A method and device for diagnosing IO of a measurement and control equipment

Abstract

The application relates to a high-safety-integrity monitoring and control device IO diagnosis method and device. The monitoring and control device is composed of two redundant monitoring and control units, a logic control part of the monitoring and control unit carries out logic processing and output control, and the output part outputs a control signal during diagnosis. When both controllers receive the output feedback signal, the diagnosis IO output is normal, otherwise, the diagnosis IO output is output error. The application solves the safety action problem of the controller IO output, improves the reliability of the monitoring and control device output through the redundant output of the two-way side empty unit, and improves the safety of the monitoring and control device output through the pulse diagnosis mode. The application can meet the high-safety-integrity requirement of the monitoring and control device IO output, and has great application and promotion space.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of industrial control instruments, and particularly provides an IO diagnosis method and device for a high-safety-integrity measurement and control equipment. BACKGROUND

[0002] A functional safety system, also called a safety instrument system (SIS) or an emergency shutdown system (ESD), is a system with functional safety. The safety instrument system is composed of high-safety-integrity measurement and control equipment, including sensors, controllers and actuators, and is mainly used in industrial production to protect operators and production equipment and avoid accidents that seriously endanger the safety of human life. Functional safety is a manifestation of whether the safety instrument system can effectively perform its safety functions and is the last safeguard before a dangerous accident occurs, so the safety integrity level (SIL) of the safety instrument system is required to be higher.

[0003] Hardware random failure is a time-random and consequence-fixed failure. Regardless of the cause of the failure, the final result is always an output error or a behavior error. If a redundant structure is used, the calculation results of multiple components running in parallel can be compared to determine whether an error or failure has occurred. Conventional systems often use a single-channel structure, i.e., a linear 1oo1 (1 out of 1) structure without redundancy, but this structure cannot guarantee reliability or safety.

[0004] From the development technology of functional safety products, redundancy and fault tolerance are the common methods for safety design internationally. Through multiple design of the system, such as multiple controllers, multiple IOs and multiple power supplies, the availability of the system under failure conditions is ensured. By adding voting, diagnosis and other technical measures in the system, the safe operation of the system under failure conditions is checked. Common redundant structures include dual-channel redundancy 1oo2 and triple-channel redundancy 2oo3, and redundancy of more than four is rarely seen, mainly due to cost and efficiency problems. Redundant structures are applied in two ways, one for reliability and one for safety. Reliability applications are mainly to ensure the reliability of the system, such as dual-machine hot standby or cold standby, but do not require a voting structure and do not need to consider the correctness of the calculation result. The focus of reliability applications is on the ability to provide continuous service, and the correctness of the result is not strictly required. The focus of safety applications is on the correctness of the result, such as a safety function of an application that outputs a high level, which must output a high level and cannot output a low level. Safety applications are similar to "calculation", in which multiple channels work simultaneously and the results are compared. If they are the same or the results are acceptable (such as 2oo3 in which two results are consistent), the result is considered correct, otherwise a safety output is required. It can be seen that the biggest difference between the two is that reliability applications generally do not have a voting mechanism, while safety applications generally include a voting mechanism.

[0005] Another effective means to improve the safety integrity capability of the measuring and controlling equipment during diagnosis is that, for safety-related applications composed of electronic / electric / programmable elements, diagnosis is mainly for early detection and treatment of random failure to avoid dangerous failure. Especially for the control part of the actuator being inductive elements, such as relays, due to the smoothing of high-frequency pulses by inductance, the high-frequency pulses do not affect the normal work, and after the output pulse, the output state can be judged by feeding back the high-frequency pulse, thereby completing the diagnosis of the output.

[0006] In the current existing system design process, the safety integrity capability of the system is improved by higher-order redundancy, which is relatively high in cost. Therefore, considering the cost, the present application patent integrates redundancy and diagnosis technology, adds diagnosis measures on the basis of redundancy to improve the diagnosis capability of the system, so as to make up for the defects caused by insufficient number of redundancies, and through the addition of diagnosis measures to the 1oo2 system, the same safety integrity capability as 2oo3 is achieved. SUMMARY

[0007] In view of the above deficiencies in the prior art, the technical problem to be solved by the present application is to provide a high-safety-integrity measuring and controlling equipment IO diagnosis method and device, mainly used for measuring and controlling device IO output diagnosis function. The design improves the reliability of the measuring and controlling device output according to the high-safety-integrity technology of the measuring and controlling equipment, and improves the safety of the measuring and controlling device output through pulse diagnosis. The present application can effectively diagnose the IO output function of the measuring and controlling equipment by adding IO output diagnosis pulses in the 1oo2 system, has the characteristics of simple structure and high safety performance, and has wide application and popularization value.

