Safety control method, system and device

Abstract

The present invention provides a safety control method, system and device, which belong to the field of petrochemical production safety. The method comprises: inputting signals obtained from the same site into four signal channels respectively, and establishing an inter-channel information transmission communication mechanism between the four signal channels; performing multiple software four-out-of-two voting operations on each signal channel, and outputting the software voting results; inputting the software voting results output by the last voting operation of the four signal channels into a hardware voting circuit for hardware voting, and outputting the hardware voting results as control signals. The safety control method, system and device of the present invention perform multiple four-out-of-two software voting on four mutually redundant signal channels for signals from the same site, and when one or two of the signal channels fail, safety control can still be achieved. The safety control method, system and device of the present invention can effectively reduce the safety failure rate and the false shutdown rate.

Description

Technical Field

[0001] The present invention relates to the field of safe production in petrochemical industry, and in particular to a safety control method, a safety control system and a safety control device. Background Art

[0002] Safety control system is one of the most important equipment to ensure safe production in petrochemical industry. It is used to monitor potential dangers in industrial processes, issue alarm information in time or automatically execute predetermined protection functions to prevent dangerous incidents in petrochemical process or mitigate their consequences, so as to ensure the safety of personnel, equipment and the surrounding environment of the factory.

[0003] At present, petrochemical production enterprises often use safety control systems to improve the safety integrity level (SIL) of the system while meeting the overall needs and ensuring the system reliability indicators, so as to achieve the level of SIL3 for a single channel of the safety control system. The hardware fault margin refers to the number of hardware failures that the safety instrument system can maintain and continue to operate without an overall failure. In order to minimize the impact of common cause failures on the system, the hardware fault margin of the safety control system is generally required to be greater than or equal to 1. A hardware fault margin of 1 means that there are two devices with the following structural constraints, that is, a dangerous failure of one of the two components or subsystems cannot prevent the triggering of the safety action.

[0004] At present, the system structures that can achieve a hardware fault margin of 1 and are widely used mainly include: 1oo2, 2oo3, and 2x2oo2 structures. The 1oo2 structure is commonly used in situations where two independent controllers each have their own independent I / O. If a channel fails and a dangerous failure occurs, the other channel works normally and the system can still be in a safe state. Although the 1oo2 structure improves the hardware fault margin, since this structure does not change any output state or output vote, the safety failure score of this structure is low, so it is difficult for the entire safety function to achieve a higher safety integrity level. The 2oo2 structure consists of three parallel sub-channels, and the three sub-channels vote in 2o3 at the output. The 2oo2 system has high safety and can achieve fault tolerance, that is, a single safety failure will not affect its normal safety function, but the general 2oo2 system still has defects in detection and operation speed. If a single channel fails, there may be a situation where the system cannot detect it, which will lead to the failure not being discovered in time, and the architecture is complex and the implementation cost is high. The two-by-two-take-two structure consists of two subsystems composed of four CPUs. Each subsystem has a comparison output unit. The subsystems are switched using a dual-system hot standby method, which greatly affects the real-time and availability of the system. If the switching causes data loss, it will also lead to accidental shutdown. Such a system has low security, reliability and availability.

[0005] In addition, the current safety control system has been completely transformed from the early analog technology to the digital technology. The digital system relies on software programming to realize its safety logic function. Since the software failure mechanism is different from the random failure of hardware, it is a common cause failure. The common cause failure refers to the simultaneous failure of two or more units in a system due to a common cause, resulting in a single cause or failure causing adverse effects on multiple components or parts of the system. Summary of the invention

[0006] To solve the above problems, the purpose of the embodiments of the present invention is to provide a safety control method, system and device.

[0007] In order to achieve the above object, the present invention provides a safety control method for petrochemical production safety control in a first aspect, the method comprising:

[0008] Input the signals acquired from the same scene into four signal channels respectively, and an inter-channel information transmission communication mechanism is established between the four signal channels;

[0009] Perform multiple software four-out-of-two voting operations on each signal channel and output the software voting results;

[0010] The software voting result outputted from the last voting operation of the four signal channels is inputted into the hardware voting circuit for hardware voting, and the hardware voting result is outputted as a control signal.

[0011] Optionally, performing multiple software four-out-of-two voting operations on each signal channel includes: performing two software four-out-of-two voting operations on each signal channel.

[0012] Optionally, performing multiple software four-out-of-two voting operations on each signal channel includes: four signal channels use different processors to perform multiple software four-out-of-two voting operations.

[0013] Optionally, the performing of multiple software four-out-of-two voting operations includes:

[0014] When performing each software four-out-of-two voting operation, the input signal is judged for fault and the signal is voted and output after the fault signal is eliminated.

