestically produced product for underwater oil tree safety controllers. The reliability needs to be further improved in harsh marine environments. Common faults of control boards include unstable signal acquisition, poor reliability, short safe service life, and inability to perform circuit diagnosis. If we want to ensure the stable development of underwater production, we need the emergence of highly reliable products. Summary of the invention

[0004] Purpose of the invention: The embodiment of the present application provides a control system of a safety controller, aiming to overcome the technical problem of poor reliability of the control board of the safety controller when operating underwater in the prior art; another purpose of the embodiment of the present application is to provide a safety controller; the third purpose of the present application is to provide an underwater oil production tree.

[0005] Technical solution: A control system of a safety controller described in an embodiment of the present application at least comprises: a first control board, a second control board, a first CAN communication channel and a second CAN communication channel; wherein the first control board and the second control board exchange information through the first CAN communication channel and the second CAN communication channel; the first control board and the second control board have the same structure;

[0006] Among them, the first control board includes a first control module, a second control module and a dual-channel isolation module; the first control module and the second control module are electrically connected through the dual-channel isolation module, and data comparison and information synchronization are performed between the first control module and the second control module through the dual-channel isolation module.

[0007] In some embodiments, the first control module includes a first control unit and a first programmable logic unit; the second control module includes a second control unit and a second programmable logic unit;

[0008] Wherein, the first control unit is electrically connected to the first programmable logic unit, and the second control unit is electrically connected to the second programmable logic unit;

[0009] The first programmable logic unit is electrically connected to the second programmable logic unit, and the first programmable logic unit and the second programmable logic unit perform data exchange and information synchronization via the dual-channel isolation module.

[0010] In some embodiments, the first control module further includes a first communication unit, and the second control module further includes a second communication unit;

[0011] The first communication unit is electrically connected to the first control unit and the first programmable logic unit respectively;

[0012] The second communication unit is electrically connected to the second control unit and the second programmable logic unit respectively.

[0013] In some embodiments, the first communication unit includes a first CAN_FD communication isolation unit and a first CAN communication isolation unit; the second communication unit includes a second CAN_FD communication isolation unit and a second CAN communication isolation unit;

[0014] The first CAN_FD communication isolation unit and the first CAN communication isolation unit are both electrically connected to the first control unit;

[0015] The second CAN_FD communication isolation unit and the second CAN communication isolation unit are both electrically connected to the second control unit.

[0016] In some embodiments, the first communication unit also includes a first serial communication unit; the second communication unit also includes a second serial communication unit; the first serial communication unit is electrically connected to the first control unit and the first programmable logic unit respectively; the second serial communication unit is electrically connected to the second control unit and the second programmable logic unit respectively.

[0017] In some embodiments, the first communication unit further includes a first printing debugging unit; the second communication unit further includes a second printing debugging unit;

[0018] Wherein, the first printing debugging unit is electrically connected to the first control unit, and the second printing debugging unit is electrically connected to the second control unit.

[0019] In some embodiments, the first control module further includes a first operation status monitoring unit; the second control module further includes a second operation status monitoring unit;

[0020] Wherein, the first operation status monitoring unit is electrically connected to the first control unit, and the first operation status monitoring unit is used to monitor the operation status information of the first control unit and send it to the first control unit;

[0021] The second operation status monitoring unit is electrically connected to the second control unit, and is used for monitoring the operation status information of the second control unit and sending the information to the second control unit.

[0022] In some embodiments, the first operation status monitoring unit includes a first temperature monitoring unit; the second operation status monitoring unit includes a second temperature monitoring unit;

[0023] Wherein, the first temperature monitoring unit is electrically connected to the first control unit, and the first temperature monitoring unit is used to monitor the temperature of the first control unit and send it to the first control unit;

[0024] The second temperature monitoring unit is electrically connected to the second control unit, and is used to monitor the temperature of the second control unit and send the temperature to the second control unit.

[0025] In some embodiments, the first control module further includes a first power module; the second control module further includes a second power module;

[0026] Wherein, the first power supply module is electrically connected to the first communication unit, the first control unit and the first programmable logic unit respectively, and is used to supply power to the first communication unit, the first control unit and the first programmable logic unit;

[0027] The second power supply module is electrically connected to the second communication unit, the second control unit and the second programmable logic unit respectively, and is used to supply power to the second communication unit, the second control unit and the second programmable logic unit.

[0028] In some embodiments, the first control module further includes a first clock unit; the second control module further includes a second clock unit;

[0029] The first clock unit is electrically connected to the first programmable logic unit; and the second clock unit is electrically connected to the second programmable logic unit.

[0030] In some embodiments, the first control module further includes a first display unit; the second control module further includes a second display unit;

[0031] Wherein, the first display unit is electrically connected to the first control unit; and the second display unit is electrically connected to the second control unit.

[0032] Correspondingly, a safety controller described in an embodiment of the present application includes the control system of the safety controller as described above.

[0033] Accordingly, an underwater Christmas tree according to an embodiment of the present application includes the safety controller as described above.

[0034] Beneficial effect: Compared with the prior art, the control system of the safety controller, the safety controller and the underwater Christmas tree of the embodiment of the present application, the control system of the safety controller at least includes: a first control board, a second control board, a first CAN communication channel and a second CAN communication channel; wherein, the first control board and the second control board exchange information through the first CAN communication channel and the second CAN communication channel; the first control board and the second control board have the same structure; wherein, the first control board includes a first control module, a second control module and a dual-channel isolation module; the first control module and the second control module are electrically connected through the dual-channel isolation module, and the first control module and the second control module perform data comparison verification and information synchronization through the dual-channel isolation module. Therefore, the present application can provide a reliable control board for the safety controller to operate underwater by providing a control system of a safety controller. And by setting the first control board, the second control board and the first CAN communication channel, a redundant control board is provided for the safety controller, so that when one of the control boards fails during the underwater operation of the safety controller, the other control board can ensure that the safety controller continues to operate underwater, thereby improving the reliability of the system. In addition, a first control module, a second control module and a dual-channel isolation module are provided in each control board to realize mutual verification and redundancy between data, thereby further improving the reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 It is a principle structural block diagram of a control system of a safety controller provided in an embodiment of the present application;

[0037] Figure 2 This is a schematic diagram of the appearance structure of a control board provided in an embodiment of the present application;

[0038] Figure 3 It is a principle structural block diagram of a control system of another safety controller provided in an embodiment of the present application;

