A safety output circuit with a physical disconnection method and an implementation method

Abstract

A safety output circuit with a physical disconnection method and an implementation method, belonging to the technical field of safety output circuits, including a fuse, a dynamic drive circuit, a feedback module, a CPU circuit, a watchdog circuit, and a self-protection circuit. Among them, the CPU circuit is connected to the dynamic drive circuit to drive the dynamic drive circuit; the dynamic drive circuit is connected to the CPU circuit through the feedback module, and the CPU circuit collects the output of the dynamic drive circuit; the CPU circuit is connected to the watchdog circuit to provide a watchdog signal for the watchdog circuit; the watchdog circuit is connected to the self-protection circuit, and the two terminals of the output end of the self-protection circuit are respectively connected to the power supply and the ground; the fuse is installed on the power supply path. The output of unexpected situations is removed by the physical disconnection method of melting the fuse to ensure that the dynamic drive circuit realizes the inherent "fail-safe".

Description

Technical Field

[0001] The present invention belongs to the technical field of safety output circuits, and particularly relates to a safety output circuit with a physical disconnection method and an implementation method thereof. Background Art

[0002] The dynamic operation mode is a commonly used and very effective fault detection and safety protection measure in railway signal systems. Especially in the design and implementation of acquisition unit circuits, drive unit circuits and their control circuits, it can play an inherent "fail-safe" protection role to a certain extent for static faults, especially the "false retention" of control outputs.

[0003] In fact, among various faults that cause incorrect outputs, the "false retention" of the output is a particular and easily occurring situation that cannot be ignored in computer control systems.

[0004] "Dynamic drive" means that when giving a non-restrictive "hazardous side" drive control, it is necessary for the software to alternately give "ON" and "OFF" control commands to the drive circuit at a certain period. Different from the static drive mode, the dynamic drive circuit realizes the conversion and isolation between the dynamic logic level pulse sequence and the static drive level; the key of the dynamic drive also mainly lies in the way and its safety of realizing this conversion in its drive unit circuit. Since the dynamic drive mode is essentially a drive mode with an inherent "fail-safe" property for static faults, usually some inherent "fail-safe" technical measures can be adopted to make the drive unit circuit only give an effective drive output (level) when there is a pulse sequence with a certain frequency or a certain alternating signal input, and any inconvenient static level / current input (fixed ON or fixed OFF) is invalid for it, so it is also safe.

[0005] The hardware random faults of digital computers are usually static faults. In a not very complex drive program, the possibility of continuous regular pulse output caused by software bugs is extremely low. Therefore, the dynamic drive mode is the most thorough method for safety protection against any software and hardware faults that cause "fixed ON" or "fixed OFF" in the drive circuit, including "false retention"; especially for extreme situations such as lightning strikes or traction current intrusion that may cause multiple sub-systems and multi-level control devices to break down simultaneously, it also has good safety protection capabilities. The dynamic drive mode is also mostly used to control the "rejection" mechanism for forcing the system to a safe state. Usually, a relay that turns on its control power supply is driven when the system is normal, and the control power supply is cut off once the pulse drive stops.

[0006] The key link to implement the dynamic drive mode lies in being able to implement the (inherent) "fail-safe" circuit for pulse-level conversion. This circuit converts the drive pulse sequence with the logic voltage standard given by the computer into the energy drive level with the relay voltage standard in a "fail-safe" manner, and finally realizes the safe control of the safety relay. Since the pulse drive mode usually has slightly poor anti-interference ability, and the timing read-back detection method cannot completely and effectively monitor the interference of higher-frequency pulses. In theory, there is also a possibility that the interference violates the detection and the circuit has malfunctioned. Therefore, strict requirements are imposed on the anti-interference ability of the pre-stage pulse drive circuit.

[0007] Railway signals and the like have strict requirements for safe output. Once it is judged that the output is inconsistent with the expectation, it is required that it cannot be solved by re-judgment, restarting, etc. CPU error + two-point faults in the dynamic drive circuit, power pulse interference + faults in the dynamic drive circuit may all output the safe output incorrectly, making the dynamic drive circuit unable to achieve "fail-safe". Summary of the Invention

[0008] Aiming at the problem that the dynamic circuit in the prior art cannot achieve "fail-safe", the present invention proposes a safe output circuit with a physical disconnection method and an implementation method. By removing the output of unexpected situations through the physical disconnection method of fusing the fuse, it is ensured that the dynamic drive circuit realizes the inherent "fail-safe".

