A power supply safety management device and method for a non-coding signal system

Abstract

The present invention provides a power supply safety management device for a non-coding signal system, comprising: a first power management module, which includes a plurality of first channels. The first channels convert the voltage of a first power supply into the operating voltage of corresponding logic operation units, and based on the detection result of the operating voltage, control the first power management module to cut off power, or control all logic operation units to perform synchronous reset; a second power management module, which includes a plurality of second channels. The second channels convert the electrical signal of the first power supply into a first analog electrical signal and detect whether its voltage is normal. If not, the second power management module cuts off power; a third power management module includes: a plurality of output relays for controlling the third power supply to supply power to external safety devices; a plurality of isolation relays for controlling the second power supply to supply power to the coils of the plurality of output relays; detect whether the voltages of the second and third power supplies are normal. If normal, supply power to external safety devices. The present invention also provides a power supply safety management method.

Description

Technical Field

[0001] The present invention relates to the field of railway communication signal systems, and in particular, to a power supply safety management device and method for a non-coded signal system. Background Art

[0002] Power supply is a basic element for the safe operation of railway signal systems. It not only affects the logical operation safety of key logical operation units but also directly affects safety signal quantities as an intermediate signal conditioning link. Therefore, the safety management of power supply is an important safety guarantee for safety integrity level 4 (SIL4) signal systems. Generally, according to the safety assurance principle of safety signal systems, they can be roughly divided into coded systems and non-coded systems. The coded system ensures the whole process of safety signal quantities through safety coding. For example, errors can be detected through coding verification in the processes of signal acquisition and processing, and the impact of power supply abnormalities on safety quantities is relatively small. In contrast, the non-coded system has higher requirements for power supply safety management. For example, for the supply voltages (including 3.3V, 1.2V, 1.0V) of logic devices responsible for safety logical operations, if not effectively managed, it will lead to incorrect processing logic and affect the safe operation of railway signal systems. Another example is that when the logic processing unit crashes and goes offline, its output needs to be cut off. Since the operation of the logic unit in the offline state is uncontrollable, a more secure and reliable safety-side holding method is required. In addition, there are other power supply voltages, such as the output drive voltage (220V), etc. Overvoltage and undervoltage are likely to have an adverse impact on trackside equipment.

[0003] Therefore, how to provide a power supply safety management device and method for a non-coded signal system to prevent signal safety hazards caused by poor power supply management is an urgent problem to be solved at present. Summary of the Invention

[0004] The purpose of the present invention is to provide a power supply safety management device and method for a non-coded signal system, which uses different power supply management strategies for different power supplies in the non-coded safety signal system, can systematically prevent signal safety hazards caused by poor power supply management in the non-coded signal system, and can better balance system safety and on-site availability.

[0005] To achieve the above object, the present invention provides a power supply safety management device for a non-coded signal system, and the non-coded signal system includes: first to third power management modules;

[0006] The first power management module includes a plurality of first channels; the first channels convert the electrical signals of the first power supply into first digital quantity electrical signals for supplying power to corresponding logic operation units; if a first channel determines that the amplitude of the corresponding first digital quantity electrical signal is higher than a set upper limit amplitude, the electrical connection between the first power supply and the first power management module is disconnected through this first channel; if a first channel determines that the amplitude of the corresponding first digital quantity electrical signal is lower than a set lower limit amplitude, all logic operation units are driven to perform synchronous reset through this first channel;

[0007] The second power management module includes a plurality of second channels; the second channels convert the electrical signals output by the first power supply into first analog quantity electrical signals, and the first analog quantity electrical signals are used to generate safety signal quantities; if a second channel determines that the voltage of the corresponding first analog quantity electrical signal does not fall within the corresponding voltage fluctuation range, the electrical connection between the first power supply and the second power management module is disconnected;

[0008] The third power management module includes a plurality of output relays and a plurality of isolation relays, the plurality of output relays are used to control the third power supply to supply power to external safety devices; the plurality of isolation relays are used to control the second power supply to supply power to the coils of the plurality of output relays; the third power management module periodically detects the voltages of the second power supply and the third power supply, and when the durations of the voltages of the second power supply and the third power supply falling within the corresponding voltage fluctuation ranges are both greater than the corresponding preset normal duration threshold or less than the corresponding preset abnormal duration threshold, the third power supply supplies power to external safety devices.

[0009] Optionally, the first power management module further includes: a first fuse and a plurality of first fuse switches; the plurality of first fuse switches respectively correspond to the plurality of first channels;

[0010] The first end of the first fuse is connected to the output end of the first power supply; the first fuse switch is a normally open switch, and its electrical connection is between the second end of the first fuse and the ground;

[0011] The first channel includes: a first DC-DC conversion module, an overvoltage monitoring module, and an undervoltage monitoring module; the first DC-DC conversion module is electrically connected between the second end of the first fuse and the corresponding logic operation unit, and is used to convert the electrical signal of the first power supply into a first digital quantity electrical signal for supplying power to the corresponding logic operation unit; the overvoltage monitoring module is electrically connected to the output end of the first DC-DC conversion module and is signal-connected to the corresponding first fuse switch; when the amplitude of the first digital quantity electrical signal exceeds the set upper limit amplitude, the overvoltage monitoring module drives the corresponding first fuse switch to close; the undervoltage monitoring module is electrically connected between the output end of the corresponding first DC-DC conversion module and the reset pins of all logic operation units; when the amplitude of the first digital quantity electrical signal is lower than the set lower limit amplitude, the corresponding undervoltage monitoring module drives all logic operation units to perform synchronous reset.

