Safe turn-off control circuit and control method thereof

Abstract

The invention belongs to the technical field of automobile electric control systems, and particularly relates to a safe turn-off control circuit and a control method thereof, which comprise a resistor R1, a resistor R2, a resistor R3, a resistor R4, a resistor R5, a resistor R6, a resistor R7, a triode T1, a triode T2, a connection relation of the triode T1 and the triode T2, and a safe turn-off control method based on the circuit. According to the invention, a control path is provided between the system state monitoring unit and the function driving output unit; effective state feedback is provided to the system function control unit, and after the system function control unit still can operate or resumes operation from an abnormal state, a safe turn-off control state can be obtained. The input voltage and current requirements of different function driving output units are met, particularly, multi-path driving output control is provided at the same time, it is guaranteed that control signals are relatively independent, and input faults of any path of function driving output unit cannot cause input anomalies of other function driving output units.

Description

Technical Field

[0001] The present invention relates to the technical field of automobile electronic control systems, and in particular to a safety shutdown control circuit and a control method thereof, which are applied to an ECU (Electronic Control Unit) electronic controller having specified requirements for functional safety. Background Art

[0002] In the automotive electronic control system, according to the system failure safety state requirements, when the electronic control unit ECU identifies a functional abnormality, it is necessary to ensure that the output function of the electronic control unit enters the expected controllable safety state. To this end, the electronic control unit with safety function requirements generally contains at least three parts: system function control unit, system status monitoring unit and function drive output unit.

[0003] During normal operation, the system function control unit sends control instructions to the function drive output unit to implement the system function; when the internal and external status of the system is abnormal, the system status monitoring unit detects the abnormality and outputs a shutdown control instruction to the function drive output unit to shut down the output, thereby putting the system into a controllable safe state.

[0004] Therefore, the current selection of matching system status monitoring unit chips, system function control unit chips and function drive output units to build safety shutdown control has poor flexibility; in addition, the system status monitoring unit has limited output shutdown control signal driving capabilities, making it difficult to meet multi-channel drive output control requirements. Summary of the invention

[0005] The purpose of the present invention is to solve the technical problems existing in the background technology. To this end, a safety shutdown control circuit and a control method thereof are provided.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] A safety shutdown control circuit comprises a resistor R1, a resistor R2, a resistor R6, a resistor R7 and a transistor T2;

[0008] One end of the resistor R1 is connected to the output end of the system function control unit, and the other end of the resistor R1 is connected to the input end of the function drive output unit;

[0009] One end of the resistor R2 is connected to the output end of the system status monitoring unit, and the other end of the resistor R2 is connected to the input end of the system function control unit;

[0010] One end of the resistor R6 is directly or indirectly connected to the output end of the system status monitoring unit, and the other end of the resistor R6 is connected to the base of the transistor T2;

[0011] One end of the resistor R7 is connected to the base of the transistor T2, and the other end of the resistor R7 is connected to the power supply GND;

[0012] The collector of the transistor T2 is connected to the function drive output unit; the emitter of the transistor T2 is connected to the power supply GND.

[0013] The following is a technical solution further defined by the circuit in the present invention, when the resistor R6 is indirectly connected to the output end of the system state monitoring unit, a resistor R3, a resistor R4 and a transistor T1 are arranged between the resistor R6 and the output end of the system state monitoring unit;

[0014] One end of the resistor R3 is connected to the signal logic power supply VCC, and the other end of the resistor R3 is connected to the output end of the system status monitoring unit;

[0015] One end of the resistor R4 is connected to the base of the transistor T1, and the other end of the resistor R4 is connected to the output end of the system status monitoring unit;

[0016] The emitter of the transistor T1 is connected to the signal logic power supply VCC, and the collector of the transistor T1 is connected to one end of the resistor R6.

[0017] The following is a technical solution further limited by the circuit in the present invention, which also includes a resistor R5, one end of which is connected to the base of the transistor T1, and the other end of which is connected to the signal logic power supply VCC.

[0018] The following is a technical solution further defined by the circuit in the present invention. When a direct connection is made between the resistor R6 and the output end of the system status monitoring unit, the output end of the system status monitoring unit is connected to one end of the resistor R3, and the other end of the resistor R3 is connected to the power supply GND.

[0019] The following is a technical solution further defined by the circuit in the present invention, wherein the transistor T2 is configured as an NPN transistor.

[0020] The following is a technical solution further defined in the circuit of the present invention, wherein the transistor T1 is configured as a PNP transistor.