[0009] The present invention adopts the following technical solutions:

[0010] A safe output circuit with a physical disconnection method includes a fuse, a dynamic drive circuit, a feedback module, a CPU module, a watchdog circuit, and a self-protection circuit. Among them, the CPU module is connected to the dynamic drive circuit to drive the dynamic drive circuit; the dynamic drive circuit is connected to the CPU module through the feedback module, and the CPU module collects the output of the dynamic drive circuit; the CPU module is connected to the watchdog circuit to provide a watchdog signal for the watchdog circuit; the watchdog circuit is connected to the self-protection circuit, and the two terminals of the output end of the self-protection circuit are respectively connected to the power supply and the ground; the fuse is installed on the power supply path.

[0011] Further, the self-protection circuit is composed of a relay and a resistor. The input coil of the relay is connected to the output signal of the watchdog circuit. The output end of the relay is a normally open contact, one end is connected to the fuse, and the other end is grounded.

[0012] The implementation method of the safe output circuit with a physical disconnection method includes the following steps:

[0013] 1) The self-protection circuit is connected to the CPU module through the watchdog circuit;

[0014] 2) The CPU module determines the working status of the CPU module and the dynamic drive circuit through self-check or feedback module, and provides different dog-feeding signals for the watchdog circuit;

[0015] 3) The input of the watchdog circuit is the dog-feeding signal output by the CPU module, and the watchdog circuit outputs a signal for the self-protection circuit;

[0016] 4) The self-protection circuit controls whether the fuse is blown through the output node;

[0017] 5) One output process ends.

[0018] Further, in step 2), if the CPU module determines a circuit fault through self-check or feedback module, the output of the dog-feeding signal is terminated, the watchdog circuit outputs a high level, enabling the self-protection circuit, short-circuiting the power supply and GND, the fuse is blown, and there is no output level at the safety output port, and one output process ends.

[0019] Further, in step 2), if the CPU module determines that the circuit is normal through self-check or feedback module, the CPU module generates a dog-feeding signal and provides it to the watchdog circuit. The watchdog circuit outputs a low-level signal, and the output node of the self-protection circuit remains disconnected, and one output process ends.

[0020] Further, in step 3), when the watchdog circuit outputs a high level to drive the relay coil, the normally open contact of the relay conducts, and the fuse in the power supply circuit is short-circuited and blown to ensure that there is no output in the circuit.

[0021] The present invention has the following beneficial effects and advantages:

[0022] The dynamic drive circuit with a physical disconnection method of the present invention removes the output of unexpected situations through the physical disconnection method of blowing the fuse, and actively blows the fuse to solve the problem that the safe output is inconsistent with the expectation after a circuit fault caused by reasons such as power interference, and has high safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 is a principle block diagram of the dynamic safety output circuit;

[0024] Figure 2 is a flowchart of the implementation method of the dynamic safety output circuit with a physical disconnection method of the present invention;

[0025] Figure 3 is a schematic diagram of the self-protection circuit. DETAILED DESCRIPTION OF THE INVENTION

[0026] The present invention will be further described in detail below with reference to the drawings and specific embodiments.

[0027] As Figure 1As shown in the figure, in order to obtain the working condition (normal operation or damage) of the safety output circuit, the present invention provides a safety output circuit with a physical disconnection method, including a fuse, a dynamic drive circuit, a feedback module, a CPU module, a watchdog circuit, and a self-protection circuit. The CPU module is connected to the dynamic drive circuit to drive the dynamic drive circuit; the CPU module is connected to the feedback module to collect the output of the dynamic drive circuit; the CPU module is connected to the watchdog circuit to continuously provide a watchdog signal to the watchdog circuit; the watchdog circuit is connected to the self-protection circuit, and the two terminals of the output end of the self-protection circuit are respectively connected to the power supply and the ground; the fuse is installed on the power supply path.