[0012] Optionally, the first power management module includes two first channels; the first DC-DC conversion modules of the two first channels are different types of DC-DC conversion modules.

[0013] Optionally, the second power management module further includes: a second fuse and a plurality of second fuse switches; the plurality of second fuse switches respectively correspond to a plurality of second channels;

[0014] The first end of the second fuse is electrically connected to the output end of the first power supply, and the second fuse switch is a normally open switch, and is electrically connected between the second end of the second fuse and the ground;

[0015] The second channel includes: a second DC-DC conversion module, a first ADC sampling circuit, and a first microprocessor; the input end of the second DC-DC conversion module is connected to the second end of the second fuse, and is used to convert the electrical signal output by the first power supply into the first analog quantity electrical signal;

[0016] The first ADC sampling circuit is electrically connected between the output end of the second DC-DC conversion module and the input end of the first microprocessor, and is used to sample the first analog quantity electrical signal and the 0V electrical signal respectively to obtain a first sampling value and a second sampling value; the first microprocessor is also signal-connected to the second fuse switch; the first microprocessor calculates the difference between the first sampling value and the second sampling value, and if the difference does not fall within the set difference range, the first microprocessor drives the corresponding second fuse switch to close.

[0017] Optionally, the second power management module includes two second channels; the second DC-DC conversion modules of the two second channels are different types of DC-DC conversion modules.

[0018] Optionally, the third power management module further includes: a plurality of second microprocessors and a plurality of third microprocessors; the plurality of second microprocessors respectively correspond to a plurality of isolation relays; the plurality of third microprocessors respectively correspond to a plurality of output relays;

[0019] The output terminal of the first power supply is electrically connected to the positive pole of the isolation relay coil, and the negative pole of the isolation relay coil is grounded through the corresponding second microprocessor; the isolation relay includes a first normally open contact and a second normally open contact; the first normally open contacts of the plurality of isolation relays are connected in series between the second power supply and the positive pole of the output relay coil; the negative pole of the output relay coil is grounded through the corresponding third microprocessor; the second normally open contacts of the plurality of isolation relays and the normally open contacts of the plurality of output relays are connected in series between the output terminal of the third power supply and the external safety device.

[0020] Optionally, the third power management module further includes: an optocoupler isolation voltage sampling circuit and a second ADC sampling circuit;

[0021] The optocoupler isolation voltage sampling circuit is used to sample the output voltage of the second power supply. When the output voltage of the second power supply falls within the corresponding voltage fluctuation range, the optocoupler isolation voltage sampling circuit outputs a low-level feedback signal, otherwise the optocoupler isolation voltage sampling circuit outputs a high-level feedback signal; when the duration of the optocoupler isolation voltage sampling circuit continuously outputting a low-level feedback signal exceeds the preset time threshold, the negative pole of the isolation relay coil is grounded through the second microprocessor;

[0022] The second ADC sampling circuit is used to sample the output voltage of the third power supply. When the output voltage of the third power supply falls within the corresponding voltage fluctuation range, the second ADC sampling circuit outputs a low-level feedback signal, otherwise the second ADC sampling circuit outputs a high-level feedback signal; when the duration of the second ADC sampling circuit continuously outputting a low-level feedback signal exceeds the time threshold, the negative pole of the output relay coil is grounded through the third microprocessor.

[0023] Optionally, the first power supply is used to output a 12V analog electrical signal; the operating voltages of the logic operation unit include 1V, 1.2V, and 3.3V voltages, and the corresponding voltage fluctuation ranges of the 1V, 1.2V, and 3.3V operating voltages are 0.9V to 1.1V, 1.08V to 1.32V, and 3V to 3.6V respectively; the voltage of the analog electrical signal is 5V, and the corresponding voltage fluctuation range is 4.75V to 5.25V; the output voltage of the second power supply is 24V, and the corresponding voltage fluctuation range is 21.6V to 26.4V; the output voltage of the third power supply is 220V, and the corresponding voltage fluctuation range is 198V to 242V.

[0024] The present invention also provides a power supply safety management method for a non-coded signal system, which is implemented by the power supply safety management device of the non-coded signal system as described in the present invention, and includes the steps:

[0025] S1. The overvoltage monitoring module and undervoltage monitoring module of the first channel perform overvoltage monitoring and undervoltage monitoring on the first digital quantity electrical signal; if the amplitude of the first digital quantity electrical signal exceeds the set upper limit amplitude, the overvoltage monitoring module drives the corresponding first fuse switch to close, the first fuse melts, and all logic operation units lose power; if the first digital quantity electrical signal is lower than the set lower limit amplitude, the undervoltage monitoring module drives all logic operation units to perform synchronous reset;