[0039] Figure 4 It is a flow chart of an FPGA provided in an embodiment of the present application;

[0040] Figure 5 is a principle block diagram of a dual-channel isolation module provided in an embodiment of the present application;

[0041] Figure 6 It is a principle block diagram of a CAN-FD communication isolation unit provided in an embodiment of the present application;

[0042] Figure 7 It is a principle block diagram of a CAN communication isolation unit provided in an embodiment of the present application;

[0043] Figure 8 It is a functional block diagram of an RS485 unit provided in an embodiment of the present application;

[0044] Fig. 9 It is a functional block diagram of a DBG_UART unit provided in an embodiment of the present application;

[0045] Fig.10 is a principle block diagram of a temperature monitoring unit provided in an embodiment of the present application;

[0046] Fig.11 is a functional block diagram of an RTC unit provided in an embodiment of the present application;

[0047] Fig.12 is a principle block diagram of a display unit provided in an embodiment of the present application;

[0048] Fig.13 It is a structural schematic diagram of a control board provided in an embodiment of the present application;

[0049] Fig.14 It is a schematic diagram of a CPU local peripheral circuit provided in an embodiment of the present application;

[0050] Fig.15 It is a schematic diagram of a CPU local peripheral circuit 2 provided in an embodiment of the present application;

[0051] Fig.16 It is a schematic diagram of a CPU local peripheral circuit 3 provided in an embodiment of the present application;

[0052] Fig.17is a schematic diagram of a local peripheral circuit 1 of an FPGA provided in an embodiment of the present application;

[0053] Fig.18 It is a schematic diagram of the FPGA local peripheral circuit 2 provided in the embodiment of the present application;

[0054] Fig.19 It is a diagram of the composition and connection relationship of the HT-SKE500 safety controller module provided in the embodiment of the present application.

[0055] Reference numerals:

[0056] 10-first control board; 20-second control board 20; 30-first CAN communication channel; 40-first dual-channel isolation module; 50-second dual-channel isolation module; 100-first control module; 200-second control module; 300-third control module; 400-fourth control module; 101-first control unit; 102-first programmable logic unit; 103-first communication unit; 104-first operation status monitoring unit; 105-first power supply module; 106-first clock unit; 107-first display unit; 1031-first CAN_FD communication isolation unit; 1032-first A CAN communication isolation unit; 1033-a first serial communication unit; 1034-a first print debugging unit; 1041-a first temperature monitoring unit; 201-a second control unit; 202-a second programmable logic unit; 203-a second communication unit; 204-a second operation status monitoring unit; 205-a second power supply module; 206-a second clock unit; 207-a second display unit; 2031-a second CAN_FD communication isolation unit; 2032-a second CAN communication isolation unit; 2033-a second serial communication unit; 2034-a second print debugging unit; 2041-a second temperature monitoring unit. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0058] It should be understood that although the terms first, second, etc. may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another component. Therefore, the first component discussed below can be referred to as the second component without departing from the teachings of the concepts of the present application. As used herein, the term "and / or" includes any one of the associated listed items and all combinations of one or more.

[0059] Those skilled in the art will appreciate that the drawings are only schematic diagrams of example embodiments and may not be to scale. The modules or processes in the drawings are not necessarily required to implement the present application and therefore cannot be used to limit the scope of protection of the present application.

[0060] Figure 1 This is a principle structure diagram of a control system of a safety controller provided in an embodiment of the present application. Figure 1 The control system of the safety controller at least includes: a first control board 10, a second control board 20, a first CAN communication channel 30 and a second CAN communication channel 60; wherein, the first control board 10 and the second control board 20 exchange information through the first CAN communication channel 30 and the second CAN communication channel 60; the first CAN communication channel 30 and the second CAN communication channel 60 are mutually redundant and work simultaneously, wherein any one communication channel fails, does not affect the normal operation of the other channel; the first control board 10 and the second control board 20 have the same structure; wherein, the first control board 10 includes a first control module 100, a second control module 200 and a dual-channel isolation module; the first control module 100 and the second control module 200 are electrically connected through the dual-channel isolation module, and the first control module 100 and the second control module 200 perform data comparison verification and information synchronization through the dual-channel isolation module.

[0061] Among them, the first control board 10 and the second control board 20 are redundantly set, and the two sets of settings are exactly the same. The first control board 10 and the second control board 20 can both be externally connected to analog input boards, switch input boards, switch output boards, etc., so as to realize data collection and external drive functions. The external boards are not within the scope of this design. The first control board 10 and the second control board 20 exchange information through the first CAN communication channel 30 and the second CAN communication channel 60. When one of the control boards fails, the normal collection, drive and other functions of the entire system can be continued through the other control board, so as to ensure that the safety controller continues to operate underwater. Among them, the first control board 10 and the second control board 20 realize 2oo2 communication through a dedicated CAN communication channel. The 2oo2 communication mode is adopted to make it safer and thus improve the reliability of the system.

[0062] For example, see Figure 1, the first control board 10 includes a first control module 100, a second control module 200 and a first dual-channel isolation module 40. Among them, the first control module 100 and the second control module 200 are electrically connected through the first dual-channel isolation module 40, and the first control module 100 and the second control module 200 exchange data and synchronize information through the first dual-channel isolation module 40 to achieve data interaction and information synchronization between the first control module 100 and the second control module 200. On the one hand, mutual verification can be achieved to ensure the reliability of data transmission. On the other hand, redundant settings are formed with each other. When one of the control modules fails, the other control module can continue to ensure the normal operation of the safety controller underwater, thereby improving the reliability of the system.

[0063] The structure of the second control board 20 is the same as that of the first control board 10. Figure 1 , the second control board 20 includes a third control module 300, a fourth control module 400 and a second dual-channel isolation module 50. The third control module 300 and the fourth control module 400 are electrically connected through the second dual-channel isolation module 50, and the third control module 300 and the fourth control module 400 exchange data and synchronize information through the second dual-channel isolation module 50 to achieve data interaction and information synchronization between the third control module 300 and the fourth control module 400. On the one hand, mutual verification can be achieved to ensure the reliability of data transmission. On the other hand, redundant settings are formed with each other. When one of the control modules fails, the safety controller can continue to operate normally underwater through another control module, thereby improving the reliability of the system.