[0028] The CPU module judges the circuit working condition through self-check and the feedback module, and controls whether the fuse melts through the watchdog circuit and the self-protection circuit.

[0029] As Figure 3 shown in the figure, the self-protection circuit consists of a relay and a resistor. The input coil of the relay is connected to the output signal of the watchdog circuit. The output end of the relay is a normally open contact, one end is connected to the fuse, and the other end is grounded.

[0030] As Figure 2 shown in the figure, the present invention also provides a method for implementing a dynamic drive circuit with a physical disconnection method, including the following steps:

[0031] 1) The self-protection circuit is connected to the CPU module through the watchdog circuit;

[0032] 2) The CPU module judges the working state of the CPU module and the dynamic drive circuit through self-check or the feedback module, and provides different watchdog signals to the watchdog circuit;

[0033] 3) The input of the watchdog circuit is the watchdog signal output by the CPU module, and the output to the self-protection circuit is a low-level (opposite to the enable signal of the self-protection circuit) signal;

[0034] 4) The self-protection circuit controls whether the fuse melts through the output node;

[0035] 5) One output process ends.

[0036] In step 2), if the CPU module judges a circuit fault through self-check or the feedback module, the output of the watchdog signal is terminated, the watchdog circuit outputs a high level, enables the self-protection circuit, shorts the power supply and GND, the fuse melts, and there is no output level at the safety output port, and one output process ends.

[0037] In step 2), if the CPU module determines that the circuit is normal through self-check or feedback module, the CPU module generates a watchdog signal and provides it to the watchdog circuit. The watchdog circuit outputs a low-level signal, and the output node of the self-protection circuit remains disconnected, ending one output process.

[0038] As Figure 3 shown, the self-protection circuit consists of a relay and a resistor. When the watchdog circuit outputs a high level to drive the relay coil, the relay node conducts, and the fuse in the power supply circuit is short-circuited to ensure that there is no output from the circuit.

Claims

1. A safety output circuit with a physical disconnection method, characterized in that: It includes a fuse, a dynamic drive circuit, a feedback module, a CPU module, a watchdog circuit, and a self-protection circuit. The CPU module is connected to the dynamic drive circuit to drive the dynamic drive circuit. The dynamic drive circuit is connected to the CPU module through the feedback module, and the CPU module collects the output of the dynamic drive circuit. The CPU module is connected to the watchdog circuit to provide a watchdog signal to the watchdog circuit. The watchdog circuit is connected to the self-protection circuit, and the two terminals of the output end of the self-protection circuit are respectively connected to the power supply and the ground. The fuse is installed on the power supply path. The self-protection circuit consists of a relay and a resistor. The input coil of the relay is connected to the output signal of the watchdog circuit. The output end of the relay is a normally open contact, one end is connected to the fuse, and the other end is grounded. When the watchdog circuit outputs a high level to drive the relay coil, the normally open contact of the relay conducts, and the fuse in the power supply circuit is short-circuited and melted to ensure that there is no output in the circuit.

2. The implementation method of a safety output circuit with a physical disconnection method according to claim 1, characterized in that: It includes the following steps: Step 1) The self-protection circuit is connected to the CPU module through the watchdog circuit; Step 2) The CPU module judges the working states of the CPU module and the dynamic drive circuit through self-check or the feedback module, and provides different watchdog signals to the watchdog circuit; Step 3) The input of the watchdog circuit is the watchdog signal output by the CPU module, and the watchdog circuit outputs a signal to the self-protection circuit; Step 4) The self-protection circuit controls whether the fuse is melted through the output node; Step 5) One output process ends; In step 2), if the CPU module judges a circuit fault through self-check or the feedback module, the output of the watchdog signal is terminated, the watchdog circuit outputs a high level to enable the self-protection circuit, short-circuits the power supply and GND, the fuse is melted, and there is no output level at the safety output port, and one output process ends; In step 2), if the CPU module judges that the circuit is normal through self-check or the feedback module, the CPU module generates a watchdog signal and provides it to the watchdog circuit. The watchdog circuit outputs a low-level signal, and the output node of the self-protection circuit remains disconnected, and one output process ends.

Images