[0026] S2. The first ADC sampling circuit of the second channel samples the first analog quantity electrical signal and the 0V electrical signal to obtain a first sampling value and a second sampling value respectively; the first microprocessor calculates the difference between the first sampling value and the second sampling value, and if the difference does not fall within the set difference range, the first microprocessor drives the corresponding second fuse switch to close, and the second fuse melts; if all the second channels judge that the corresponding first analog quantity electrical signal is normal, the first analog quantity electrical signal is output;

[0027] S3. The optocoupler isolation voltage sampling circuit periodically samples the voltage of the second power supply and outputs a corresponding feedback signal, and the second ADC sampling circuit periodically samples the voltage of the third power supply and outputs a corresponding feedback signal; the second microprocessor judges whether the feedback signal of the second power supply is normal, and if it is normal, starts timing the normal monitoring result; the third microprocessor judges whether the feedback signal of the third power supply is normal, and if it is normal, starts timing the normal monitoring result; if the timing duration of the normal monitoring results of the second microprocessor and the third microprocessor reaches the preset normal duration threshold, the coils of the corresponding isolation relay and output relay are powered on; if the coils of all isolation relays and output relays are powered on, the third power supply supplies power to the external safety device.

[0028] Optionally, in step S3, if the second microprocessor and the third microprocessor judge that the corresponding feedback signal is abnormal, the second microprocessor and the third microprocessor start timing the abnormal monitoring result; if the timing duration of the abnormal monitoring results of the second microprocessor and the third microprocessor reaches the preset abnormal duration threshold, the coils of the corresponding isolation relay and output relay lose power, and the third power supply does not supply power to the external safety device.

[0029] Compared with the prior art, the beneficial effects of the power supply safety management device and method of the non-coded signal system of the present invention are as follows:

[0030] 1) The present invention designs different power management strategies for different types of power supplies, effectively reducing the signal safety hazards caused by poor power management, and can better balance system security and on-site availability.

[0031] 2) Each of the multiple first channels of the present invention can automatically detect whether the operating voltage (3V / 1.2V / 1V) of the corresponding logic operation unit exceeds the upper limit amplitude. When it exceeds the upper limit amplitude, the corresponding first channel automatically blows the first fuse to prevent irreversible damage to the logic operation unit caused by excessive operating voltage. The first channel can also automatically detect whether the operating voltage of the logic operation unit is lower than the lower amplitude threshold. When it is lower than the lower limit amplitude, the operation result of the logic operation unit is already untrustworthy, which may lead to the untrustworthiness of the calculation results of other associated logic operation units. At this time, the corresponding first channel can synchronously reset all the logic operation units to ensure the credibility of the subsequent calculation results of the logic operation units.

[0032] 3) The multiple second channels of the present invention can strictly control the first analog electrical signal (5V analog electrical signal) used to generate the safety signal quantity (such as participating in the filament current feedback circuit of the signal machine). Only when all the second channels consider the corresponding first analog electrical signal normal can it be considered that the collected filament current value is safe, and based on this, the actual state of the signal machine is judged; otherwise, the system sends a default safety side signal quantity to the upper computer, and at the same time disconnects the isolation relay and the output relay to cut off the output. The present invention effectively guarantees the safety of the safety signal quantity acquisition process.

[0033] 4) The present invention periodically collects the voltages of the second power supply (24V DC) and the third power supply (220V AC), and outputs the corresponding feedback signals to the second microprocessor and the third microprocessor. Only when all the second microprocessors and the third microprocessors judge that the corresponding feedback signals are normal (the duration exceeds the set normal duration threshold), the third power supply supplies power to external safety devices (such as turnouts and signal machines). Through the present invention, it is possible to avoid inconsistent logic driving and feedback results of the relay caused by the power supply, and prevent incorrect triggering of the system downtime.

[0034] 5) The structure of the present invention is simple to implement, the principle design is clear and easy to understand, and it is easy to promote. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solution of the present invention, the drawings required for description will be briefly introduced below. Obviously, the drawings in the following description are an embodiment of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings:

[0036] Figure 1 It is a schematic diagram of the power supply tree structure of the non-coded signal system;

[0037] Figure 2 It is a schematic diagram of the structure of the first power management module of the present invention;

[0038] Figure 3 It is a schematic structural diagram of the second power management module of the present invention;

[0039] Figure 4 It is a schematic structural diagram of the third power management module of the present invention;

[0040] Figure 5 It is a flowchart of the power supply safety management method for the non-coded signal system of the present invention;

[0041] Figure 6 It is a schematic diagram of the working process of the first power management module in the embodiment of the present invention;

[0042] Figure 7 It is a schematic diagram of the working process of the second power management module in the embodiment of the present invention;

[0043] Figure 8 、 Figure 9 It is a schematic diagram of the working process of the third power management module in the embodiment of the present invention. Detailed implementation manners

[0044] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0045] It should be understood that when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their combinations.

[0046] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit this application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0047] It should be further understood that the term "and / or" used in this application specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0048] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "once" or "in response to determining" or "in response to detecting" depending on the context. Similarly, the phrase "if determined" or "if [the described condition or event] is detected" can be interpreted as meaning "once determined" or "in response to determining" or "once [the described condition or event] is detected" or "in response to detecting [the described condition or event]" depending on the context.

[0049] In addition, in the description of this application, the terms "first", "second", "third", etc. are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance.