[0064] The embodiment of the present application provides a control system of a safety controller, and the control system of the safety controller at least includes: a first control board 10, a second control board 20, a first CAN communication channel 30 and a second CAN communication channel 60; wherein the first control board 10 and the second control board 20 exchange information through the first CAN communication channel 30 and the second CAN communication channel 60; the first control board 10 and the second control board 20 have the same structure; wherein the first control board 10 includes a first control module 100, a second control module 200 and a dual-channel isolation module; the first control module 100 and the second control module 200 are electrically connected through the dual-channel isolation module, and the first control module 100 and the second control module 200 perform data comparison verification and information synchronization through the dual-channel isolation module. Therefore, the present application can provide a reliable control board for the safety controller in underwater operations by providing a control system of a safety controller. Furthermore, by providing a first control board 10, a second control board 20 and a first CAN communication channel 30, a redundant control board is provided for the safety controller, so that when one of the control boards fails during underwater operation of the safety controller, the other control board can ensure that the safety controller continues to operate underwater, thereby improving the reliability of the system. Furthermore, a first control module 100, a second control module 200 and a dual-channel isolation module are provided in each control board to achieve mutual verification and redundancy between data, thereby further improving the reliability of the system.

[0065] Figure 2 1 is a schematic diagram of the appearance structure of a control board provided in an embodiment of the present application. The first control board 10 and the second control board 20 have the same size and structure. Figure 2 The control board adopts a 3U width board design, with a width of 100mm and a length of 180mm. It has no panel installation, a PCB thickness of 1.6mm, and a maximum device height of no more than 20mm. The back connector uses a 53-pin connector, and the board adopts a fanless passive cooling design.

[0066] Figure 3 It is a principle structure block diagram of the control system of another safety controller provided in the embodiment of the present application. In the technical solution of the embodiment of the present application, the first control board 10 and the second control board 20 are identical and redundant. For example, in the embodiment of the present application, the structure of the control board is described in detail by taking the first control board 10 as an example (the same below, no further description). Based on the above embodiment, please refer to Figure 3The first control module 100 includes a first control unit 101 and a first programmable logic unit 102; the second control module 200 includes a second control unit 201 and a second programmable logic unit 202; wherein the first control unit 101 and the first programmable logic unit 102 are electrically connected, and the second control unit 201 and the second programmable logic unit 202 are electrically connected; the first programmable logic unit 102 and the second programmable logic unit 202 are electrically connected, and the first programmable logic unit 102 and the second programmable logic unit 202 perform data exchange and information synchronization through a dual-channel isolation module.

[0067] The first control unit 101 and the second control unit 201 are identical and redundant to each other. The first control unit 101 and the second control unit 201 can be control chips such as single-chip microcomputers, which can be specifically configured according to actual conditions and are not specifically limited here.

[0068] The first programmable logic unit 102 and the second programmable logic unit 202 are identical and are redundant to each other. The first programmable logic unit 102 and the second programmable logic unit 202 may be field-programmable gate arrays (FPGAs).

[0069] For example, see Figure 3 The first programmable logic unit 102 and the second programmable logic unit 202 perform data exchange and information synchronization through the first dual-channel isolation module 40, which can improve the reliability of the control board, thereby improving the reliability of the safety controller in underwater operations.

[0070] The first programmable logic unit 102 and the first control unit 101 can exchange data via the external bus EMIF. After isolation, it is used for synchronization and data exchange between two channels of the FPGA, power status detection functions, etc. Similarly, the second programmable logic unit 202 and the second control unit 201 can also exchange data via the external bus EMIF.

[0071] The first programmable logic unit 102 and the first control unit 101 can exchange data via the external bus EMIF, and matching resistors are designed on the data lines and the address lines to ensure signal integrity of the address lines and the data lines. Similarly, matching resistors are also designed on the data lines and the address lines between the second programmable logic unit 202 and the second control unit 201.

[0072] The first programmable logic unit 102 provides Clear and Reset signals to the first control unit 101. After the control board is powered on, these two pins can receive high-level signals to serve as clear and reset signals to the internal logic of the first programmable logic unit 102. Similarly, the second programmable logic unit 202 provides Clear and Reset signals to the second control unit 201.

[0073] The first programmable logic unit 102 receives the GPIO signal sent by the first control unit 101 for synchronization between the two CPUs. Similarly, the second programmable logic unit 202 receives the GPIO signal sent by the first control unit 101 for synchronization between the two CPUs.

[0074] Figure 4 is a flow chart of an FPGA provided in an embodiment of the present application. Figure 4 , the FPGA between the two channels is also equipped with synchronization lines and communication lines, which are used for synchronization and data exchange between the two channels after isolation. The dual-mode communication CPU is transmitted to the FPGA through EMIF, and the FPGA is transmitted to the other end FPGA through the serial port. The FPGA is transparent. Among them, the FPGA hardware function related circuits mainly include the FPGA chip EP4CE15F17I7N, the configuration chip and the RTC module. The two crystal oscillators are 20MHz and 30MHz respectively. After passing through the PLL inside, they provide independent clocks for the logic channels in the FPGA.

[0075] Figure 5 is a principle block diagram of a dual-channel isolation module provided in an embodiment of the present application. Figure 5 The dual-channel isolation module is electrically connected to FPGA1 (i.e., the first programmable logic unit 102) and FPGA2 (i.e., the second programmable logic unit 202) respectively. The dual-channel isolation module completes the data exchange and synchronous isolation of the dual channels. Among them, the dual-channel isolation module uses an isolation chip to isolate the signal, the isolation rating is 1KVrms, and the maximum data rate is 25Mbps.

[0076] In some embodiments, please refer to Figure 3 The first control module 100 also includes a first communication unit 103, and the second control module 200 also includes a second communication unit 203; the first communication unit 103 is electrically connected to the first control unit 101 and the first programmable logic unit 102 respectively; the second communication unit 203 is electrically connected to the second control unit 201 and the second programmable logic unit 202 respectively.

[0077] Among them, the first control module 100 and the second control module 200 are respectively provided with a first communication unit 103 and a second communication unit 203, which can be used to realize the basic communication of the first control board 10, such as communication between internal components, communication with external devices, etc., so as to ensure the communication function of the control board, and then ensure the communication function of the safety controller, and ensure the reliability of the safety controller in underwater operation.