[0021] A safety shutdown control method based on the above safety shutdown control circuit comprises the following steps:

[0022] Step S1: setting N safety shutdown control circuits corresponding to N functional drive output units one by one, where N≥1;

[0023] Step S2: the state monitoring output terminal of the system function control unit is connected to the state monitoring input terminal of the system state monitoring unit;

[0024] The enable / disable control output terminal of the system function control unit is connected to the enable / disable control input terminal of the function drive output unit through the safety shutdown control circuit;

[0025] The shutdown control output terminal of the system status monitoring unit is connected to the state feedback input terminal of the system function control unit through the safety shutdown control circuit;

[0026] The shutdown control output terminal of the system status monitoring unit is connected to the enable / disable control input terminal of the function drive output unit through the safety shutdown control circuit;

[0027] Step S3: When the system status monitoring unit monitors that the system operation status is normal:

[0028] The system function control unit controls the function drive output unit to perform drive output, including: the enable / disable control output terminal of the system function control unit outputs a drive signal, and through a safety shutdown control circuit, the enable control input terminal of the function drive output unit receives the drive signal, so that the function drive output unit performs drive output;

[0029] The system function control unit controls the function drive output unit to shut down the drive output, including: the enable / disable control output terminal of the system function control unit outputs a shutdown signal, and through the safety shutdown control circuit, the disable control input terminal of the function drive output unit receives the shutdown signal, so that the function drive output unit shuts down the drive output;

[0030] Step S4: When the system status monitoring unit detects that the system operation status is abnormal, at the same time, the enable / disable control output terminal of the system function control unit outputs a driving signal:

[0031] The system status monitoring unit controls the functional drive output unit to shut down the drive output, including: the shutdown control output terminal of the system status monitoring unit outputs a shutdown signal, and through the safety shutdown control circuit, the disable control input terminal of the functional drive output unit receives the shutdown signal, so that the functional drive output unit shuts down the drive output.

[0032] The following is a technical solution further defined by the method of the present invention. When the system state monitoring unit monitors that the system operation state is normal, at this time, the shutdown control output terminal of the system state monitoring unit outputs a high level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T1 is in the shutdown state under the action of the pull-up resistors R3 and R5, and the base of the transistor T2 has no start current and is in the shutdown state. The shutdown control of the system state monitoring unit has no effect on the enable control input of the function drive output unit;

[0033] The system function control unit controls the function drive output unit to drive output, including: the enable / disable control output terminal of the system function control unit outputs a high level, and through the resistor R1, the enable control input terminal of the function drive output unit is a high level, so that the function drive output unit drives output;

[0034] The system function control unit controls the function drive output unit to shut down the drive output, including: the enable / disable control output terminal of the system function control unit outputs a low level, and through the resistor R1, the disable control input terminal of the function drive output unit is at a low level, so that the function drive output unit shuts down the drive output;

[0035] When the system status monitoring unit detects that the system operation status is abnormal, at the same time, the enable / disable control output terminal of the system function control unit outputs a high level. At this time, the shutdown control output terminal of the system status monitoring unit outputs a low level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T1 is in the on state under the bias of the resistors R4 and R5, and the base of the transistor T2 enters the on state through the VCC, transistor T1 and resistor R6 input turn-on current, forcing the enable control input terminal of the low-function drive output unit to be a low level, and shutting down the drive output.

[0036] The following is a technical solution further defined by the method of the present invention. When the system state monitoring unit monitors that the system operation state is normal, at this time, the shutdown control output terminal of the system state monitoring unit outputs a high level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T2 has no start current and is in the shutdown state. The shutdown control of the system state monitoring unit has no effect on the enable control input of the function drive output unit;

[0037] The system function control unit controls the function drive output unit to drive output, including: the enable / disable control output terminal of the system function control unit outputs a high level, and through the resistor R1, the enable control input terminal of the function drive output unit is a high level, so that the function drive output unit drives output;

[0038] The system function control unit controls the function drive output unit to shut down the drive output, including: the enable / disable control output terminal of the system function control unit outputs a low level, and through the resistor R1, the disable control input terminal of the function drive output unit is at a low level, so that the function drive output unit shuts down the drive output;

[0039] When the system status monitoring unit detects that the system operation status is abnormal, at the same time, the enable / disable control output terminal of the system function control unit outputs a high level. At this time, the shutdown control output terminal of the system status monitoring unit outputs a high level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T2 enters the on state through the received high level and the input start current of the resistor R6, forcing the enable control input terminal of the low-function drive output unit to be a low level, and shutting down the drive output.