[0050] Figure 1 It is a power supply tree structure diagram (including safety acquisition and safety drive functions) for a common non-coded signal system. The power supply of the non-coded signal system can be roughly divided into three categories:

[0051] The first category: 12V to 3.3V / 1.2V / 1.0V digital power, which mainly provides the main power supply voltage of 3.3V, the GPIO (General-purpose input / output) voltage, and the logic operation voltages (1.2V and 1.0V) for the logic operation units (including microprocessor MCU, programmable logic device FPGA / CPLD). When the first category of power supply has overvoltage, it is easy to damage the logic operation unit. When the first category of power supply has over-undervoltage, the operation result of the logic operation unit is untrustworthy.

[0052] The second category: 12V to analog 5V voltage. The 5V analog voltage participates in the generation of safety signal quantities, such as the ADC (Analog-to-digital converter) acquisition of the safety link (used to generate the signal lamp filament current feedback signal) or the generation of the bias voltage. When the second category of power supply is abnormal, it will cause the safety signal quantity (signal machine filament current signal) to be incorrect and result in a safety accident. Among them, the first category and the second category of power supplies usually realize power supply conversion through the safety board card of the non-coded signal system itself.

[0053] Category 3: External input power (including 220V AC and 24V power). The 220V AC is used to provide driving power for external safety devices (such as signal machines and switch lights). The 24V power is used to supply power to the coils of output relays. When the 24V power has an abnormality, such as power failure or undervoltage, it will cause the driving logic and feedback result of the output relay to be inconsistent. At this time, it may trigger the downtime behavior of the non-coded signal system, affecting the operation. But actually, it is just a power failure or undervoltage of 24V. In this state, it is the safe side. The abnormality of the 220V AC will also cause the driving and feedback states of the external safety devices to be inconsistent, affecting the availability. In addition, both the 24V and 220V powers belong to external input power. Abnormalities caused by problems other than the non-safe board itself should not cause the safe board to shut down. Therefore, appropriate management strategies need to be set for such power abnormalities.

[0054] The present invention provides a power safety management device for a non-coded signal system, and the non-coded signal system includes: first to third power management modules.

[0055] As Figure 2 shown, the first power management module includes: a plurality of first channels, a first fuse 101, and a plurality of first fuse switches 105. The plurality of first fuse switches 105 respectively correspond to the plurality of first channels. In this embodiment, the first power management module includes two first channels 100a and 100b (the number of first channels is only used as an example and is not a limitation of the present invention).

[0056] The first end of the first fuse 101 is connected to the output end of the first power supply. In the present invention, the first power supply is used to output a 12V analog electrical signal. The first fuse switch 105 is a normally open switch, and it is electrically connected between the second end of the first fuse 101 and the ground.

[0057] The first channel includes: a first DC-DC conversion module 104, an overvoltage monitoring module 102, and an undervoltage monitoring module 103.

[0058] The first DC-DC conversion module 104 is electrically connected between the second end of the first fuse 101 and the corresponding logic operation unit, and is used to convert the electrical signal of the first power supply into a first digital electrical signal for supplying power to the corresponding logic operation unit. In the present invention, the first digital electrical signal includes digital electrical signals of 1V, 1.2V, and 3.3V. The voltage fluctuation ranges corresponding to the digital electrical signals of 1V, 1.2V, and 3.3V are 0.9V to 1.1V, 1.08V to 1.32V, and 3V to 3.6V.

[0059] In this embodiment, the two first DC-DC conversion modules 104 are different types of DC-DC conversion modules. The first channel 100a adopts a FLYBACK (flyback) DC-DC power module, and the first channel 100b adopts a SEPIC (Single Ended Primary Inductor Converter) DC-DC conversion module. By using two different types of DC-DC conversion modules, the corresponding first digital electrical signals are generated independently and differentially.

[0060] As Figure 2 shown, in this embodiment, the first channel includes two logic operation units (the number of logic units is only an example and not a limitation of the present invention). One of the logic operation units is an FPGA or a CPLD, and the other operation unit is an MCU (microprocessor).

[0061] The overvoltage monitoring module 102 is electrically connected to the output end of the first DC-DC conversion module 104 and is signal-connected to the corresponding first fuse switch 101. When the amplitude of the first digital electrical signal exceeds the set upper limit amplitude, the overvoltage monitoring module 102 drives the corresponding first fuse 105 switch to close, and the first power supply is directly grounded to form a short-circuit large current, melting the first fuse 101 to prevent damage to the logic operation unit caused by excessive voltage.

[0062] The undervoltage monitoring module 103 is electrically connected between the output end of the corresponding first DC-DC conversion module 104 and the reset pins of all logic operation units. As Figure 2 shown, each undervoltage monitoring module 103 is signal-connected to the reset pins of 4 logic operation units. When the amplitude of the first digital electrical signal is lower than the set lower limit amplitude, the corresponding undervoltage monitoring module 103 drives all logic operation units to perform synchronous reset. When the first digital electrical signal is lower than the lower limit amplitude, the operation results of the corresponding logic operation units are no longer reliable, resulting in the calculation results of other associated logic operation units (which can be distributed in different first channels) also being unreliable. At this time, the corresponding undervoltage monitoring module 103 can synchronously reset all logic operation units to ensure the credibility of the subsequent calculation results of the logic operation units. It avoids the safety hazards brought by the incorrect output results of the logic operation units.