[0078] In some embodiments, please refer to Figure 3 The first communication unit 103 includes a first CAN_FD communication isolation unit 1031 and a first CAN communication isolation unit 1032; the second communication unit 203 includes a second CAN_FD communication isolation unit 2031 and a second CAN communication isolation unit 2032; the first CAN_FD communication isolation unit 1031 and the first CAN communication isolation unit 1032 are both electrically connected to the first control unit 101; the second CAN_FD communication isolation unit 2031 and the second CAN communication isolation unit 2032 are both electrically connected to the second control unit 201.

[0079] Among them, a first CAN_FD communication isolation unit 1031 is set in the first control module 100 to realize CAN communication within the system and CAN communication with external devices, etc., which can improve the data transmission rate and ensure the communication reliability of the safety controller during underwater operation. In addition, a second CAN_FD communication isolation unit 2031 is set in the second control module 200, which can be used as a CAN communication redundancy setting to prevent the first CAN_FD communication isolation unit 1031 from failing. Communication can be continued through the second CAN_FD communication isolation unit 2031, thereby improving the reliability of the control board and the safety controller. Similarly, a first CAN communication isolation unit 1032 is set in the first control module 100, and a second CAN communication isolation unit 2032 is set in the second control module 200. On the one hand, multiple CAN communication backup channels can be provided, which is suitable for situations where the safety controller is inconvenient to update and maintain equipment in an underwater operating environment. On the other hand, a redundant setting is formed. When one of the CAN communication isolation units fails, communication can be continued through another CAN communication isolation unit, thereby ensuring the communication reliability of the safety controller.

[0080] Figure 6 1 is a principle block diagram of a CAN-FD communication isolation unit provided in an embodiment of the present application. Figure 6The CAN-FD communication isolation unit provided in the embodiment of the present application is used for internal communication of the system through the CAN-FD interface to realize data interaction with external switch input / output, analog input and other modules. The CAN-FD communication isolation unit adopts an interface expansion method and uses the SPI interface to realize the expansion of the CAN-FD interface. The principle of the CAN-FD communication isolation unit is as follows: Figure 6 Each CPU unit (ie, the first control unit 101 and the second control unit 201) is connected to the backplane CAN_FD interface of the control board through an SPI isolation chip and an SPI to CAN_FD chip respectively.

[0081] Figure 7 1 is a principle block diagram of a CAN communication isolation unit provided in an embodiment of the present application. Figure 7 Each CPU unit (ie, the first control unit 101 and the second control unit 201) provides two CAN channels respectively, and each uses two CAN transceiver chips to achieve signal isolation and communication.

[0082] In some embodiments, please refer to Figure 3 The first communication unit 103 also includes a first serial communication unit 1033; the second communication unit 203 also includes a second serial communication unit 2033; the first serial communication unit 1033 is electrically connected to the first control unit 101 and the first programmable logic unit 102 respectively; the second serial communication unit 2033 is electrically connected to the second control unit 201 and the second programmable logic unit 202 respectively.

[0083] Among them, the first serial communication unit 1033 and the second serial communication unit 2033 are mutually redundantly set, and are used to provide serial communication for the first control board 10, such as the first control board 10 external data communication. Therefore, in the scheme of the embodiment of the present application, by setting the first CAN_FD communication isolation unit 1031, the first CAN communication isolation unit 1032 and the first serial communication unit 1033 in the first control module 100, a rich communication method can be provided for the first control board 10, which can meet the various communication requirements of the control board, thereby improving the reliability of the first control board 10 and the safety controller. Similarly, the second control board 20 is also provided with CAN_FD, CAN and serial communication, which can improve the reliability of the second control board 20 and the safety controller.

[0084] The first serial communication unit 1033 and the second serial communication unit 2033 may be 485 serial communication.

[0085] Figure 8 is a principle block diagram of an RS485 unit provided in an embodiment of the present application. Figure 8The first serial communication unit 1033 and the second serial communication unit 2033 use RS485 communication isolation modules, which can be used to control the external data communication of the board. The RS485 unit includes two RS485 channels and uses two RS485 transceiver chips to achieve signal isolation and communication.

[0086] In some embodiments, please refer to Figure 3 The first communication unit 103 further includes a first printing debugging unit 1034 ; the second communication unit 203 further includes a second printing debugging unit 2034 ; wherein the first printing debugging unit 1034 is electrically connected to the first control unit 101 , and the second printing debugging unit 2034 is electrically connected to the second control unit 201 .

[0087] The first print debugging unit 1034 and the second print debugging unit 2034 can be used to debug print data and are redundant with each other.

[0088] The first printing debugging unit 1034 and the second printing debugging unit 2034 may use a UART serial communication interface.

[0089] Fig. 9 This is a block diagram of a DBG_UART unit provided in an embodiment of the present application. Fig. 9 The first print debugging unit 1034 and the second print debugging unit 2034 use DBG_UART units for debugging print data. Each channel inside the first control board 10 provides one DBG_UART interface for debugging print data.

[0090] Therefore, in the solution of the embodiment of the present application, by setting the first CAN_FD communication isolation unit 1031, the first CAN communication isolation unit 1032, the first serial communication unit 1033 and the first print debugging unit 1034 in the first control module 100, a rich communication mode can be provided for the first control board 10, which can meet the various communication requirements of the control board, thereby improving the reliability of the first control board 10 and the safety controller. Similarly, the second control board 20 is also provided with CAN_FD, CAN and serial communication, which can improve the reliability of the second control board 20 and the safety controller.

[0091] In some embodiments, please refer to Figure 3The first control module 100 also includes a first operation status monitoring unit 104; the second control module 200 also includes a second operation status monitoring unit 204; wherein the first operation status monitoring unit 104 is electrically connected to the first control unit 101, and the first operation status monitoring unit 104 is used to monitor the operation status information of the first control unit 101 and send it to the first control unit 101; the second operation status monitoring unit 204 is electrically connected to the second control unit 201, and the second operation status monitoring unit 204 is used to monitor the operation status information of the second control unit 201 and send it to the second control unit 201.

[0092] Specifically, the first operation status monitoring unit 104 monitors the operation status information of the first control unit 101 in real time and sends it to the first control unit 101. After receiving its operation status information, the first control unit 101 determines whether its operation status is abnormal according to the operation status information. If an abnormality occurs, it will make corresponding processing in time to ensure the reliability of the operation of the first control unit 101, and then ensure the reliability of the underwater operation of the safety controller. Similarly, the second operation status monitoring unit 204 monitors the operation status information of the second control unit 201 in real time and sends it to the second control unit 201. After receiving its operation status information, the second control unit 201 determines whether its operation status is abnormal according to the operation status information. If an abnormality occurs, it will make corresponding processing in time to ensure the reliability of the operation of the second control unit 201, and then ensure the reliability of the underwater operation of the safety controller.