[0008] The technical scheme adopted by the present application to achieve the above-mentioned purpose is: a high-safety-integrity measuring and controlling equipment IO diagnosis device, comprising two measuring and controlling units;

[0009] The measuring and controlling unit comprises:

[0010] The processor is used for generating an output pulse control command to the output module, receiving a feedback pulse signal obtained through the output module, and performing pulse diagnosis.

[0011] The output module is used for receiving the feedback pulse signal of the switch and feeding back to the processor, and sending the pulse control command of the processor to the switch.

[0012] The two processors are redundant to each other and regularly exchange data and synchronize clocks.

[0013] A high-safety-integrity measuring and controlling equipment IO diagnosis device is used for diagnosing a switch circuit, the switch circuit comprising a first switch and a second switch connected in series, one end of the switch circuit being connected with a power supply and the other end being used for connecting an actuator.

[0014] The first switch and the second switch are MOS tubes;

[0015] The gate of the first MOS tube is connected with the output module of the first control unit to receive a pulse, the drain is connected with an input power supply, and the source is connected with the drain of the second MOS tube;

[0016] The gate of the second MOS tube is connected with the output module of the second control unit to receive a pulse, the source is connected with the actuator, and the feedback switch state is fed back to the output module of the first control unit and the output module of the second control unit.

[0017] In the diagnosis state, the regularly sent pulse has a period not less than 500 ms and a pulse width not greater than 250 ns.

[0018] When the processor performs pulse diagnosis, the feedback pulse signal of the current corresponding switch is judged, a high level is output to indicate that the switch is off, and a low level is output to indicate that the switch is on.

[0019] When the feedback pulse signal indicates that the running output state of the switch is on, the diagnosis output pulse is a high level.

[0020] When the feedback pulse signal indicates that the running output state of the switch is off, the diagnosis output pulse is a low level.

[0021] The pulse diagnosis specifically includes the following steps:

[0022] The first processor and the second processor respectively send pulse signals to the respective output modules to control the conduction of the corresponding switches, and the feedback pulse signals of the first switch and the second switch are respectively sent to the first processor and the second processor, the first processor and the second processor respectively judge whether the sent pulse signals and the feedback pulse signals are consistent; if not, the first switch and the second switch are disconnected, and an alarm signal is sent.

[0023] The pulse diagnosis includes the following steps:

[0024] The first processor and the second processor perform time synchronization;

[0025] After the diagnosis period starts, a timer is started, and the first processor and the second processor simultaneously send pulse control commands to make the first switch and the second switch act simultaneously.

[0026] The first processor and the second processor simultaneously receive feedback pulse signals.

[0027] The first processor and the second processor judge whether the feedback pulse signals are received through data interaction.

[0028] When the first processor and the second processor both receive the feedback pulse signal, the diagnosis result is that the output works normally;

[0029] When the first processor and the second processor both do not receive the feedback pulse signal, the diagnosis result is that the output works in failure;

[0030] When only the first processor or the second processor receives the feedback pulse signal, the diagnosis result is that the diagnosis circuit works in failure;

[0031] When the timer time is up, the next diagnosis is performed.

[0032] The present application is used to realize a high safety integrity measurement and control equipment IO diagnosis method and device.

[0033] 1. The realization method is simple and easy to operate, and the method is based on the redundant measurement and control equipment design architecture,

[0034] The function diagnosis is performed by increasing the pulse output, the method is simple, and the above function can be realized only by simple circuit cooperation, the method is simple to realize and has strong operability.

[0035] 2. The hardware circuit design is convenient. The present application applies the hardware circuit to cooperate with the software to realize the output diagnosis,

[0036] only needs to increase the feedback circuit on the basis of the original hardware, the hardware circuit design is convenient, and the problem of applying the complex circuit to realize the high diagnosis coverage is solved.