[0063] As Figure 3 shown, the second power management module includes: a plurality of second channels, a second fuse 201, and a plurality of second fuse switches 205. The plurality of second fuse switches 205 respectively correspond to the plurality of second channels. In this embodiment, the second power management module includes two second channels 200a, 200b (the number of second channels is only an example and not a limitation of the present invention).

[0064] The second channel includes: a second DC-DC conversion module 204, a first ADC sampling circuit 202, and a first microprocessor CPU1.

[0065] The first end of the second fuse 201 is electrically connected to a first power supply (12V analog signal). The second fuse switch 205 is a normally open switch, and is electrically connected between the second end of the second fuse 201 and the ground.

[0066] The input end of the second DC-DC conversion module 204 is connected to the second end of the second fuse 201, and is used to convert the electrical signal output by the first power supply into a first analog electrical signal (5V analog signal). The first analog electrical signal is used to generate a safety signal quantity (participating in the process of collecting the filament current of the signal lamp).

[0067] The first ADC sampling circuit 202 is electrically connected between the output end of the second DC-DC conversion module 204 and the input end of the first microprocessor CPU1, and is used to sample the first analog electrical signal and the 0V electrical signal to obtain a first sampling value and a second sampling value respectively. The first microprocessor CPU1 is also signal-connected to the second fuse switch 105. The first microprocessor CPU1 calculates the difference between the first sampling value and the second sampling value. If the difference does not fall within a set difference range (4.75V to 5.25V), the first microprocessor CPU1 first sends a default safety-side signal quantity to the host computer, and then drives the corresponding second fuse switch 205 to close. The first power supply is directly grounded to form a short-circuit large current, and the second fuse 201 is blown. The disconnection of the second fuse also directly cuts off the anode of the coil power supply of the isolation relay, and the output is cut off. The present invention effectively guarantees the acquisition security.

[0068] In this embodiment, the two second DC-DC conversion modules 204 are different types of DC-DC conversion modules. The second power management module is of a "two-out-of-two" structure. Only when the first analog electrical signals of the two second channels are both normal (fall within the range of 4.75V to 5.25V) can the first analog electrical signals of the two second channels be used to generate a safety signal quantity. If the first analog electrical signal of any one of the second channels is abnormal, the second fuse 201 is blown, and the first analog electrical signals of the two second channels cannot be output. The safety board needs to be manually maintained.

[0069] As Figure 4 shown, the third power management module includes an isolation module 301, an output module 302, an opto-isolated voltage sampling circuit 303, and a second ADC sampling circuit 304.

[0070] The isolation module 301 includes a plurality of isolation relays and a plurality of second microprocessors (corresponding to the plurality of isolation relays respectively). The output module 302 includes: a plurality of output relays and a plurality of third microprocessors (corresponding to the plurality of output relays respectively). In this embodiment, as Figure 4 shown, the third power management module includes two isolation relays K1, K2 and two second microprocessors CPU2_A, CPU2_B. The output module includes two output relays K3, K4 and two third microprocessors CPU3_A, CPU3_B. Figure 4 The number of isolation relays and output relays in [the above description] is only an example and does not limit the present invention.

[0071] The isolation relay K1 includes a first normally open contact a1 and a second normally open contact a2. The isolation relay K2 includes a first normally open contact b1 and a second normally open contact b2. The output relay K3 includes a normally open contact c1, and the output relay K4 includes a normally open contact d1. The first normally open contacts a1, b1 are connected in series between the second power supply (24V) and the positive poles of the coils of the output relays K3, K4. The second normally open contacts a2, b2 and the normally open contacts c1, d1 are connected in series between the output terminal of the third power supply (220V) and the external safety device. The first power supply (12V) is electrically connected to the positive poles of the coils of the isolation relays K1, K2, and the second microprocessors CPU2_A, CPU2_B control the negative poles of the coils of the isolation relays K1, K2 to be grounded through the corresponding K1 control circuit and K2 control circuit. The third microprocessors CPU3_A, CPU3_B control the negative poles of the coils of the output relays K3, K4 to be grounded through the K3 control circuit and K4 control circuit.

[0072] The opto-isolated voltage sampling circuit 303 is used to sample the output voltage of the second power supply. When the output voltage of the second power supply falls within the corresponding voltage fluctuation range (21.6V - 26.4V), the opto-isolated voltage sampling circuit 303 outputs a low-level feedback signal; otherwise, the opto-isolated voltage sampling circuit 303 outputs a high-level feedback signal. When the second microprocessor determines that the duration of the low-level feedback signal continuously output by the opto-isolated voltage sampling circuit 303 exceeds the corresponding preset normal duration threshold (e.g., 30s), the second microprocessor drives the negative pole of the corresponding isolation relay coil to be grounded. When the second microprocessor determines that the duration of the high-level feedback signal continuously output by the opto-isolated voltage sampling circuit 303 exceeds the corresponding preset abnormal duration threshold, the second microprocessor drives the negative pole of the corresponding isolation relay coil not to be grounded, the isolation relay coil is de-energized, the corresponding first normally open contact and second normally open contact are disconnected, and the external safety device is de-energized. When the second microprocessor determines that the duration of the high-level feedback signal continuously output by the opto-isolated voltage sampling circuit 303 does not exceed the preset normal duration threshold, it is still considered that the voltage of the second power supply is normal, and the corresponding isolation relay coil remains energized.