[0015] A second aspect of the present invention provides a safety control system based on the above safety control method, which is used for safety control of petrochemical production, and the safety control system comprises:

[0016] Four signal channels, each of which is provided with an input module, a logic processing module and an output module;

[0017] The input module is used for signal input;

[0018] The logic processing module is connected to the input module, and the logic processing module includes a communication module, a memory and a microprocessor; the communication module is used to obtain the signal value between the signal channels, the memory stores the program instructions of the multiple software four-out-of-two voting operation, and the microprocessor is used to execute the program instructions in the memory;

[0019] The output module is connected to the logic processing module and is used to output the software voting result output by the last voting operation of the signal channel;

[0020] The hardware voting module has a built-in hardware voting circuit and is connected to the output module of each signal channel. It is used to perform hardware voting and control signal output on the four software voting results output by the last voting operation of the four signal channels.

[0021] Optionally, the input module includes an input card for realizing conversion and transmission of input signals of the signal channel; the output module includes an output card for converting the software voting result output by the last voting operation of the signal channel and outputting the voting signal of the signal channel; the input card and the output card are implemented based on a microprocessor.

[0022] Optionally, the hardware voting module includes an output terminal board, which is connected to the output card of each signal channel. The output terminal board has a built-in hardware voting circuit for performing hardware voting on the voting signals output by the last voting operation of the four signal channels and outputting a control signal.

[0023] Optionally, the four signal channels are respectively signal channel A, signal channel B, signal channel C and signal channel D;

[0024] The hardware voting circuit is composed of a first two-out-of-one hardware voting circuit and a second two-out-of-one hardware voting circuit connected in parallel;

[0025] The first one-out-of-two hardware voting circuit is controlled by the voting signals output by the signal channel A and the signal channel B. The first one-out-of-two hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals output by the signal channel A and the signal channel B is a valid signal;

[0026] The second two-out-of-one hardware voting circuit is controlled by the voting signals output by signal channel C and signal channel D. The second two-out-of-one hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals output by signal channel C and signal channel D is a valid signal.

[0027] Optionally, the output card of each signal channel uses output contacts to output the voting signals of the signal channel in pairs; wherein,

[0028] The voting signals output by the output card of signal channel A are voting signal A1 and voting signal A2;

[0029] The voting signals output by the output card of signal channel B are voting signal B1 and voting signal B2;

[0030] The voting signals output by the output card of signal channel C are voting signal C1 and voting signal C2;

[0031] The voting signals output by the output card of signal channel D are voting signal D1 and voting signal D2.

[0032] Optionally, the hardware voting circuit includes eight switch terminals, namely a first switch terminal, a second switch terminal, a third switch terminal, a fourth switch terminal, a fifth switch terminal, a sixth switch terminal, a seventh switch terminal and an eighth switch terminal, and the first to eighth switch terminals are respectively controlled by a voting signal A1, a voting signal B1, a voting signal B2, a voting signal A2, a voting signal C1, a voting signal D1, a voting signal D2 and a voting signal C2;

[0033] The first switch terminal is connected in parallel with the second switch terminal to form a first parallel circuit; the third switch terminal is connected in parallel with the fourth switch terminal to form a second parallel circuit; the fifth switch terminal is connected in parallel with the sixth switch terminal to form a third parallel circuit; the seventh switch terminal is connected in parallel with the eighth switch terminal to form a fourth parallel circuit;

[0034] The first parallel circuit is connected in series with the second parallel circuit to form the first two-out-of-one hardware voting circuit; the third parallel circuit is connected in series with the fourth parallel circuit to form the second two-out-of-one hardware voting circuit;

[0035] The first to eighth switch terminals are in a normally open state. When the voting signal controlling the switch terminal is a valid signal, the switch terminal is triggered to close so that the hardware voting circuit is turned on and outputs the valid voting signal.

[0036] Optionally, the models of the microprocessor of the input card, the microprocessor of the output card and the microprocessor of the logic processing module in each signal channel are different from each other.

[0037] Optionally, the models of the microprocessor in signal channel A and the microprocessor in signal channel B are different from each other, and the models of the microprocessor in signal channel C and the microprocessor in signal channel D are different from each other.

[0038] A third aspect of the present invention provides a safety control device, the device is configured with the above-mentioned safety control system, and the safety control device comprises:

[0039] Four voting chassis and hardware voting output devices connected to the four voting chassis;

[0040] The voting machine box includes a plurality of slots into which cards are inserted, and the cards include an input card, a CPU card, an output card and a communication card;

[0041] The CPU card is used to store and execute multiple software four-out-of-two voting operation program instructions;

[0042] The four chassis communicate via a communication card.

