A two-out-of-two safety output circuit system and method

Abstract

The present invention discloses a two-out-of-two safety output circuit system and method, the system includes a low-frequency control unit, a low-frequency optocoupler drive circuit, a low-frequency switching power supply circuit, a high-frequency control unit, a high-frequency optocoupler drive circuit and a high-frequency switching power supply circuit; the low-frequency control unit, the low-frequency optocoupler drive circuit, the low-frequency switching power supply circuit, the high-frequency optocoupler drive circuit and the high-frequency switching power supply circuit are connected in sequence, and the high-frequency control unit is connected to the high-frequency optocoupler drive circuit. The present invention eliminates the dangerous output caused by a single frequency acting in the circuit due to a fault or interference by building a two-stage output circuit with a large frequency gap to form a logical output relationship, thereby improving the safety of the safety output circuit system.

Description

Technical Field

[0001] The present invention belongs to the field of rail transportation, and in particular relates to a two-out-of-two safety output circuit system and method. Background Art

[0002] The rail transit industrial control field with safety requirements usually requires a two-out-of-two safety output circuit that meets safety standards to drive the output to ensure the principle of fault-oriented safety output. In the field of industrial control, the two-out-of-two safety logic output circuit mostly adopts reactive fault safety or single dynamic pulse. This type of output circuit has the problem of limited use environment, and the specific frequency interference generated by the complex industrial environment, the control pin adhesion of the device, the fixed frequency output failure of the controller, etc. may still cause the output stage to produce dangerous output or the output controller cannot detect its own output failure in normal working state. Summary of the invention

[0003] In view of the above problems, the technical solution adopted by the present invention is: a two-out-of-two safety output circuit system, comprising a low-frequency control unit, a low-frequency optocoupler drive circuit, a low-frequency switching power supply circuit, a high-frequency control unit, a high-frequency optocoupler drive circuit and a high-frequency switching power supply circuit; the low-frequency control unit, the low-frequency optocoupler drive circuit, the low-frequency switching power supply circuit, the high-frequency optocoupler drive circuit and the high-frequency switching power supply circuit are connected in sequence, and the high-frequency control unit is connected to the high-frequency optocoupler drive circuit; wherein,

[0004] The low-frequency control unit is used to generate a low-frequency dynamic signal, and the low-frequency dynamic signal acts on the low-frequency switching power supply circuit through the low-frequency optical coupling driving circuit;

[0005] The low-frequency switching power supply circuit is used to generate a voltage that satisfies the high-frequency optocoupler driving circuit to turn on, so that the high-frequency switching power supply circuit can work normally;

[0006] The high-frequency control unit is used to generate a high-frequency dynamic signal, and when the high-frequency switching power supply circuit works normally, the high-frequency optical coupling driving circuit acts on the high-frequency switching power supply circuit;

[0007] The high-frequency switching power supply circuit is used to generate a high-level output voltage acting on a load.

[0008] Optionally, the system also includes a signal self-check circuit and a signal mutual-check circuit, the signal self-check circuit is connected between the low-frequency transformer voltage and the low-frequency control unit and between the high-frequency switching power supply circuit and the high-frequency control unit, and the signal mutual-check circuit is connected between the low-frequency transformer voltage and the high-frequency control unit and between the high-frequency switching power supply circuit and the low-frequency control unit.

[0009] Optionally, the signal self-checking circuit and the signal mutual-checking circuit are both isolation sampling circuits, and the low-frequency dynamic signal and the high-frequency dynamic signal are sampled through the isolation sampling circuit for self-checking or mutual checking.

[0010] Optionally, the low-frequency dynamic signal and the high-frequency dynamic signal are periodically changing control signals, and the duty cycle is automatically adjusted according to the periodically changing frequency to keep the output power stable.

[0011] Optionally, an isolation communication circuit is connected between the low-frequency control unit and the high-frequency control unit;

[0012] The isolated communication circuit is used to isolate the communication synchronization signal and status between the low-frequency control unit and the high-frequency control unit.