[0073] The second ADC sampling circuit 304 is used to sample the output voltage of the third power supply (220V). When the output voltage of the third power supply falls within the corresponding voltage fluctuation range (198V - 242V), the second ADC sampling circuit 304 outputs a feedback signal with a low level; otherwise, the second ADC sampling circuit 304 outputs a feedback signal with a high level. When the third microprocessor determines that the duration of the second ADC sampling circuit 304 continuously outputting a low-level feedback signal exceeds the corresponding normal duration threshold, the third microprocessor drives the negative electrode of the corresponding output relay coil to be grounded. When the third microprocessor determines that the duration of the second ADC sampling circuit 304 continuously outputting a high-level feedback signal exceeds the corresponding abnormal duration threshold, the third microprocessor drives the negative electrode of the corresponding output relay coil not to be grounded, the output relay coil is de-energized, the corresponding normally open contact is disconnected, and the external safety device is de-energized. When the third microprocessor determines that the duration of the second ADC sampling circuit 304 continuously outputting a high-level feedback signal does not exceed the corresponding abnormal duration threshold, it is still considered that the voltage of the third power supply is normal, and the corresponding output relay coil remains energized.

[0074] In this embodiment, if the output relays K3 and K4 can be effectively energized, it is necessary to satisfy that the two isolation relays K1 and K2 are energized and pulled up, and at the same time, the second microprocessors CPU2_A and CPU2_B give permission signals at the same time. 220V is connected in series with the second normally open contacts a2 and b2 of the two relays K1 and K2 of the isolation module, and at the same time, it is also connected in series with the normally open contacts c1 and d1 of the output relays K3 and K4. That is to say, it is necessary to satisfy that 4 relays are energized at the same time to finally output 220V voltage to the external safety device.

[0075] The present invention also provides a power supply safety management method for a non-coded signal system, which is implemented by the power supply safety management device of the non-coded signal system as described in the present invention, as Figure 5 shown, including the steps:

[0076] S1. The overvoltage monitoring module and undervoltage monitoring module of the first channel perform overvoltage monitoring and undervoltage monitoring on the first digital quantity electrical signal; if the amplitude of the first digital quantity electrical signal exceeds the set upper limit amplitude, the overvoltage monitoring module drives the corresponding first fuse switch to close, the first fuse melts, and all logic operation units lose power; if the first digital quantity electrical signal is lower than the set lower limit amplitude, the undervoltage monitoring module drives all logic operation units to perform synchronous reset.

[0077] As Figure 6 shown in the working process schematic diagram of the first power management module (with two first channels) in this embodiment.

[0078] S2. The first ADC sampling circuit of the second channel samples the first analog electrical signal and the 0V electrical signal, respectively obtaining a first sampling value and a second sampling value; the first microprocessor calculates the difference between the first sampling value and the second sampling value. If the difference does not fall within the set difference range, the first microprocessor drives the corresponding second fuse switch to close and the second fuse blows; if all the multiple second channels determine that the corresponding first analog electrical signal is normal, the first analog electrical signal is output.

[0079] As Figure 7 shows the schematic diagram of the working process of the second power management module (with two second channels) in this embodiment.

[0080] S3. The opto - isolator voltage sampling circuit periodically samples the voltage of the second power supply and outputs a corresponding feedback signal, and the second ADC sampling circuit periodically samples the voltage of the third power supply and outputs a corresponding feedback signal; the second microprocessor determines whether the feedback signal of the second power supply is normal. If it is normal, the normal monitoring result timing starts; the third microprocessor determines whether the feedback signal of the third power supply is normal. If it is normal, the normal monitoring result timing starts; if the normal monitoring result timing durations of the second microprocessor and the third microprocessor reach the preset normal duration threshold, the coils of the corresponding isolation relay and output relay are energized; if the coils of all the isolation relays and output relays are energized, the third power supply supplies power to the external safety device.

[0081] If the second microprocessor and the third microprocessor determine that the corresponding feedback signal is abnormal, the second microprocessor and the third microprocessor start the abnormal monitoring result timing; if the abnormal monitoring result timing durations of the second microprocessor and the third microprocessor reach the preset abnormal duration threshold, the coils of the corresponding isolation relay and output relay lose power, and the third power supply does not supply power to the external safety device. If the abnormal monitoring result timing durations of the second microprocessor and the third microprocessor do not reach the preset abnormal duration threshold, it is considered that the monitoring results of 24V and 220V are still normal, and the coils of the corresponding isolation relay and output relay remain energized.