[0040] Compared with the prior art, the present invention has the following technical effects:

[0041] The present invention provides a safety shutdown control circuit and a control method thereof, which provide a control path between a system status monitoring unit and a functional drive output unit, and ensure that the instructions controlled by the system status monitoring unit effectively act on the functional drive output unit when the system functional control unit is abnormal; secondly, the safety shutdown control circuit provides effective status feedback to the system functional control unit while shutting down the drive output, and the safety shutdown control status can be obtained when the system functional control unit can still operate or recover from the abnormality; finally, the safety shutdown control circuit meets the input voltage and current requirements of different functional drive output units, especially provides multi-channel drive output control at the same time, and ensures that the control signals are relatively independent, and the input failure of any one functional drive output unit will not cause the input abnormality of other functional drive output units.

[0042] The present invention is further described below in conjunction with the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 is a system connection relationship diagram of the present invention;

[0045] Figure 2 is a system connection diagram including a single-channel safety shutdown control circuit in Embodiment 1 of the present invention;

[0046] Figure 3 is a system connection relationship diagram including a multi-channel safety shutdown control circuit in embodiment 1 of the present invention;

[0047] Figure 4 is a system connection relationship diagram including a single-channel safety shutdown control circuit in Embodiment 2 of the present invention;

[0048] Figure 5 1 is a system connection diagram including a multi-path safety shutdown control circuit in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.

[0050] In the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments of the present invention can be understood according to specific circumstances.

[0051] Example 1

[0052] like Figure 1 , 2 As shown in FIG. 3 , a safety shutdown control circuit is provided, including a resistor R1 , a resistor R2 , a resistor R3 , a resistor R4 , a resistor R5 , a resistor R6 , a resistor R7 , a transistor T1 , and a transistor T2 .

[0053] One end of the resistor R1 is electrically connected to the enable / disable control output end of the system function control unit, and the other end of the resistor R1 is electrically connected to the enable / disable control input end of the function drive output unit.

[0054] One end of the resistor R2 is electrically connected to the shutdown control output end of the system state monitoring unit, and the other end of the resistor R2 is connected to the state feedback input end of the system function control unit.

[0055] The system status monitoring unit is electrically connected to the system function control unit, so that the system status monitoring unit can monitor the status of the system.

[0056] One end of the resistor R3 is electrically connected to the signal logic power supply VCC, and the other end of the resistor R3 is electrically connected to the shutdown control output end of the system status monitoring unit.

[0057] One end of the resistor R4 is electrically connected to the base of the PNP transistor T1 , and the other end of the resistor R4 is electrically connected to the shutdown control output end of the system status monitoring unit.

[0058] One end of the resistor R5 is electrically connected to the base of the PNP transistor T1 , and the other end of the resistor R5 is electrically connected to the signal logic power supply VCC.

[0059] The emitter of the PNP transistor T1 is electrically connected to the signal logic power supply VCC, and the collector of the PNP transistor T1 is electrically connected to one end of the resistor R6.

[0060] One end of the resistor R6 is electrically connected to the collector of the PNP transistor T1 , and the other end of the resistor R6 is electrically connected to the base of the NPN transistor T2 .

[0061] One end of the resistor R7 is electrically connected to the base of the NPN transistor T2 , and the other end of the resistor R7 is electrically connected to the power source GND.

[0062] The collector of the NPN transistor T2 is electrically connected to the disable control input terminal of the functional drive output unit; the emitter of the transistor T2 is electrically connected to the power supply GND.

[0063] A safety shutdown control method is provided, which mainly includes the following steps:

[0064] Step S1: Set N safety shutdown control circuits corresponding to N functional drive output units, where N≥1. When N=1, Figure 2 As shown, a single-channel safety shutdown control circuit is used to control a single-channel functional drive output unit.

[0065] Step S2: Figure 1 As shown, the state monitoring output of the system function control unit is connected to the state monitoring input of the system state monitoring unit. The enable / disable control output of the system function control unit is connected to the enable / disable control input of the function drive output unit through the safety shutdown control circuit. The shutdown control output of the system state monitoring unit is connected to the state feedback input of the system function control unit through the safety shutdown control circuit. The shutdown control output of the system state monitoring unit is connected to the enable / disable control input of the function drive output unit through the safety shutdown control circuit.

[0066] Step S3: When the system is working normally, the enable / disable control output of the system function control unit is high level, and through the resistor R1, the input high effective level of the function drive output unit is provided to enable the drive output; when the system function needs to shut down the drive output normally, the enable / disable control output of the system function control unit is low level, and through the resistor R1, the input low level of the function drive output unit is provided to shut down the drive output. In this state, the system state monitoring unit monitors the state normally and outputs a high level shutdown control signal: on the one hand, the signal is fed back to the system function control unit through R2 to notify the system function control unit; on the other hand, the system state monitoring unit has no effective shutdown control output for the function drive output unit, and the base of the transistor T1 is in the shutdown state under the action of the pull-up resistors R3 and R5, so the base of the transistor T2 has no start current and is in the shutdown state, and the shutdown control has no effect on the enable input of the function drive output unit.