[0013] Optionally, an isolation communication circuit is connected between the low-frequency control unit and the high-frequency control unit;

[0014] The isolated communication circuit is also used to perform an isolated communication synchronization self-check state on the low-frequency control unit and the high-frequency control unit.

[0015] Optionally, the low-frequency switching power supply circuit is a low-frequency single-tube flyback drive circuit, and the high-frequency switching power supply circuit is a high-frequency single-tube flyback drive circuit;

[0016] The switch tube at the input end of the low-frequency single-tube flyback drive circuit is connected to the low-frequency optocoupler drive circuit, the output end of the low-frequency single-tube flyback drive circuit is connected to the high-frequency optocoupler drive circuit, the output end of the high-frequency optocoupler drive circuit is connected to the switch tube at the input end of the high-frequency single-tube flyback drive circuit, and the output end of the high-frequency single-tube flyback drive circuit is connected to the load.

[0017] Optionally, the low-frequency control unit and the high-frequency control unit are MCU or FPGA controllers.

[0018] Optionally, the low-frequency optocoupler driving circuit is a low-speed optocoupler, and the high-frequency optocoupler driving circuit is a high-speed logic output optocoupler.

[0019] And, a two-out-of-two safety output method, the method comprising the following steps:

[0020] The low-frequency control unit outputs a low-frequency dynamic signal, and acts on the low-frequency switching power supply circuit through a low-frequency optical coupler driving circuit;

[0021] The low-frequency switching power supply circuit generates a voltage that satisfies the high-frequency optocoupler driving circuit to turn on, so that the high-frequency switching power supply circuit can work normally;

[0022] The high-frequency control unit outputs a high-frequency dynamic signal, and acts on the high-frequency switching power supply circuit through a high-frequency optocoupler driving circuit, and the generated high-level output voltage acts on the load.

[0023] Optionally, the method further comprises the step of: the low-frequency control unit and the high-frequency control unit retrieve the output dynamic signals for self-checking and mutual checking.

[0024] Optionally, the output low-frequency dynamic signal and high-frequency dynamic signal are periodically changing control signals, and the duty cycle is automatically adjusted according to the periodically changing frequency to keep the output power stable.

[0025] Optionally, the method further comprises the step of: the low frequency control unit and the high frequency control unit performing isolated communication synchronization signals and states.

[0026] The present invention has the following beneficial effects due to the adoption of the above technical solution: by constructing a two-stage output circuit with a large frequency difference, a logical output relationship is formed to prevent dangerous output caused by a single frequency acting in the circuit due to a fault or interference, thereby improving the safety of the safety output circuit system. The controller's safety self-check is achieved through dynamic frequency conversion control and self-check. When the system is working normally, each stage of the control signal periodically changes the frequency and duty cycle at a lower frequency. When the output signal of any stage is inconsistent with the self-check signal, the two-stage circuit stops working at the same time, and the circuit output fault is monitored in time, and the fault can be located in time, thereby improving the system availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 A structural diagram of a safety output circuit according to an embodiment of the present invention is shown;

[0029] Figure 2 A schematic diagram of a safety output circuit according to an embodiment of the present invention is shown;

[0030] Figure 3 A schematic diagram of a periodic frequency-variable dynamic signal according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] The two-out-of-two safety output circuit system of the embodiment of the present invention is as follows: Figure 1 The circuit structure diagram shown includes a low-frequency control unit, a low-frequency optocoupler drive circuit, a low-frequency switching power supply circuit, a high-frequency control unit, a high-frequency optocoupler drive circuit and a high-frequency switching power supply circuit; wherein, the output end of the low-frequency control unit, the input end of the low-frequency optocoupler drive circuit, the output end of the low-frequency optocoupler drive circuit, the input end of the low-frequency switching power supply circuit, the output end of the low-frequency switching power supply circuit, the input end of the high-frequency optocoupler drive circuit, the output end of the high-frequency optocoupler drive circuit, the input end of the high-frequency switching power supply circuit, the output end of the high-frequency switching power supply circuit, and the load are connected in sequence, and the output end of the high-frequency control unit is connected to the input end of the high-frequency optocoupler drive circuit.