[0043] Optionally, the safety control device further comprises: an input quantity detector, a first safety barrier, an input terminal board, a second safety barrier and an actuator;

[0044] The input quantity detector is connected to the first safety barrier for signal collection;

[0045] The first safety barrier is connected to the input terminal board for safety energy limiting;

[0046] The input terminal board is connected to the input cards of the four chassis, and is used to divide the signal into four identical signals, and respectively send them to the input cards of the four chassis;

[0047] The second safety barrier is connected to the hardware voting output device and is used for receiving the hardware voting signal output by the hardware voting output device and inputting the hardware voting signal to the actuator.

[0048] Through the above technical solution, multiple four-out-of-two software voting is performed on four signal channels for signals from the same site. When one or two signal channels fail, safety control can still be achieved, which can effectively reduce the safety failure rate and false shutdown rate. This solves the problem that the existing hardware redundant voting technology can only achieve performance improvement in one aspect of safety failure rate or false shutdown rate, but cannot coordinate safety and reliability.

[0049] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0051] Figure 1 It is a schematic diagram of a safety control method provided by an embodiment of the present invention;

[0052] Figure 2It is a schematic diagram of a safety control system provided by one embodiment of the present invention;

[0053] Figure 3 It is a block diagram of a safety control system provided by one embodiment of the present invention;

[0054] Figure 4 It is a schematic diagram of a hardware voting circuit of a safety control system provided by an embodiment of the present invention;

[0055] Figure 5 It is a cabinet configuration diagram of a safety control device provided by one embodiment of the present invention;

[0056] Figure 6 It is a schematic diagram of a voting machine box of a safety control device provided by an embodiment of the present invention.

[0057] Description of Reference Numerals

[0058] 1- Slot. DETAILED DESCRIPTION

[0059] The specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present invention, and is not used to limit the present invention.

[0060] Embodiment 1

[0061] Figure 1 FIG. 1 is a schematic diagram of a safety control method provided by an embodiment of the present invention. Figure 1 As shown, an embodiment of the present invention provides a safety control method for petrochemical production safety control, the method comprising:

[0062] Input the signals acquired from the same scene into four signal channels respectively, and an inter-channel information transmission communication mechanism is established between the four signal channels;

[0063] Perform multiple software four-out-of-two voting operations on each signal channel and output the software voting results;

[0064] The software voting result outputted from the last voting operation of the four signal channels is inputted into the hardware voting circuit for hardware voting, and the hardware voting result is outputted as a control signal.

[0065] Specifically, the detection signal from the field, i.e., the input signal, is divided into four identical input signals and respectively input into four mutually redundant signal channels, i.e., one signal is input into one signal channel, and the signal is converted into a signal value that can be recognized by the computer on each channel. An inter-channel information transmission communication mechanism is established between the four signal channels to obtain information between the signal channels.

[0066] A multiple software four-out-of-two voting operation is performed on each signal channel, and a software voting result is output. The operation rule of the multiple software four-out-of-two voting operation is to obtain the signal value of the signal input to each signal channel or the voting result of the previous multiple software four-out-of-two voting operation as the input of the corresponding multiple software four-out-of-two voting operation through the inter-channel information transmission communication mechanism established between the signal channels, and judge the four input signal values. When at least two of the four input signal values ​​represent valid signals, the multiple software four-out-of-two voting operation outputs the valid signal value as the voting result of the multiple software four-out-of-two voting operation.

[0067] The software voting result outputted from the last software four-out-of-two voting operation of the four signal channels is inputted into the hardware voting circuit for hardware voting, and the hardware voting result is outputted as a control signal.

[0068] Through this safety control method, multiple four-out-of-two software voting is performed on the signals from the same site on four mutually redundant signal channels. When one or two signal channels fail, the other two signal channels can still work normally. At this time, safety control can still be achieved, which can effectively reduce the safety failure rate and false shutdown rate. It solves the problem that the existing hardware redundant voting technology can only achieve performance improvement in one aspect of safety failure rate or false shutdown rate, but cannot coordinate safety and reliability.

[0069] Optionally, performing multiple software four-out-of-two voting operations on each signal channel includes: performing two software four-out-of-two voting operations on each signal channel.

[0070] Optionally, performing the multiple software four-out-of-two voting operation on each signal channel includes: using different processors to perform the multiple software four-out-of-two voting operation on the four signal channels. By using different processors to perform the multiple software four-out-of-two voting operation on each signal channel, synchronization of the multiple software four-out-of-two operation processing between the signal channels can be achieved.