[0037] 3. The universality is strong. With the increasing demand of the measurement and control equipment safety performance in the industry, on the basis of the original equipment,

[0038] application of the above method realizes the high safety integrity of the output diagnosis to a large extent, does not need to change the hardware system platform greatly, is especially suitable for realizing the diagnosis of the relay type output element through the high frequency pulse, has strong universal performance and is easy to realize. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is the structural diagram of the present application;

[0040] Figure 2 is the algorithm flow chart of the controller end of the present application. DETAILED DESCRIPTION

[0041] The present application will be further described in detail below in combination with the drawings and the embodiment.

[0042] The present invention relates to a method and device for IO diagnosis of high-safety integrity measurement and control equipment. The measurement and control device is composed of two redundant measurement and control units. The logic control part of the measurement and control unit performs logic processing and output control. During the diagnosis process, the output part outputs a control signal. When both controllers receive the output feedback signal, the IO output is diagnosed as normal. Otherwise, it is diagnosed as an IO output error. The present invention solves the problem of safe action of the controller IO output. The reliability of the measurement and control device output is improved through the redundant output of the two-way side air unit. The safety of the measurement and control device output is improved through pulse diagnosis. The present invention can meet the high safety integrity requirements of the measurement and control equipment IO output and has a large application and promotion space.

[0043] Figure 1 This is a structural diagram of the present invention. The measurement and control device consists of two measurement and control units, which are connected in a redundant structure. Each unit controls one output, and the two outputs are connected in series to jointly control the supply and disconnection of power. Each measurement and control unit consists of three parts: input, processor, and output. The input part collects sensor data, converts analog values ​​into digital signals through A / D, and transmits the output to the processor. The processor controls the output through logical operations. The output unit mainly realizes output according to the instructions of the logic control part, and opens and closes the switch by issuing control signals.

[0044] The input module is used to receive sensor signals and convert them into digital signals and send them to the processor, such as temperature sensors (thermal resistors, thermocouples, etc.) or pressure sensors. The processor is used to receive the input signals of the sensors, perform logical processing, send pulses to the switches, and perform pulse diagnosis to generate output pulse control commands to the output module. It can be a general-purpose ARM structure processor. The output module is used to receive feedback pulse signals from the switches. Redundant switches can be MOS tubes or other electronic devices with switching properties.

[0045] like Figure 1 As shown, the redundant switch is partially connected as follows. Taking MOS as a switch as an example, the gate of the first MOS tube is connected to the output module of the first measurement and control unit to receive pulses, the drain is connected to the input power supply, and the source is connected to the drain of the second MOS tube; the gate of the second MOS tube is connected to the output module of the second measurement and control unit to receive pulses, the source is connected to the actuator, and feedback of the switch status is provided.

[0046] In order to guarantee the safety of the output, the state when both switches are opened is defined as the safe state. The logic control unit controls the two switches to execute the output function. When both switches are turned on, the power supply to the actuator is realized. When any one of the two switches fails to turn on, the power supply to the actuator cannot be executed. When both switches fail to turn on, the power supply cannot be executed, but no dangerous failure occurs. When the logic control unit controls the two switches to turn off, the power supply to the actuator is realized. When any one of the two switches fails to turn off, the power supply to the actuator still cannot be executed. When both switches fail to turn off, a dangerous failure occurs. The above-mentioned method of redundancy can improve the safety of the output, but cannot solve the dangerous failure that both switches fail to turn off.

[0047] In view of the requirement of avoiding dangerous failure, the pulse diagnosis method is used. The redundant logic unit regularly sends a pulse signal to the output part, the output part controls the turn-on of the switch, and the output state monitoring signal is fed back to the processor. The processor judges whether the sent control signal and the feedback signal are consistent. If not, all the switches are opened, and an alarm signal is sent. When the processor performs pulse diagnosis, the current running state is judged. When the current running output state is opened, the diagnosis output pulse is high. When the current running output state is turned off, the diagnosis output pulse is low.

[0048] Figure 2 The flowchart of the diagnosis is shown in the figure. After the measurement and control equipment is normally operated, the redundant processors perform time synchronization through data exchange. When the diagnosis cycle starts, the redundant processors start the timers respectively, judge the current switch output state, and the controller sends a pulse control signal. When the current running output state is opened, the diagnosis output pulse is high. When the current running output state is turned off, the diagnosis output pulse is low. The measurement and control equipment logic unit controls the two switches to act simultaneously. The two processors receive the feedback pulse signals simultaneously. Through data exchange, whether the pulse feedback signals are received is judged. When the two processors receive the feedback pulse signals, the diagnosis result is that the output works normally. When the two processors fail to receive the feedback pulse signals, the diagnosis result is that the output works abnormally. When only one of the two processors receives the feedback pulse signals, the diagnosis result is that the diagnosis circuit of the road works abnormally. When the timer time is up, the next diagnosis is performed.