[0033] The low-frequency control unit is used to generate a low-frequency dynamic signal, and the high-frequency control unit is used to generate a high-frequency dynamic signal. The low-frequency dynamic signal and the high-frequency dynamic signal are periodically changing control signals, and the duty cycle is automatically adjusted according to the periodic changing frequency to keep the output power stable. Figure 3 The schematic diagram of the periodic variable frequency dynamic signal is shown, where period 1 is a low-frequency wide pulse control signal, and period 2 is a high-frequency narrow pulse control signal, and the signals of period 1 and period 2 change alternately. In this embodiment, the low-frequency dynamic signal is a periodic variable PWM wave of 2kHz and 1.9kHz, and the high-frequency dynamic signal is a periodic variable PWM wave of 100kHz and 95kHz.

[0034] The low-frequency dynamic signal generated by the low-frequency control unit acts on the low-frequency switching power supply circuit through the low-frequency optocoupler drive circuit, so that the low-frequency switching power supply circuit performs a voltage boost process on the output circuit to generate a voltage that satisfies the high-frequency optocoupler drive circuit to turn on, so that the high-frequency switching power supply circuit works normally. The high-frequency dynamic signal generated by the high-frequency control unit acts on the high-frequency switching power supply circuit through the high-frequency optocoupler drive circuit, so that the high-frequency switching power supply circuit performs a voltage boost process on the input voltage to generate a high-level output voltage, thereby supplying power to the load.

[0035] Furthermore, the system also includes a signal self-check circuit and a signal mutual-check circuit, wherein the signal self-check circuit is connected between the low-frequency transformer voltage and the low-frequency control unit and between the high-frequency switching power supply circuit and the high-frequency control unit, and the signal mutual-check circuit is connected between the low-frequency transformer voltage and the high-frequency control unit and between the high-frequency switching power supply circuit and the low-frequency control unit. In this embodiment, the signal self-check circuit and the signal mutual-check circuit are both isolation recovery circuits, and the low-frequency dynamic signal and the high-frequency dynamic signal are recovered through the isolation recovery circuit for self-check or mutual-check. The low-frequency control unit and the high-frequency control unit simultaneously perform relevant mutual-check and self-check on the dynamic signals of the two-stage circuits (low-frequency switching power supply circuit and high-frequency switching power supply circuit). If any one-stage frequency is abnormal, the output is considered abnormal. After any control unit stops providing dynamic signals, the output circuit cannot output.

[0036] Furthermore, an isolation communication circuit is connected between the low-frequency control unit and the high-frequency control unit. In this embodiment, the isolation communication circuit uses a high-speed isolation chip; the isolation communication circuit is used to isolate the communication synchronization signal and state of the low-frequency control unit and the high-frequency control unit. The isolation communication circuit is also used to isolate the communication synchronization self-check state of the low-frequency control unit and the high-frequency control unit.

[0037] Preferably, the low-frequency switching power supply circuit is a low-frequency single-tube flyback drive circuit, and the high-frequency switching power supply circuit is a high-frequency single-tube flyback drive circuit; the switch tube Q1 at the input end of the low-frequency single-tube flyback drive circuit is connected to the low-frequency optocoupler drive circuit, the output end of the low-frequency single-tube flyback drive circuit is connected to the high-frequency optocoupler drive circuit, the output end of the high-frequency optocoupler drive circuit is connected to the switch tube Q2 at the input end of the high-frequency single-tube flyback drive circuit, and the output end of the high-frequency single-tube flyback drive circuit is connected to the load.