[0071] Optionally, the performing of multiple software four-out-of-two voting operations includes:

[0072] When performing each software four-out-of-two voting operation, the input signal is judged for fault and the fault signal is removed before the signal voting output. When performing each software four-out-of-two operation, the four input signal values ​​are analyzed to determine whether there is a fault signal in the four input signals. If there is a fault signal, the fault signal is removed and the valid signal value is used for voting output. And through the source of the fault signal, it can be known that the processing module that outputs the fault signal is faulty and unavailable, which can prompt the fault module to be checked.

[0073] Embodiment 2

[0074] Figure 2 FIG. 1 is a schematic diagram of a safety control system provided by an embodiment of the present invention. Figure 2 As shown, an embodiment of the present invention provides a safety control system based on the safety control method described in the above embodiment 1, which is used for safety control of petrochemical production, and the safety control system includes:

[0075] Four signal channels, each of which is provided with an input module, a logic processing module and an output module;

[0076] The input module is used for signal input;

[0077] The logic processing module is connected to the input module, and the logic processing module includes a communication module, a memory and a microprocessor; the communication module is used to obtain the signal value between the signal channels, the memory stores the program instructions of the multiple software four-out-of-two voting operation, and the microprocessor is used to execute the program instructions in the memory;

[0078] The output module is connected to the logic processing module and is used to output the software voting result output by the last voting operation of the signal channel;

[0079] The hardware voting module has a built-in hardware voting circuit and is connected to the output module of each signal channel. It is used to perform hardware voting and control signal output on the four software voting results output by the last voting operation of the four signal channels.

[0080] Specifically, Figure 2 As shown, the system includes: signal channel A, signal channel B, signal channel C and signal channel D. The signal channel A is provided with input module A, logic processing module A and output module A; the signal channel B is provided with input module B, logic processing module B and output module B; the signal channel C is provided with input module C, logic processing module C and output module C; the signal channel D is provided with input module D, logic processing module D and output module D.

[0081] The same signal from the same field sensor is input into signal channel A, signal channel B, signal channel C and signal channel D respectively, passes through the input module, logic processing module and output module of each signal channel, and then passes through a unified hardware voting module, and finally outputs the final control signal.

[0082] like Figure 2 As shown, an inter-channel information transmission communication mechanism is established between the logic processing module A, the logic processing module B, the logic processing module C and the logic processing module D, which can realize information transmission between signal channels.

[0083] The signal channel A, signal channel B, signal channel C and signal channel D are redundant with each other. When one or two of the signal channels fail and cannot output a valid signal or cannot output a signal, the other two channels can still work normally to ensure that the system can still achieve safe control.

[0084] Preferably, the input and output modules, logic processing modules, and output modules are provided with self-checking circuits, which can detect whether the modules themselves fail. If module failure is detected, the signal value output by the module is marked. For example, marking the output signal value as 0 indicates that the module outputs a failure signal value.

[0085] For example, when the input module of a certain signal channel detects failure, the data output by the input module is marked as invalid. When the logic processing module performs a two-out-of-four voting operation, the output of the failed input module is inconsistent with the valid signal values ​​of the other three channels and is ignored or eliminated. Any two of the other three channels can output the voting result normally. In this case, the logic module below the input module of the failed signal channel can still receive other normal input data and the data comes from the redundant input modules of other signal channels. Therefore, the entire system can continue to work, the system is still in a usable state, and still has the ability to perform safety control.

[0086] Furthermore, the input module includes an input card for realizing the conversion and transmission of the input signal of the signal channel; the output module includes an output card for converting the software voting result output by the last voting operation of the signal channel and outputting the voting signal of the signal channel; the input card and the output card are implemented based on a microprocessor.

[0087] Furthermore, the hardware voting module includes an output terminal board, which is connected to the output card of each signal channel. The output terminal board has a built-in hardware voting circuit for performing hardware voting on the voting signals output by the last voting operation of the four signal channels and outputting a control signal.

[0088] Figure 3 FIG. 1 is a block diagram of a safety control system provided by an embodiment of the present invention. Figure 3 As shown, the input module in each signal channel includes an input card implemented based on a microprocessor, the logic processing module includes a controller CPU card implemented based on a microprocessor, and the output module includes an output card implemented based on a microprocessor. The hardware voting module includes an output terminal board with a built-in hardware voting circuit.

[0089] Wherein, the input card includes a digital quantity input card and an analog quantity input card.

[0090] The input card is used to convert the signal input from each signal channel into a signal value that can be processed by the computer, and input it to the controller CPU card of the logic processing module in the signal channel. The controller CPU card on the channel stores the user logic program for performing multiple software four-out-of-two voting operations. The output card is used to perform signal conversion on the output signal value and output it to the hardware voting module.