[0093] The operating status information may be temperature information, voltage information, current information, etc., which may be set according to actual conditions and are not specifically limited here.

[0094] In some embodiments, please refer to Figure 3 The first operation status monitoring unit 104 includes a first temperature monitoring unit 1041; the second operation status monitoring unit 204 includes a second temperature monitoring unit 2041; wherein the first temperature monitoring unit 1041 is electrically connected to the first control unit 101, and the first temperature monitoring unit 1041 is used to monitor the temperature of the first control unit 101 and send it to the first control unit 101; the second temperature monitoring unit 2041 is electrically connected to the second control unit 201, and the second temperature monitoring unit 2041 is used to monitor the temperature of the second control unit 201 and send it to the second control unit 201.

[0095] Specifically, the first temperature monitoring unit 1041 monitors the temperature information of the first control unit 101 in real time and sends it to the first control unit 101. After receiving its temperature information, the first control unit 101 determines whether its temperature is abnormal (such as overtemperature, whether it exceeds the preset temperature) according to the temperature information. If an abnormality occurs, corresponding processing is made in time to ensure the reliability of the operation of the first control unit 101, thereby ensuring the reliability of the underwater operation of the safety controller. Similarly, the second temperature monitoring unit 2041 monitors the temperature information of the second control unit 201 in real time and sends it to the second control unit 201. After receiving its temperature information, the second control unit 201 determines whether its temperature is abnormal according to the temperature information. If an abnormality occurs, corresponding processing is made in time to ensure the reliability of the operation of the second control unit 201, thereby ensuring the reliability of the underwater operation of the safety controller. Among them, the specific value of the preset temperature can be set according to the actual situation, and no specific limitation is made here.

[0096] The first temperature monitoring unit 1041 and the second temperature monitoring unit 2041 may be temperature sensors.

[0097] Fig.10 is a principle block diagram of a temperature monitoring unit provided in an embodiment of the present application. Fig.10 The temperature detection module communicates with the CPU through the I2C bus. The CPU unit's built-in I2C function module is used to achieve data interaction with the temperature sensor.

[0098] In some embodiments, please refer to Figure 3 The first control module 100 also includes a first power module 105; the second control module 200 also includes a second power module 205; wherein the first power module 105 is electrically connected to the first communication unit 103, the first control unit 101 and the first programmable logic unit 102, respectively, for supplying power to the first communication unit 103, the first control unit 101 and the first programmable logic unit 102; wherein the second power module 205 is electrically connected to the second communication unit 203, the second control unit 201 and the second programmable logic unit 202, respectively, for supplying power to the second communication unit 203, the second control unit 201 and the second programmable logic unit 202.

[0099] The first power module 105 and the second power module 205 are used to realize voltage conversion and provide various voltage inputs for the first control board 10. The first control board 10 is connected to a 24VDC power supply through a backplane connector and is provided with two power supply channels.

[0100] Among them, the power supply modules of the two power supply channels have the same principle, and the power supply distribution of one of the channels is explained below. First, in order to ensure the independence of the two channels on the first control board 10, the output voltage of the isolated power supply module is 12VDC when the 24V power supply is connected to the two channels. Second, the 12VDC±2% power supply output by the isolated power supply module is respectively output through three power supply chips, and 5VDC±5%, 3.3VDC±5%, and 1.2VDC are output to meet the needs of subsequent chip work. Third, among them, the 1.2VDC±3% voltage is used for FPGA and MCU. Fourth, among them, 3.3VDC±5% is used to power the MCU. Fifth, among them, 5VDC is converted into 2.5VDC±1% for FPGA. Sixth, the 5VDC power supply is mainly used to power the communication isolation chip on the control board.

[0101] Among them, the isolation withstand voltage of the 24V power isolation module is 2KVDC, which can provide a maximum power of 6W. The power consumption of each circuit of the first control board 10 does not exceed 4W, and the power module can meet the power supply requirements of the first control board 10 within the entire operating temperature range. In addition, the 5V power supply is used directly on the first control board 10 as a common power supply for each isolation device to communicate with other modules and transmit signals. The 24V input power supply is connected in series with a 0.5A fast-fuse fuse to protect the board from overcurrent. The power module does not set a switch enable, and automatically supplies power when powered on.

[0102] In some embodiments, please refer to Figure 3 The first control module 100 further includes a first clock unit 106 ; the second control module 200 further includes a second clock unit 206 ; wherein the first clock unit 106 is electrically connected to the first programmable logic unit 102 ; and the second clock unit 206 is electrically connected to the second programmable logic unit 202 .

[0103] The first clock unit 106 and the second clock unit 206 are used to provide a time reference for the system.

[0104] The first clock unit 106 and the second clock unit 206 may adopt real-time clock chips.

[0105] Fig.11 is a block diagram of the RTC unit provided in the embodiment of the present application. Fig.11 ,RTC uses a real-time clock chip, a 32.768K crystal oscillator provides real-time pulses, and a battery is used to power the real-time clock chip. The real-time clock chip is connected to the FPGA via I2C.

[0106] In some embodiments, please refer to Figure 3The first control module 100 further includes a first display unit 107 ; the second control module 200 further includes a second display unit 207 ; wherein the first display unit 107 is electrically connected to the first control unit 101 ; and the second display unit 207 is electrically connected to the second control unit 201 .

[0107] The first display unit 107 and the second display unit 207 are used to control the status display of the board and are redundant to each other.

[0108] The first display unit 107 and the second display unit 207 may be display devices or equipment such as LED lamps.

[0109] Fig.12 is a block diagram of the display unit provided in the embodiment of the present application. Fig.12 The display unit is used to control the board status display. The display unit is mainly composed of 2 groups of 6 LEDs, a total of 12 LEDs. Each group includes 5 LEDs for controlling the channel indicators of the board operation status indication and a power indicator.