[0038] The low-frequency optocoupler driving circuit is a low-speed optocoupler, and the high-frequency optocoupler driving circuit is a high-speed logic output optocoupler. Figure 2 As shown in the circuit schematic diagram, in this embodiment, the low-speed optocoupler is a four-pin optocoupler (model: TLP291), and the high-speed logic output optocoupler is an 8-pin optocoupler (model: ACPL-H312). For the low-speed optocoupler U1, its pin 1 is connected to the low-frequency control unit, pin 4 is connected to the 5V isolated power supply of the low-frequency single-tube flyback drive circuit, and pin 3 is connected to the input end of the switch tube Q1 in the low-frequency single-tube flyback drive circuit. For the high-speed logic output optocoupler U2, its pin 2 is connected to the high-frequency control unit, pin 8 is connected to the output end of the low-frequency single-tube flyback isolation circuit, and pins 6 and 7 are connected to the input end of the switch tube Q2 in the high-frequency single-tube flyback isolation circuit.

[0039] The low-frequency control unit inputs a low-frequency dynamic PWM signal to the anode of the input end of the low-speed optocoupler U1. The low-frequency dynamic signal acts on the low-frequency single-tube flyback drive circuit from the emitter of the output end of the low-speed optocoupler U1. The 5V isolated power supply supplies power to the collector of the output end of the low-speed optocoupler U1. The low-speed optocoupler U1 drives the switch tube Q1 to turn on and off, so that the low-frequency single-tube flyback drive circuit works. The step-up transformer T1 in the low-frequency single-tube flyback drive circuit raises the secondary voltage and inputs the voltage into the high-speed logic output optocoupler U2. When the turn-on voltage of the high-speed logic output optocoupler U2 is reached, the high-speed logic output optocoupler U2 can output. The high-frequency control unit outputs a high-frequency dynamic PWM signal. The high-speed logic output optocoupler U2 drives the switch tube Q2 in the high-frequency single-tube flyback drive circuit to turn on and off, so that the high-frequency single-tube flyback drive circuit works, thereby supplying power to the load through the high-frequency single-tube flyback circuit.

[0040] Among them, the low-frequency control unit, the high-frequency control unit, the low-frequency switching power supply circuit, the high-frequency switching power supply circuit and the connection between the output end are all electrically isolated. The low-frequency control unit controls the low-frequency switching power supply circuit through the low-speed optocoupler U1, and the low-frequency switching circuit is driven to the power supply end of the high-speed logic output optocoupler U2 through the isolated output generated by the transformer T1. The high-frequency control unit 2 controls the high-frequency switching power supply circuit through the high-speed optocoupler, and the high-frequency switching power supply circuit is driven to the final load end of the two-out-of-two circuit through the isolated output generated by the transformer T2, thereby ensuring the safety of the circuit system.

[0041] Optionally, the low-frequency control unit and the high-frequency control unit are MCU or FPGA controllers.

[0042] Based on the above, in this embodiment, the dangerous output caused by a specific single frequency interference frequency can be prevented by using a low-frequency switching power supply circuit and a high-frequency switching power supply circuit with a large frequency difference. If a 100kHz low-duty-cycle high-frequency dynamic signal drives a low-frequency single-tube flyback drive circuit, it will not be able to generate enough output voltage to turn on the high-frequency optocoupler drive circuit for output. At the same time, the 2kHz low-frequency dynamic signal will be turned on for a long time, which will cause the high-frequency single-tube flyback drive circuit to enter a saturated state and unable to work normally. In summary, the two dynamic signals cannot drive the other level of circuit to generate output. This method enhances the anti-interference type of the circuit and improves the safety of the two-out-of-two circuit. The output signal generated by the drive circuit controlled by the dynamic signal eliminates the uncontrollable output state of the circuit device caused by short circuit or open circuit, thereby ensuring the safety of the output signal.