[0091] like Figure 3 As shown, the field detection signal (i.e., input signal) transmitted by the input quantity detector and the first safety barrier is divided into four identical input signals through the input terminal board, and sent to four signal channels respectively. The logic processing modules of the four signal channels realize high-speed isolated two-way communication between the two controller CPU cards of each signal channel through the communication card, and obtain the signal values ​​of other channels. When the safety control system is working, first, the controller CPU card of each signal channel performs the first software four-out-of-two voting operation on the four input signals from the same site and the same part to achieve fault tolerance of the input signal channel. Secondly, the logic processing modules of the four signal channels obtain the voting results of the previous software four-out-of-two voting operation of the controller CPU card of other channels through the communication card again, and perform the next software four-out-of-two voting on the voting results to achieve fault tolerance of the voting results of the previous voting operation of each controller CPU card. Finally, the voting results output by the controller CPU card of each signal channel after performing multiple software four-out-of-two voting operations are sent to the output terminal board through the output card for hardware voting. The results of the hardware voting output by the output terminal board are sent to the actuator after the second safety barrier.

[0092] When a signal channel input module, logic processing module or output module in the safety control system fails, other modules of the channel or other signal channels can still work normally, and the system can still output correct control commands after multiple four-out-of-two voting. The system's refusal probability and false operation probability are improved, thereby improving the overall availability and reliability of the system.

[0093] like Figure 3 As shown, the logic processing modules of the four signal channels use different controller CPU cards, and the communication card is used to realize high-speed isolated two-way communication between the two controller CPU cards of each signal channel, so as to realize the synchronous processing of the operation results of the four channels.

[0094] like Figure 3As shown, signal channel A includes: input card I-A1, controller CPU card CPU-A1 and output card O-A1, signal channel B includes: input card I-B2, controller CPU card CPU-B2 and output card O-B2, signal channel C includes: input card I-C1, controller CPU card CPU-C1 and output card O-C1, signal channel D includes: input card I-D2, controller CPU card CPU-D2 and output card O-D2.

[0095] Furthermore, the models of the microprocessor of the input card, the microprocessor of the output card and the microprocessor of the logic processing module in each signal channel are different from each other. For example, the microprocessors in the input card I-A1, the controller CPU card CPU-A1 and the output card O-A1 in the signal channel A are microprocessors of different models from the same or different manufacturers.

[0096] Furthermore, the models of the microprocessor in signal channel A and the microprocessor in signal channel B are different from each other, and the models of the microprocessor in signal channel C and the microprocessor in signal channel D are different from each other. For example, the input card I-A1, the controller CPU card CPU-A1 and the output card O-A1 in signal channel A and the input card I-C1, the controller CPU card CPU-C1 and the output card O-C1 in signal channel C are implemented by microprocessors selected from one microprocessor manufacturer; while the input card I-B2, the controller CPU card CPU-B2 and the output card O-B2 in signal channel B and the input card I-D2, the controller CPU card CPU-D2 and the output card O-D2 in signal channel D are implemented by microprocessors selected from another microprocessor manufacturer.

[0097] Due to the use of microprocessors of different models, the input card I-A1, input card I-B2, input card I-C1 and input card I-D2 in the safety control system constitute a diversity input card. The controller CPU card CPU-A1, controller CPU card CPU-B2, controller CPU card CPU-C1 and controller CPU card CPU-D2 constitute a diversity controller CPU card. The output card O-A1, output card O-B2, output card O-C1 and output card O-D2 constitute a diversity output card. Therefore, the safety control system has the diversity of different signal channels and the diversity of different execution modules within the same signal channel. When a certain model of microprocessor fails due to problems, due to the different models of other microprocessors, the probability of failure due to the same problem is extremely low, so other models of microprocessors can work normally, further ensuring that the safety control system can work normally. By setting up the diversity of different signal channels and the diversity of different execution modules within the same signal channel, the system risk caused by common cause failure of the digital system can be reduced, and reliability and availability can be taken into account, which is conducive to improving the safety integrity of the control loop, ensuring the safe and stable operation of the system, and further ensuring that the safety control system complies with the IEC61508 international safety standard.

[0098] Embodiment 3

[0099] An embodiment of the present invention provides a hardware voting circuit for a safety control system, wherein the hardware voting circuit is composed of a first one-out-of-two hardware voting circuit and a second one-out-of-two hardware voting circuit connected in parallel.

[0100] The first one-out-of-two hardware voting circuit is controlled by the voting signals output by the signal channel A and the signal channel B. The first one-out-of-two hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals output by the signal channel A and the signal channel B is a valid signal;

[0101] The second two-out-of-one hardware voting circuit is controlled by the voting signals output by signal channel C and signal channel D. The second two-out-of-one hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals output by signal channel C and signal channel D is a valid signal.