[0110] Fig.13 is a schematic diagram of the structure of a control board provided in an embodiment of the present application. Fig.13 The control board adopts 2oo2D architecture. In order to meet the functional safety design requirements and API17F standard recommendations, the control board is designed according to the redundant hardware architecture. The principle block diagram is as follows Fig.13 As shown, in order to identify the failure that causes the error of the processing unit result, the data (including results, intermediate results and test data) between the two processing units core0 and core1 are exchanged to detect the failure in the processing unit as early as possible. CPU0 / CPU1 sends the interaction data to FPGA0 / FPGA1, and the data is exchanged with each other and then sent to the CPUs connected to each other. The data interaction between FPGA0 and FPGA1 includes synchronization lines and communication lines, which are used for synchronization and data exchange between the two channels after isolation. The control board CPU sends the hard-wired signals and communication messages between the two modules to the local FPGA through the EMIF bus, and the FPGA forwards the signals and messages to the opposite FPGA through the direct serial bus to achieve synchronization between Core 0 and Core 1. Among them, CPU0 and CPU1 are the first control unit 101 and the second control unit 201 respectively, and FPGA0 and FPGA1 are the first programmable logic unit 102 and the second programmable logic unit 202 respectively.

[0111] The control board can be divided into the following functions: power supply unit, CPU unit, FPGA unit, CAN_FD communication isolation unit, CAN communication isolation unit, DBG_UART unit, display unit, RTC unit, dual-channel isolation unit and temperature monitoring unit.

[0112] According to the functional safety requirements, control board faults include serious faults and general faults. Serious faults include: abnormal voltage, temperature, memory, stack, register, instruction of the processor itself, and application program calling the downtime function. General faults include: abnormal communication link, abnormal received data verification, and all other faults that do not affect safety control and calculation except serious faults. The main control board should have the function of restarting after a fault. When restarting, it should perform a self-test at startup. After passing the self-test, it is allowed to enter the normal cycle operation state. If the self-test fails, the main control board enters the safe state. In the safe state, the main control board stops receiving data from the outside and sending data to the outside, and prohibits automatic restart. The operation of the control board is divided into two stages, namely the initialization stage and the cycle operation stage. During the startup process, the control board performs a self-test, including the control board voltage and temperature monitoring self-test, detects the status of each configured functional board, and detects the system memory, processor registers, and instructions. If the test fails, the system outputs a fault message and crashes. During stable periodic operation, periodic self-tests are required, including self-tests of the control board voltage and temperature monitoring, detection of the status of each configured functional module, detection of system memory, processor registers, and instructions. If the detection fails, the system outputs fault information and shuts down. The minimum operation cycle is 50ms. Within one operation cycle, input data parsing, logical processing operations and safety comparisons, control data transmission, inter-system synchronization, master-slave status and dual-system switching judgment, etc. need to be completed in sequence. During the periodic operation stage, the control board is protected by a hardware watchdog with a time window (300-900ms, the time window cannot be configured). The watchdog feeding operation needs to be performed regularly and periodically to ensure that the watchdog does not time out under normal operation.

[0113] Among them, the CPU unit is responsible for the data communication and data processing of the control board, and is built with an embedded microprocessor as the core. Therefore, the CPU must meet the required communication interface resources, and the CPU processing capacity is required to be no less than 400DMIPS. In addition to data communication and data processing, other functions implemented by the CPU unit include: First, LED indicator control. The CPU unit realizes the display control of the LED light through the corresponding GPIO port according to the operating status of the control board. Second, the synchronous logic processing between the two channels. The CPU units of the two channels are synchronized by pulse handshake when working. Third, read the values ​​of each voltage on the board. The CPU has two ADC function modules with an ADC accuracy of 10 bits. Use ADC to collect all the working voltages on the circuit board and send the converted values ​​back to the CPU for processing. Fourth, read the temperature signal of the control board. The CPU has an I2C function module. Use the I2C bus to collect temperature data through the temperature sensor and process it accordingly. Fifth, control the ID number collection of the board. The CPU unit completes ID collection through GPIO and reads the ID information composed of the resistor network on the board for function board identification and communication address configuration. Sixth, the self-test of the internal resources of the CPU unit. The CPU unit supports the self-test function. During the system power-on and normal operation, the CPU unit performs self-tests on the internal functions of the chip. Seventh, the external hardware watchdog module. The CPU unit feeds the watchdog by sending periodic pulses through a pin, uses a watchdog chip to supervise the CPU operation, delays the start when power is on, and provides a hardware watchdog with a time window. Eighth, communicate with the FPGA. The CPU unit uses the EMIF interface to exchange data with the FPGA. Ninth, data interaction with the Flash chip. The external Flash chip is connected to the CPU unit through the SPI interface for the storage of log data.

[0114] Fig.14 1 is a schematic diagram of a CPU local peripheral circuit provided in an embodiment of the present application. Fig.14 , connected to the FLASH chip U1 through the SPI pin of the CPU for storing log data. The FLASH chip U1 uses a SPI FLAH chip with a storage capacity of 512Mb.

[0115] Fig.15 Schematic diagram of the CPU local peripheral circuit 2 provided in the embodiment of the present application. Fig.15 , connected to the temperature sensor U2 through the CPU's I2C bus, collects temperature data and performs corresponding processing.

[0116] Fig.16 is a schematic diagram of a CPU local peripheral circuit 3 provided in an embodiment of the present application. Fig.16, using the CPU's EMIF bus to realize information interaction between the CPU and FPGA.

[0117] Among them, the FPGA unit and the CPU unit exchange data through the external bus EMIF; after isolation, it is used for synchronization and data exchange between the two channels of the FPGA; power supply status detection function, etc. The main functions implemented by the FPGA unit include: data communication between the FPGA unit and the CPU unit, data exchange between the FPGA unit and the CPU unit through the external bus EMIF, and matching resistors are designed on the data line and address line for signal integrity of the address line and data line. The FPGA unit provides Clear and Reset signals to the CPU unit. After the board is powered on, these two pins can receive high-level signals and serve as clear and reset signals to the internal logic of the FPGA unit. The FPGA unit receives the GPIO signal sent by the CPU unit for synchronization between the two CPUs. Synchronization and data exchange between the two channels of the FPGA unit. The FPGA unit between the dual-mode channels also has synchronization lines and communication lines, which are used for synchronization and data exchange between the two channels after isolation. Dual-mode communication CPU to FPGA through EMIF, FPGA to the opposite FPGA through the serial port, FPGA is transparent transmission.