[0043] When the high-frequency control unit is outputting normally, the high-frequency control unit cannot know whether its dynamic output pin is in an uncontrolled fixed output state. By dynamically adjusting the output frequency and self-checking, dynamic safety monitoring of the output pin can be achieved during normal working output, the working status of the circuit system can be obtained, and the standby board can be switched in time to enhance system safety and availability.

[0044] In combination with the above two-out-of-two safety output circuit system, a two-out-of-two safety output method is further provided, comprising the following steps:

[0045] The low-frequency control unit outputs a low-frequency dynamic signal, and acts on the low-frequency switching power supply circuit through a low-frequency optical coupler driving circuit;

[0046] The low-frequency switching power supply circuit generates a voltage that satisfies the high-frequency optocoupler driving circuit to turn on, so that the high-frequency switching power supply circuit can work normally;

[0047] The high-frequency control unit outputs a high-frequency dynamic signal, which acts on the high-frequency switching power supply circuit through a high-frequency optocoupler driving circuit, and the generated high-level output voltage acts on the load;

[0048] In addition, the method also includes the following steps: the low-frequency control unit and the high-frequency control unit retrieve the output dynamic signals for self-inspection and mutual inspection; and the low-frequency control unit and the high-frequency control unit isolate the communication synchronization signals and states.

[0049] It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention, so they have no substantial technical significance. Any modification of the structure, change of the proportion relationship or adjustment of the size should still fall within the scope of the technical content disclosed by the present invention without affecting the effects and purposes that can be achieved by the present invention. At the same time, the terms such as "upper", "lower", "left", "right", "middle" and "one" quoted in this specification are only for the convenience of description, and are not used to limit the scope of the implementation of the present invention. The change or adjustment of their relative relationship should also be regarded as the scope of the implementation of the present invention without substantially changing the technical content.

[0050] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technician familiar with this profession can make some changes or modifications to equivalent embodiments of equivalent changes using the technical contents disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A two-out-of-two safety output circuit system, characterized in that: It includes a low-frequency control unit, a low-frequency optocoupler drive circuit, a low-frequency switching power supply circuit, a high-frequency control unit, a high-frequency optocoupler drive circuit and a high-frequency switching power supply circuit; the low-frequency control unit, the low-frequency optocoupler drive circuit, the low-frequency switching power supply circuit, the high-frequency optocoupler drive circuit and the high-frequency switching power supply circuit are connected in sequence, and the high-frequency control unit is connected to the high-frequency optocoupler drive circuit; wherein, The low-frequency control unit is used to generate a low-frequency dynamic signal, and the low-frequency dynamic signal acts on the low-frequency switching power supply circuit through the low-frequency optical coupling driving circuit; The low-frequency switching power supply circuit is used to generate a voltage that satisfies the high-frequency optocoupler driving circuit to turn on, so that the high-frequency switching power supply circuit can work normally; The high-frequency control unit is used to generate a high-frequency dynamic signal, and when the high-frequency switching power supply circuit works normally, the high-frequency optical coupling driving circuit acts on the high-frequency switching power supply circuit; The high-frequency switching power supply circuit is used to generate a high-level output voltage acting on a load; The low-frequency optocoupler driving circuit includes a four-pin optocoupler, and the high-frequency optocoupler driving circuit includes an 8-pin optocoupler; The system further comprises a signal mutual detection circuit, wherein the signal mutual detection circuit is connected between the low-frequency transformer voltage and the high-frequency control unit and between the high-frequency switch power supply circuit and the low-frequency control unit; The low-frequency control unit and the high-frequency control unit simultaneously perform mutual inspection and self-inspection on the dynamic signals of the low-frequency switching power supply circuit and the high-frequency switching power supply circuit. When the output signal of any level is inconsistent with the self-inspection signal, the two-level circuits stop working at the same time.