[0102] Furthermore, the output card of each signal channel uses output contacts in pairs to output the voting signals of the signal channel; wherein,

[0103] The voting signals output by the output card of signal channel A are voting signal A1 and voting signal A2;

[0104] The voting signals output by the output card of signal channel B are voting signal B1 and voting signal B2;

[0105] The voting signals output by the output card of signal channel C are voting signal C1 and voting signal C2;

[0106] The voting signals output by the output card of signal channel D are voting signal D1 and voting signal D2.

[0107] Figure 4 This is a schematic diagram of a hardware voting circuit for a safety control system provided by an embodiment of the present invention. Figure 4 As shown, the hardware voting circuit includes eight switch terminals, namely, a first switch terminal, a second switch terminal, a third switch terminal, a fourth switch terminal, a fifth switch terminal, a sixth switch terminal, a seventh switch terminal and an eighth switch terminal. The first to eighth switch terminals are controlled by voting signals A1, B1, B2, A2, C1, D1, D2 and C2, respectively.

[0108] like Figure 4 As shown, the first switch terminal controlled by the voting signal A1 is connected in parallel with the second switch terminal controlled by the voting signal B1 to form a first parallel circuit; the third switch terminal controlled by the voting signal B2 is connected in parallel with the fourth switch terminal controlled by the voting signal A2 to form a second parallel circuit; the fifth switch terminal controlled by the voting signal C1 is connected in parallel with the sixth switch terminal controlled by the voting signal D1 to form a third parallel circuit; the seventh switch terminal controlled by the voting signal D2 is connected in parallel with the eighth switch terminal controlled by the voting signal C2 to form a fourth parallel circuit.

[0109] like Figure 4 As shown, the first parallel circuit is connected in series with the second parallel circuit to form a first two-out-of-one hardware voting circuit; the third parallel circuit and the fourth parallel circuit are connected in series to form a second two-out-of-one hardware voting circuit; the first two-out-of-one hardware voting circuit is connected in parallel with the second two-out-of-one hardware voting circuit.

[0110] The first to eighth switch terminals are in a normally open state. When the voting signal controlling the switch terminal is a valid signal, the switch terminal is triggered to close so that the hardware voting circuit is turned on and outputs the valid voting signal.

[0111] Embodiment 4

[0112] An embodiment of the present invention provides a safety control device, the device is configured with the safety control system of the above embodiment, and the safety control device includes:

[0113] Four voting chassis and hardware voting output devices connected to the four voting chassis;

[0114] The voting machine box includes a plurality of slots 1 into which cards are inserted, and the cards include input cards, CPU cards, output cards and communication cards;

[0115] The CPU card is used to store and execute multiple software four-out-of-two voting operation program instructions;

[0116] The four chassis communicate via a communication card.

[0117] Figure 5 It is a cabinet configuration diagram of a safety control device provided by an embodiment of the present invention.

[0118] like Figure 5 As shown, a typical safety control device is composed of four voting boxes (voting box A, voting box B, voting box C and voting box D). Each box constitutes a signal channel, and the four boxes are placed in a cabinet with a length*width*height=800x800x2000mm. The controller CPU card of each voting box performs point-to-point bidirectional isolation high-speed communication with the controller CPU cards in other boxes through the communication card in the box. The output card of each box is connected to the hardware voting output device.

[0119] Figure 6 FIG. 1 is a schematic diagram of a voting cabinet of a security control device provided by an embodiment of the present invention. Figure 6 As shown, a voting machine chassis consists of fifteen slots 1, and each slot 1 is inserted with a corresponding card. Except for the first slot 1 on the far left, which is fixed as a controller CPU card, other slots 1 can be freely configured. For example, the second slot 1 and the third slot 1 are communication cards, the fourth slot 1 to the ninth slot 1 are digital input cards, the tenth slot 1 and the eleventh slot 1 are analog input cards, and the twelfth slot 1 to the fifteenth slot 1 are digital output cards. When the system capacity is large and two cabinets need to be configured, the communication card in the third slot 1 is responsible for communicating with the chassis of the second cabinet. When only one cabinet needs to be configured, the third slot 1 can be configured as an input card or an output card.

[0120] Furthermore, the safety control device further comprises: an input quantity detector, a first safety barrier, an input terminal board, a second safety barrier and an actuator;

[0121] The input quantity detector is connected to the first safety barrier for signal collection;

[0122] The first safety barrier is connected to the input terminal board for safety energy limiting;

[0123] The input terminal board is connected to the input cards of the four chassis, and is used to divide the signal into four identical signals, and respectively send them to the input cards of the four chassis;

[0124] The second safety barrier is connected to the hardware voting output device and is used for receiving the hardware voting signal output by the hardware voting output device and inputting the hardware voting signal to the actuator.