Claims

1. A TT&C equipment IO diagnosis device, characterized in that, The two monitoring and control units are connected in series; The monitoring and control unit comprises: a processor for generating an output pulse control command to an output module, receiving a feedback pulse signal obtained through the output module, and performing pulse diagnosis; The pulse diagnosis is configured to perform: The first processor and the second processor are time-synchronized; After the start of the diagnosis cycle, a timer is started, and the first processor and the second processor simultaneously issue a pulse control command to make the first switch and the second switch act simultaneously; The first processor and the second processor simultaneously receive the feedback pulse signal; The first processor and the second processor judge whether they have both received the feedback pulse signal through data interaction; When the first processor and the second processor have both received the feedback pulse signal, the diagnosis result is that the output is working normally; When the first processor and the second processor have not both received the feedback pulse signal, the diagnosis result is that the output is faulty; When only the first processor or the second processor has received the feedback pulse signal, the diagnosis result is that the diagnosis circuit of the path is faulty; The timer time is judged, and the next diagnosis is performed; The output module is used for receiving the feedback pulse signal of the switch and feeding back the pulse control command of the processor to the switch.

2. The device IO diagnosis apparatus according to claim 1, wherein The two processors are redundant to each other and regularly exchange data and synchronize clocks.

3. The device IO diagnosis apparatus according to claim 1, wherein The first switch and the second switch are connected in series, one end of the switch circuit is connected with a power supply, and the other end is used for connecting an actuator.

4. The device IO diagnosis apparatus according to claim 3, wherein The first switch and the second switch are both MOS tubes; The gate of the first MOS tube is connected with the output module of the first monitoring and control unit to receive a pulse, the drain is connected with an input power supply, and the source is connected with the drain of the second MOS tube; The gate of the second MOS tube is connected with the output module of the second monitoring and control unit to receive a pulse, and the source is connected with the actuator and feeds back the switch state to the output module of the first monitoring and control unit and the output module of the second monitoring and control unit.

5. The device IO diagnosis apparatus according to claim 1, wherein In the diagnosis state, the regularly sent pulse has a period not less than 500 ms and a pulse width not greater than 250 ns.

6. The diagnosis method of the diagnosis device of the TT&C equipment IO according to claim 1, characterized in that, When the processor performs pulse diagnosis, the feedback pulse signal of the current corresponding switch is judged, a high level is output to represent that the switch is off, and a low level is output to represent that the switch is on; When the feedback pulse signal represents that the switch running output state is on, the diagnosis output pulse is a high level; When the feedback pulse signal represents that the switch running output state is off, the diagnosis output pulse is a low level; The pulse diagnosis comprises the following steps: The first processor and the second processor are time-synchronized; After the start of the diagnosis cycle, a timer is started, and the first processor and the second processor simultaneously issue a pulse control command to make the first switch and the second switch act simultaneously; The first processor and the second processor simultaneously receive the feedback pulse signal; The first processor and the second processor judge whether they have both received the feedback pulse signal through data interaction; When the first processor and the second processor have both received the feedback pulse signal, the diagnosis result is that the output is working normally; When the first processor and the second processor have not both received the feedback pulse signal, the diagnosis result is that the output is faulty; When only the first processor or the second processor has received the feedback pulse signal, the diagnosis result is that the diagnosis circuit of the path is faulty; The timer time is up, and the next diagnosis is performed.

7. The diagnosis method of the diagnosis apparatus of a TT&C equipment IO according to claim 6, characterized in that, The pulse diagnosis is as follows: The first processor and the second processor respectively send pulse signals to the output modules at regular intervals to control the conduction of the corresponding switches, and the feedback pulse signals of the first switch and the second switch are respectively sent to the first processor and the second processor, and the first processor and the second processor respectively judge whether the sent pulse signals and the feedback pulse signals are consistent. If not, the first switch and the second switch are disconnected, and an alarm signal is sent out.

Images