[0082] Figure 8 , Figure 9 shows the schematic diagram of the working process of the third power management module in this embodiment. In this embodiment, the third power management module can be regarded as including channel A and channel B. Channel A includes isolation relay K1, second microprocessor CPU2_A, output relay K3, and third microprocessor CPU3_A. Channel B includes isolation relay K2, second microprocessor CPU2_B, output relay K4, and third microprocessor CPU3_B. In this embodiment, according to Figure 8, the dual channels (Channel A and Channel B) need to make a consistency judgment on the "OK (normal)" or "NOK (abnormal)" state of 24V / 220V. Only when the judgment results of both channels are "OK", at this time, the third power management module will consider the 24V / 220V voltage as "OK". If the judgment result of any one of Channel A or Channel B for the 24V / 220V voltage is "NOK", then the third power management module considers the 24V / 220V voltage state as "NOK".

[0083] When the third power management module considers the 24V / 220V voltage state as "NOK", the system will enter a reversible degradation mode. At this time, the isolation relays K1 and K2 will be powered off through the Figure 4 K1 control circuit and K2 control circuit in it, so as to cut off the output. At the same time, the third power management module keeps periodically performing a health check on the isolation module.

[0084] When the third power management module considers the 24V / 220V voltage state as "OK", it will exit the degradation mode and start the system self-check process. If the self-check passes, the third power management module enters the normal working mode and supplies power to external safety devices.

[0085] It should be understood that the magnitudes of the sequence numbers of the steps in the above embodiments do not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.

[0086] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A power supply safety management device for a non-coding signal system, characterized in that, The non-coding signal system includes: first to third power management modules; The first power management module includes a plurality of first channels; the first channels convert the electrical signals of the first power supply into first digital quantity electrical signals for supplying power to corresponding logic operation units; if a first channel determines that the amplitude of the corresponding first digital quantity electrical signal is higher than a set upper limit amplitude, the electrical connection between the first power supply and the first power management module is disconnected through this first channel; if a first channel determines that the amplitude of the corresponding first digital quantity electrical signal is lower than a set lower limit amplitude, all logic operation units are driven to perform synchronous reset through this first channel; The second power management module includes a plurality of second channels; the second channels convert the electrical signals output by the first power supply into first analog quantity electrical signals, and the first analog quantity electrical signals are used to generate safety signal quantities; If a second channel determines that the voltage of the corresponding first analog quantity electrical signal does not fall within the corresponding voltage fluctuation range, the electrical connection between the first power supply and the second power management module is disconnected; The third power management module includes a plurality of output relays and a plurality of isolation relays, and the plurality of output relays are used to control the third power supply to supply power to external safety devices; The plurality of isolation relays are used to control the second power supply to supply power to the coils of the plurality of output relays; The third power management module periodically detects the voltages of the second power supply and the third power supply. When the durations for which the voltages of the second power supply and the third power supply fall within the corresponding voltage fluctuation ranges are both greater than the corresponding preset normal duration threshold or less than the corresponding preset abnormal duration threshold, the third power supply supplies power to external safety devices.

2. The power supply safety management device of the non-coding signal system according to claim 1, characterized in that, The first power management module further includes: a first fuse and a plurality of first fuse switches; the plurality of first fuse switches respectively correspond to the plurality of first channels; The first end of the first fuse is connected to the output end of the first power supply; the first fuse switch is a normally open switch, and its electrical connection is between the second end of the first fuse and the ground; The first channel includes: a first DC-DC conversion module, an overvoltage monitoring module, and an undervoltage monitoring module; the first DC-DC conversion module is electrically connected between the second end of the first fuse and the corresponding logic operation unit, and is used to convert the electrical signals of the first power supply into first digital quantity electrical signals for supplying power to the corresponding logic operation unit; The overvoltage monitoring module is electrically connected to the output end of the first DC-DC conversion module and is signal-connected to the corresponding first fuse switch; When the amplitude of the first digital quantity electrical signal exceeds the set upper limit amplitude, the overvoltage monitoring module drives the corresponding first fuse switch to close; The undervoltage monitoring module is electrically connected between the output end of the corresponding first DC-DC conversion module and the reset pins of all logic operation units; when the amplitude of the first digital quantity electrical signal is lower than the set lower limit amplitude, the corresponding undervoltage monitoring module drives all logic operation units to perform synchronous reset.

3. The power supply safety management device of the non-coding signal system according to claim 1, characterized in that, The first power management module includes two first channels; the first DC-DC conversion modules of the two first channels are different types of DC-DC conversion modules.

4. The power supply safety management device of the non-coding signal system according to claim 1, characterized in that, The second power management module further includes: a second fuse and a plurality of second fuse switches; the plurality of second fuse switches respectively correspond to the plurality of second channels; The first end of the second fuse is electrically connected to the output end of the first power supply. The second fuse switch is a normally open switch, and it is electrically connected between the second end of the second fuse and the ground. The second channel includes: a second DC-DC conversion module, a first ADC sampling circuit, and a first microprocessor. The input end of the second DC-DC conversion module is connected to the second end of the second fuse, and is used to convert the electrical signal output by the first power supply into the first analog electrical signal. The first ADC sampling circuit is electrically connected between the output end of the second DC-DC conversion module and the input end of the first microprocessor, and is used to sample the first analog electrical signal and the 0V electrical signal to obtain a first sampling value and a second sampling value respectively. The first microprocessor is also signal-connected to the second fuse switch. The first microprocessor calculates the difference between the first sampling value and the second sampling value. If the difference does not fall within the set difference range, the first microprocessor drives the corresponding second fuse switch to close.