[0125] The input quantity detector includes a digital quantity detector and an analog quantity detector.

[0126] Those skilled in the art will understand that all or part of the steps in the method for implementing the above-mentioned embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for making a single-chip microcomputer, a chip or a processor (processor) perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0127] The optional embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the technical concept of the embodiments of the present invention, the technical scheme of the embodiments of the present invention can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the embodiments of the present invention. It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the embodiments of the present invention will not further describe various possible combinations.

[0128] In addition, various embodiments of the present invention may be arbitrarily combined, and as long as they do not violate the concept of the embodiments of the present invention, they should also be regarded as the contents disclosed in the embodiments of the present invention.

Claims

1. A safety control method for petrochemical production safety control, characterized in that: The method comprises: The signals obtained from the same site are input into four signal channels respectively, and an inter-channel information transmission communication mechanism is established between the four signal channels; wherein the four signal channels are signal channel A, signal channel B, signal channel C and signal channel D respectively; the output card of each signal channel adopts output contacts to output the voting signals of the signal channel in pairs; wherein the voting signals output by the output card of signal channel A are voting signals A1 and A2; the voting signals output by the output card of signal channel B are voting signals B1 and B2; the voting signals output by the output card of signal channel C are voting signals C1 and C2; the voting signals output by the output card of signal channel D are voting signals D1 and D2; Perform multiple software four-out-of-two voting operations on each signal channel and output the software voting results; The software voting result outputted by the last voting operation of the four signal channels is inputted into the hardware voting circuit for hardware voting, and the hardware voting result is outputted as a control signal; wherein the hardware voting circuit is composed of a first two-out-of-one hardware voting circuit and a second two-out-of-one hardware voting circuit connected in parallel; the first two-out-of-one hardware voting circuit is controlled by the voting signal outputted by the signal channel A and the signal channel B, and the first two-out-of-one hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals outputted by the signal channel A and the signal channel B is a valid signal; the second two-out-of-one hardware voting circuit is controlled by the voting signal outputted by the signal channel C and the signal channel D, and the second two-out-of-one hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals outputted by the signal channel C and the signal channel D is a valid signal; the hardware voting circuit includes eight switch terminals, namely, a first switch terminal, a second switch terminal, a third switch terminal, a fourth switch terminal , the fifth switch terminal, the sixth switch terminal, the seventh switch terminal and the eighth switch terminal, the first to the eighth switch terminals are respectively controlled by the voting signal A1, the voting signal B1, the voting signal B2, the voting signal A2, the voting signal C1, the voting signal D1, the voting signal D2 and the voting signal C2; the first switch terminal is connected in parallel with the second switch terminal to form a first parallel circuit; the third switch terminal is connected in parallel with the fourth switch terminal to form a second parallel circuit; the fifth switch terminal is connected in parallel with the sixth switch terminal to form a third parallel circuit; the seventh switch terminal is connected in parallel with the eighth switch terminal to form a fourth parallel circuit; the first parallel circuit is connected in series with the second parallel circuit to form the first two-to-one hardware voting circuit; the third parallel circuit is connected in series with the fourth parallel circuit to form the second two-to-one hardware voting circuit; the first to the eighth switch terminals are in a normally open state, and when the voting signal controlling the switch terminal is a valid signal, the trigger switch terminal is closed to turn on the hardware voting circuit and output the valid voting signal.

2. The safety control method according to claim 1, characterized in that: The performing of multiple software four-out-of-two voting operations on each signal channel includes: performing two software four-out-of-two voting operations on each signal channel.

3. The safety control method according to claim 1, characterized in that: The performing of multiple software four-out-of-two voting operations on each signal channel includes: four signal channels use different processors to perform multiple software four-out-of-two voting operations.

4. The safety control method according to any one of claims 1 to 3, characterized in that: The performing of multiple software four-out-of-two voting operations includes: When performing each software four-out-of-two voting operation, the input signal is judged for fault and the signal is voted and output after the fault signal is eliminated.

5. A safety control system based on the safety control method according to any one of claims 1 to 4, used for safety control of petrochemical production, characterized in that: The safety control system comprises: Four signal channels, each of which is provided with an input module, a logic processing module and an output module; The input module is used for signal input; The logic processing module is connected to the input module, and the logic processing module includes a communication module, a memory and a microprocessor; the communication module is used to obtain the signal value between the signal channels, the memory stores the program instructions of the multiple software four-out-of-two voting operation, and the microprocessor is used to execute the program instructions in the memory; The output module is connected to the logic processing module and is used to output the software voting result output by the last voting operation of the signal channel; The hardware voting module has a built-in hardware voting circuit and is connected to the output module of each signal channel. It is used to perform hardware voting and control signal output on the four software voting results output by the last voting operation of the four signal channels.