[0118] Among them, the FPGA hardware function-related circuits mainly include the FPGA chip, configuration chip and RTC module. The two crystal oscillators are 20MHz and 30MHz respectively. After passing through the PLL internally, they provide independent clocks for the logic channels in the FPGA.

[0119] Fig.17 : is a schematic diagram of a local peripheral circuit of the FPGA provided in the embodiment of the present application. For example, the FPGA configuration chip U3 adopts EPCS16SI8N, Fig.17 It shows that the FPGA configuration chip U3 adopts the peripheral circuit of EPCS16SI8N.

[0120] Fig.18 : is a schematic diagram of the FPGA local peripheral circuit 2 provided in the embodiment of the present application. For example, Fig.18 The synchronization line and communication line of the FPGA are isolated and used for synchronization and data exchange between the two channels.

[0121] In addition, the definitions of the interfaces of the control board are shown in Table 1. Exemplarily, the back connector of the analog input board adopts a 53-pin connector, which is specifically defined in Table 1.

[0122] Table 1 Interface definition

[0123]

[0124]

[0125] For example, in the technical solution of the embodiment of the present application, the control board is applied to the HT-SKE500 safety controller of the underwater oil production tree, and is mainly used for the analysis and processing of data collected by the AI, DI, RS485, CAN communication and other modules in the system, as well as the drive control of the DO board and other functions.

[0126] Fig.19 HT-SKE500 safety controller module composition and connection diagram provided in the embodiment of the present application. Fig.19 The safety controller adopts a redundant A and B system structure, that is, the internal structure of the A and B systems are consistent, and a single system is used internally, which consists of a control board, an AI board, a DI board, a DO board, a CAN communication board and an RS485 communication board.

[0127] The control board provided in the embodiment of the present application adopts a 2oo2D architecture, which mainly completes application logic processing, safe comparison of logic operation results, safe processing of input and output data, etc. Parameter configuration and logic configuration functions can be provided. The module has built-in diagnostic tests and independent watchdogs. Failures do not affect the operation of other channels. Two CAN_FD interfaces are used to communicate with other electronic modules inside the SEM. The CAN_FD bus must meet functional safety requirements and have high-speed communication capabilities.

[0128] The following are the functions of the control board:

[0129] First, the power supply function. The control board introduces two 24VDC power supplies to power the internal logic circuit of the control board. The power input range is 16.8V~32V. The 24VDC power supply of the control board needs to add a fuse to prevent the damage caused by the internal short circuit of the control board. When any power supply fails and no power is provided, the other power supply should support the normal operation of the control board, and when the dual power supply is converted to a single power supply, the control board should not restart due to power jitter.

[0130] Second, the user interface. The control board provides the application software with a downtime interface function, which should be able to send the downtime reason to the recording module before the downtime. The control board provides the application software with an application running interface. The control board provides the application software with a communication interface function between the control board and each functional board in the system. The control board provides the application software with an application data transmission interface function between control boards in the system.

[0131] Third, system support. The control board supports the application business logic cycle operation. The system timing accuracy of the control board is 1ms. The control board has the ability to self-check at startup. During startup, the voltage and temperature of the processor should be monitored, and the memory, stack, register, and instructions should be tested. When a self-check fails, a fault response should be performed.

[0132] The control board has the ability to self-check periodically during operation. During periodic operation, the voltage and temperature of the processor should be monitored, the status of the functional board should be checked periodically, and the memory, stack, register, and instruction should be self-checked periodically. When a self-check failure occurs, a fault response should be made.

[0133] The control board should have the function of restarting after a fault. When restarting, it should perform a self-check at startup. After passing the self-check, it is allowed to enter the normal cycle operation state. If the self-check fails, the control board enters the safe state. In the safe state, the control board stops receiving data from the outside and sending data to the outside, and prohibits automatic restart.

[0134] The control board has a hardware watchdog with a time window to monitor the system processing cycle.

[0135] The control board should have a real-time clock (RTC) and support the configuration and reading functions of the real-time clock.

[0136] Fourth, for intra-system communication, the control board has two independent CAN_FD communications, supporting communication baud rates of 500kbps, 800kbps, 1Mbps, 2Mbps, and 2.5Mbps, and 1.5kV isolation protection. The two CAN_FD communications are redundant communications, and the control board should communicate with other functional boards through these two communications.

[0137] The control board should have a configurable ID as the ID address of CAN_FD to identify different control boards. The intra-system communication between the control board and each functional board should have a unified protocol link layer on top of the CAN_FD redundant 2-way physical communication layer. After the protocol link layer is successfully connected, the control board can communicate with other functional boards. When one of the 2-way CAN_FD communication of the control board fails, it should not affect the communication status and communication link of the protocol link layer. The communication frame loss rate between the control board and each functional board should be less than 0.1%.

[0138] Fifth, inter-system communication and switching. Two redundant CAN communications are used between the two control boards of the dual system, supporting baud rate (support options are 125kbps, 250kbps, 500kbps, 1Mbps) and 1.5kV isolation protection. The control board has a configurable ID, which is used as the CAN ID address to identify different control boards. The active and standby status of the dual-system control board is determined based on the dual-system communication status, the active and standby status of the pair of systems, and the size of the dual-system CAN ID. In the redundant communication between control boards, when one communication fails, it should not affect the protocol link layer communication status and communication link.

[0139] The redundant communication between control boards should include their own CAN ID, their own master and backup system status, cycle time information, and a safety check code. If the time, CAN ID, and safety check code are found to be out of tolerance or fail to pass the check during the verification process, the message will be discarded. The receiving board considers that the message has not been received.

[0140] Before a control board of a system fails and restarts or shuts down, this information needs to be sent to the control board of the opposite system through the redundant CAN communication between systems. If the faulty board is the master system, the original standby control board should remain in the standby state in the current processing cycle after receiving the message, and set itself as the master system at the beginning of the next processing cycle. If the faulty board is the standby system, the master control board remains in the master-standby state.

[0141] During operation, if the standby control board does not receive the fault restart or downtime message sent by the main control board, and does not receive the periodic synchronization message from the main control board, it will tolerate three consecutive cycles of communication loss and then upgrade to the main system, while providing the application with the upgrade mark. If a valid control board message is received again within the tolerance time, the standby system remains unchanged. The communication frame loss rate between the two control boards should be less than 0.1%.