5. The power supply safety management device of the non-coding signal system according to claim 4, characterized in that The second power management module includes two second channels. The second DC-DC conversion modules of the two second channels are different types of DC-DC conversion modules.

6. The power supply safety management device of the non-coding signal system according to claim 1, characterized in that, The third power management module further includes: a plurality of second microprocessors and a plurality of third microprocessors. The plurality of second microprocessors respectively correspond to a plurality of isolation relays. The plurality of third microprocessors respectively correspond to a plurality of output relays. The output end of the first power supply is electrically connected to the positive pole of the isolation relay coil, and the negative pole of the isolation relay coil is grounded through the corresponding second microprocessor. The isolation relay includes a first normally open contact and a second normally open contact. The first normally open contacts of the plurality of isolation relays are connected in series between the second power supply and the positive pole of the output relay coil. The negative pole of the output relay coil is grounded through the corresponding third microprocessor. The second normally open contacts of the plurality of isolation relays and the normally open contacts of the plurality of output relays are connected in series between the output end of the third power supply and the external safety device.

7. The power supply safety management device of the non-coding signal system according to claim 6, characterized in that, The third power management module further includes: an opto-isolated voltage sampling circuit and a second ADC sampling circuit. The opto-isolated voltage sampling circuit is used to sample the output voltage of the second power supply. When the output voltage of the second power supply falls within the corresponding voltage fluctuation range, the opto-isolated voltage sampling circuit outputs a low-level feedback signal, otherwise the opto-isolated voltage sampling circuit outputs a high-level feedback signal. When the duration of the opto-isolated voltage sampling circuit continuously outputting a low-level feedback signal exceeds the preset time threshold, the negative pole of the corresponding isolation relay coil is grounded through the second microprocessor. The second ADC sampling circuit is used to sample the output voltage of the third power supply. When the output voltage of the third power supply falls within the corresponding voltage fluctuation range, the second ADC sampling circuit outputs a low-level feedback signal, otherwise the second ADC sampling circuit outputs a high-level feedback signal. When the duration of the second ADC sampling circuit continuously outputting a low-level feedback signal exceeds the time threshold, the negative pole of the output relay coil is grounded through the third microprocessor.

8. The power supply safety management device of the non-coding signal system according to claim 1, characterized in that, The first power supply is used to output an analog electrical signal of 12V; the operating voltages of the logic operation unit include 1V, 1.2V, and 3.3V, and the corresponding voltage fluctuation ranges of the operating voltages of 1V, 1.2V, and 3.3V are 0.9V to 1.1V, 1.08V to 1.32V, and 3V to 3.6V respectively; the voltage of the analog electrical signal is 5V, and the corresponding voltage fluctuation range is 4.75V to 5.25V; the output voltage of the second power supply is 24V, and the corresponding voltage fluctuation range is 21.6V to 26.4V; the output voltage of the third power supply is 220V, and the corresponding voltage fluctuation range is 198V to 242V.

9. A power supply safety management method for a non-coded signal system, which is implemented by the power supply safety management device of the non-coded signal system according to any one of claims 1 to 8, characterized in that, Including the steps: S1. The overvoltage monitoring module and undervoltage monitoring module of the first channel perform overvoltage monitoring and undervoltage monitoring on the first digital electrical signal; if the amplitude of the first digital electrical signal exceeds the set upper limit amplitude, the overvoltage monitoring module drives the corresponding first fuse switch to close, the first fuse melts, and all logic operation units lose power; If the first digital electrical signal is lower than the set lower limit amplitude, the undervoltage monitoring module drives all logic operation units to perform synchronous reset; S2. The first ADC sampling circuit of the second channel samples the first analog electrical signal and the 0V electrical signal to obtain a first sampling value and a second sampling value respectively; the first microprocessor calculates the difference between the first sampling value and the second sampling value, and if the difference does not fall within the set difference range, the first microprocessor drives the corresponding second fuse switch to close, and the second fuse melts; If all the second channels judge that the corresponding first analog electrical signal is normal, the first analog electrical signal is output; S3. The optocoupler isolation voltage sampling circuit periodically collects the voltage of the second power supply and outputs a corresponding feedback signal, and the second ADC sampling circuit periodically collects the voltage of the third power supply and outputs a corresponding feedback signal; the second microprocessor judges whether the feedback signal of the second power supply is normal, and if it is normal, starts timing for the normal monitoring result; the third microprocessor judges whether the feedback signal of the third power supply is normal, and if it is normal, starts timing for the normal monitoring result; If the timing duration of the normal monitoring results of the second microprocessor and the third microprocessor reaches the preset normal duration threshold, the coils of the corresponding isolation relay and output relay are energized; if the coils of all isolation relays and output relays are energized, the third power supply supplies power to the external safety device.

10. The power supply safety management method of the non-coding signal system according to claim 9, characterized in that, In step S3, if the second microprocessor and the third microprocessor judge that the corresponding feedback signal is abnormal, the second microprocessor and the third microprocessor start timing for the abnormal monitoring result; if the timing duration of the abnormal monitoring results of the second microprocessor and the third microprocessor reaches the preset abnormal duration threshold, the coils of the corresponding isolation relay and output relay lose power, and the third power supply does not supply power to the external safety device.

Images