2. The two-out-of-two safety output circuit system according to claim 1, characterized in that: The system further comprises a signal self-checking circuit, which is connected between the low-frequency transformer voltage and the low-frequency control unit and between the high-frequency switching power supply circuit and the high-frequency control unit.

3. The two-out-of-two safety output circuit system according to claim 2, characterized in that: The signal self-checking circuit and the signal mutual-checking circuit are both isolation and sampling circuits, and the low-frequency dynamic signal and the high-frequency dynamic signal are sampled through the isolation and sampling circuits for self-checking or mutual-checking.

4. The two-out-of-two safety output circuit system according to claim 1, characterized in that: The low-frequency dynamic signal and the high-frequency dynamic signal are periodically changing control signals, and the duty cycle is automatically adjusted according to the periodically changing frequency to keep the output power stable.

5. The two-out-of-two safety output circuit system according to any one of claims 1 to 4, characterized in that: An isolation communication circuit is connected between the low-frequency control unit and the high-frequency control unit; The isolated communication circuit is used to isolate the communication synchronization signal and status between the low-frequency control unit and the high-frequency control unit.

6. The two-out-of-two safety output circuit system according to claim 2 or 3, characterized in that: An isolation communication circuit is connected between the low-frequency control unit and the high-frequency control unit; The isolated communication circuit is also used to perform an isolated communication synchronization self-check state on the low-frequency control unit and the high-frequency control unit.

7. The two-out-of-two safety output circuit system according to any one of claims 1 to 4, characterized in that: The low-frequency switching power supply circuit is a low-frequency single-tube flyback drive circuit, and the high-frequency switching power supply circuit is a high-frequency single-tube flyback drive circuit; The switch tube at the input end of the low-frequency single-tube flyback drive circuit is connected to the low-frequency optocoupler drive circuit, the output end of the low-frequency single-tube flyback drive circuit is connected to the high-frequency optocoupler drive circuit, the output end of the high-frequency optocoupler drive circuit is connected to the switch tube at the input end of the high-frequency single-tube flyback drive circuit, and the output end of the high-frequency single-tube flyback drive circuit is connected to the load.

8. The two-out-of-two safety output circuit system according to any one of claims 1 to 4, characterized in that: The low-frequency control unit and the high-frequency control unit are MCU or FPGA controllers.

9. The two-out-of-two safety output circuit system according to any one of claims 1 to 4, characterized in that: The low-frequency optocoupler driving circuit is a low-speed optocoupler, and the high-frequency optocoupler driving circuit is a high-speed logic output optocoupler.

10. A two-out-of-two safety output method, characterized in that: The method comprises the following steps: The low-frequency control unit outputs a low-frequency dynamic signal, and acts on the low-frequency switching power supply circuit through a low-frequency optical coupler driving circuit; The low-frequency switching power supply circuit generates a voltage that satisfies the high-frequency optocoupler driving circuit to turn on, so that the high-frequency switching power supply circuit can work normally; The high-frequency control unit outputs a high-frequency dynamic signal, which acts on the high-frequency switching power supply circuit through a high-frequency optocoupler driving circuit, and the generated high-level output voltage acts on the load; The low-frequency optocoupler driving circuit includes a four-pin optocoupler, and the high-frequency optocoupler driving circuit includes an 8-pin optocoupler; The low-frequency control unit and the high-frequency control unit collect the output dynamic signals for self-checking and mutual checking. When the output signal of any level is inconsistent with the self-checking signal, the two-level circuits stop working at the same time.

11. The two-out-of-two safety output method according to claim 10, characterized in that: The output low-frequency dynamic signal and high-frequency dynamic signal are periodically changing control signals, and the duty cycle is automatically adjusted according to the periodic changing frequency to keep the output power stable.

12. The two-out-of-two safety output method according to any one of claims 10 to 11, characterized in that: The method further comprises the steps of: The low frequency control unit and the high frequency control unit communicate synchronous signals and states in isolation.

Images