[0142] Sixth, the control board communicates with the outside world. The control board has two RS485 communication interfaces to connect to the external system, supports baud rate configuration (configuration range is 1200 to 115200bps), and has 1.5kV isolation protection.

[0143] The RS485 communication of the control board supports Modbus RTU protocol. The two communication ports are independent and can use Modbus RTU protocol by configuring the serial port address.

[0144] The control board has two 10M / 100M Ethernet communication ports to connect to the external system and has 1.5kV isolation protection.

[0145] Each Ethernet communication of the control board is independent, and each port can use the Modbus TCP protocol by configuring the IP address.

[0146] As transparent transmission channels for upper-layer application messages, Type I RS485 and Ethernet have no security requirements. The security of upper-layer data messages is specifically implemented by the application layer protocol.

[0147] The frame loss rate of the control board's external RS485 and Ethernet communications should be less than 0.1%.

[0148] It can be seen that the control board provided in the embodiment of the present application supports redundant power input and has high reliability. The 2oo2D mode is adopted, which is more secure. It has two Ethernet interfaces, two RS485 communication interfaces, and two CAN_FD interfaces. The module has built-in diagnostic tests and independent watchdogs, and has temperature detection functions. The localization development of the safety controller control board has been completed.

[0149] Correspondingly, an embodiment of the present application further provides a safety controller, which includes the control system of the safety controller described in any embodiment of the present application.

[0150] Correspondingly, an embodiment of the present application further provides an underwater Christmas tree, which includes the safety controller described in any embodiment of the present application.

[0151] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0152] The control system, safety controller and underwater oil production tree of the safety controller provided in the embodiments of the present application are introduced in detail above, and the principles and implementation methods of the present application are explained by using specific examples. The description of the above embodiments is only used to help understand the technical solution and its core idea of ​​the present application; ordinary technicians in this field should understand that: they can still modify the technical solutions recorded in the aforementioned embodiments, or replace some of the technical features therein with equivalents; and these modifications or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of each embodiment of the present application.

Claims

1. A control system of a safety controller, characterized in that: At least: A first control board, a second control board, a first CAN communication channel and a second CAN communication channel; wherein the first control board and the second control board exchange information via the first CAN communication channel and the second CAN communication channel; the first control board and the second control board have the same structure; Among them, the first control board includes a first control module, a second control module and a dual-channel isolation module; the first control module and the second control module are electrically connected through the dual-channel isolation module, and data comparison and information synchronization are performed between the first control module and the second control module through the dual-channel isolation module.

2. The control system of the safety controller according to claim 1, characterized in that: The first control module includes a first control unit and a first programmable logic unit; the second control module includes a second control unit and a second programmable logic unit; Wherein, the first control unit is electrically connected to the first programmable logic unit, and the second control unit is electrically connected to the second programmable logic unit; The first programmable logic unit is electrically connected to the second programmable logic unit, and the first programmable logic unit and the second programmable logic unit perform data exchange and information synchronization via the dual-channel isolation module.

3. The control system of the safety controller according to claim 2, characterized in that: The first control module further includes a first communication unit, and the second control module further includes a second communication unit; The first communication unit is electrically connected to the first control unit and the first programmable logic unit respectively; The second communication unit is electrically connected to the second control unit and the second programmable logic unit respectively.

4. The control system of the safety controller according to claim 3, characterized in that: The first communication unit includes a first CAN_FD communication isolation unit and a first CAN communication isolation unit; the second communication unit includes a second CAN_FD communication isolation unit and a second CAN communication isolation unit; The first CAN_FD communication isolation unit and the first CAN communication isolation unit are both electrically connected to the first control unit; The second CAN_FD communication isolation unit and the second CAN communication isolation unit are both electrically connected to the second control unit.

5. The control system of the safety controller according to claim 3, characterized in that: The first communication unit also includes a first serial communication unit; the second communication unit also includes a second serial communication unit; the first serial communication unit is electrically connected to the first control unit and the first programmable logic unit respectively; the second serial communication unit is electrically connected to the second control unit and the second programmable logic unit respectively.

6. The control system of the safety controller according to claim 3, characterized in that: The first communication unit further includes a first printing debugging unit; the second communication unit further includes a second printing debugging unit; Wherein, the first printing debugging unit is electrically connected to the first control unit, and the second printing debugging unit is electrically connected to the second control unit.

7. The control system of the safety controller according to claim 2, characterized in that: The first control module further includes a first operation status monitoring unit; the second control module further includes a second operation status monitoring unit; Wherein, the first operation status monitoring unit is electrically connected to the first control unit, and the first operation status monitoring unit is used to monitor the operation status information of the first control unit and send it to the first control unit; The second operation status monitoring unit is electrically connected to the second control unit, and is used for monitoring the operation status information of the second control unit and sending the information to the second control unit.

8. The control system of the safety controller according to claim 7, characterized in that: The first operation status monitoring unit includes a first temperature monitoring unit; the second operation status monitoring unit includes a second temperature monitoring unit; Wherein, the first temperature monitoring unit is electrically connected to the first control unit, and the first temperature monitoring unit is used to monitor the temperature of the first control unit and send it to the first control unit; The second temperature monitoring unit is electrically connected to the second control unit, and is used to monitor the temperature of the second control unit and send the temperature to the second control unit.

9. The control system of the safety controller according to claim 3, characterized in that: The first control module also includes a first power module; the second control module also includes a second power module; Wherein, the first power supply module is electrically connected to the first communication unit, the first control unit and the first programmable logic unit respectively, and is used to supply power to the first communication unit, the first control unit and the first programmable logic unit; The second power supply module is electrically connected to the second communication unit, the second control unit and the second programmable logic unit respectively, and is used to supply power to the second communication unit, the second control unit and the second programmable logic unit.

10. The control system of the safety controller according to claim 2, characterized in that: The first control module further includes a first clock unit; the second control module further includes a second clock unit; The first clock unit is electrically connected to the first programmable logic unit; and the second clock unit is electrically connected to the second programmable logic unit.

11. The control system of the safety controller according to claim 2, characterized in that: The first control module further includes a first display unit; the second control module further includes a second display unit; Wherein, the first display unit is electrically connected to the first control unit; and the second display unit is electrically connected to the second control unit.

12. A safety controller, characterized in that: A control system comprising a safety controller as claimed in any one of claims 1 to 11.

13. An underwater Christmas tree, characterized in that: Comprising a safety controller as claimed in claim 12.

Images