6. The safety control system according to claim 5, characterized in that: The input module includes an input card for realizing the conversion and transmission of the input signal of the signal channel; the output module includes an output card for converting the software voting result output by the last voting operation of the signal channel and outputting the voting signal of the signal channel; the input card and the output card are implemented based on a microprocessor.

7. The safety control system according to claim 6, characterized in that: The hardware voting module includes an output terminal board, which is connected to the output card of each signal channel. The output terminal board has a built-in hardware voting circuit for performing hardware voting on the voting signals output by the last voting operation of the four signal channels and outputting a control signal.

8. The safety control system according to claim 7, characterized in that: The four signal channels are signal channel A, signal channel B, signal channel C and signal channel D; The hardware voting circuit is composed of a first one-out-of-two hardware voting circuit and a second one-out-of-two hardware voting circuit connected in parallel; The first one-out-of-two hardware voting circuit is controlled by the voting signals output by the signal channel A and the signal channel B. The first one-out-of-two hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals output by the signal channel A and the signal channel B is a valid signal; The second two-out-of-one hardware voting circuit is controlled by the voting signals output by signal channel C and signal channel D. The second two-out-of-one hardware voting circuit is turned on and outputs the valid voting signal when one of the voting signals output by signal channel C and signal channel D is a valid signal.

9. The safety control system according to claim 8, characterized in that: The output card of each signal channel uses output contacts to output the voting signals of the signal channel in pairs; The voting signals output by the output card of signal channel A are voting signal A1 and voting signal A2; The voting signals output by the output card of signal channel B are voting signal B1 and voting signal B2; The voting signals output by the output card of signal channel C are voting signal C1 and voting signal C2; The voting signals output by the output card of signal channel D are voting signal D1 and voting signal D2.

10. The safety control system according to claim 9, characterized in that: The hardware voting circuit includes eight switch terminals, namely, a first switch terminal, a second switch terminal, a third switch terminal, a fourth switch terminal, a fifth switch terminal, a sixth switch terminal, a seventh switch terminal and an eighth switch terminal, wherein the first to eighth switch terminals are controlled by a voting signal A1, a voting signal B1, a voting signal B2, a voting signal A2, a voting signal C1, a voting signal D1, a voting signal D2 and a voting signal C2 respectively; The first switch terminal is connected in parallel with the second switch terminal to form a first parallel circuit; the third switch terminal is connected in parallel with the fourth switch terminal to form a second parallel circuit; the fifth switch terminal is connected in parallel with the sixth switch terminal to form a third parallel circuit; the seventh switch terminal is connected in parallel with the eighth switch terminal to form a fourth parallel circuit; The first parallel circuit is connected in series with the second parallel circuit to form the first two-out-of-one hardware voting circuit; the third parallel circuit is connected in series with the fourth parallel circuit to form the second two-out-of-one hardware voting circuit; The first to eighth switch terminals are in a normally open state. When the voting signal controlling the switch terminal is a valid signal, the switch terminal is triggered to close so that the hardware voting circuit is turned on and outputs the valid voting signal.

11. The safety control system according to claim 6, characterized in that: The models of the microprocessor of the input card, the microprocessor of the output card and the microprocessor of the logic processing module in each signal channel are different from each other.

12. The safety control system according to claim 11, characterized in that: The models of the microprocessor in signal channel A and the microprocessor in signal channel B are different from each other, and the models of the microprocessor in signal channel C and the microprocessor in signal channel D are different from each other.

13. A safety control device, characterized in that: The device is equipped with a safety control system according to any one of claims 5 to 12, and the safety control device comprises: Four voting chassis and hardware voting output devices connected to the four voting chassis; The voting machine box includes a plurality of slots into which cards are inserted, and the cards include an input card, a CPU card, an output card and a communication card; The CPU card is used to store and execute multiple software four-out-of-two voting operation program instructions; The four voting machine boxes communicate via a communication card.

14. The safety control device according to claim 13, characterized in that: The safety control device further comprises: an input quantity detector, a first safety barrier, an input terminal board, a second safety barrier and an actuator; The input quantity detector is connected to the first safety barrier for signal collection; The first safety barrier is connected to the input terminal board for safety energy limiting; The input terminal board is connected to the input cards of the four voting machine boxes, and is used to divide the signal into four identical signals, and respectively send them to the input cards of the four voting machine boxes; The second safety barrier is connected to the hardware voting output device and is used for receiving the hardware voting signal output by the hardware voting output device and inputting the hardware voting signal to the actuator.

Images