[0067] Step S4: When the system operation state is abnormal and the enable / disable control output of the system function control unit is high, the system state monitoring unit monitors the abnormal state and outputs a low-level shutdown control signal: on the one hand, the signal is fed back to the system function control unit through R2 to notify the system function control unit; on the other hand, the system state monitoring unit outputs an effective shutdown control to the function drive output unit, and the base of the transistor T1 enters the on state under the bias of the resistors R4 and R5, and the base of the transistor T2 enters the on state through the VCC, T1 and R6 input turn-on current, forcing the enable input of the function drive output unit to be pulled down to a low level, thereby shutting down the drive output.

[0068] It should be noted that when N ≥ 2, Figure 3 As shown, a multi-channel safety shutdown control circuit is used to control a multi-channel functional drive output unit. For a system status monitoring unit, only one shutdown control output terminal is required to meet the multi-channel drive output control requirements.

[0069] Example 2

[0070] like Figure 1 , 4 As shown in FIG5 , a safety shutdown control circuit is provided, including a resistor R1 , a resistor R2 , a resistor R3 , a resistor R6 , a resistor R7 and a transistor T2 .

[0071] One end of the resistor R1 is electrically connected to the enable / disable control output end of the system function control unit, and the other end of the resistor R1 is electrically connected to the enable / disable control input end of the function drive output unit.

[0072] One end of the resistor R2 is electrically connected to the shutdown control output end of the system state monitoring unit, and the other end of the resistor R2 is connected to the state feedback input end of the system function control unit.

[0073] The system status monitoring unit is electrically connected to the system function control unit, so that the system status monitoring unit can monitor the status of the system.

[0074] One end of the resistor R3 is electrically connected to the shutdown control output end of the system state monitoring unit, and the other end of the resistor R3 is connected to the power supply GND.

[0075] One end of the resistor R6 is electrically connected to the shutdown control output end of the system state monitoring unit, and the other end of the resistor R6 is electrically connected to the base of the NPN transistor T2.

[0076] One end of the resistor R7 is electrically connected to the base of the NPN transistor T2 , and the other end of the resistor R7 is electrically connected to the power source GND.

[0077] The collector of the NPN transistor T2 is electrically connected to the disable control input terminal of the functional drive output unit; the emitter of the transistor T2 is electrically connected to the power supply GND.

[0078] A safety shutdown control method is provided, which mainly includes the following steps:

[0079] Step S1: Set N safety shutdown control circuits corresponding to N functional drive output units, where N≥1. When N=1, Figure 4 As shown, a single-channel safety shutdown control circuit is used to control a single-channel functional drive output unit.

[0080] Step S2: Figure 1 As shown, the state monitoring output of the system function control unit is connected to the state monitoring input of the system state monitoring unit. The enable / disable control output of the system function control unit is connected to the enable / disable control input of the function drive output unit through the safety shutdown control circuit. The shutdown control output of the system state monitoring unit is connected to the state feedback input of the system function control unit through the safety shutdown control circuit. The shutdown control output of the system state monitoring unit is connected to the enable / disable control input of the function drive output unit through the safety shutdown control circuit.

[0081] Step S3: When the system is working normally, the enable / disable control output of the system function control unit is high level, and through the resistor R1, it provides the input high effective level of the function drive output unit to enable the drive output; when the system function needs to shut down the drive output normally, the enable / disable control output of the system function control unit is low level, and through the resistor R1, it provides the input low level of the function drive output unit to shut down the drive output. In this state, the system state monitoring unit monitors the state normally and outputs a low level shutdown control signal: on the one hand, the signal is fed back to the system function control unit through R2 to notify the system function control unit; on the other hand, the system state monitoring unit has no effective shutdown control output for the function drive output unit, and the base of the transistor T2 has no start current and is in the shutdown state. The shutdown control has no effect on the enable input of the function drive output unit.

[0082] Step S4: When the system operation state is abnormal and the enable / disable control of the system function control unit outputs a high level, the system state monitoring unit monitors the abnormal state and outputs a high level shutdown control signal: on the one hand, the signal is fed back to the system function control unit through R2 to notify the system function control unit; on the other hand, the system state monitoring unit outputs an effective shutdown control to the function drive output unit, and the base of the transistor T2 enters the on state through the received high level and the input turn-on current of the resistor R6, forcing the enable input of the function drive output unit to be pulled down to a low level, thereby shutting down the drive output.

[0083] It should be noted that when N ≥ 2, Figure 5 As shown, a multi-channel safety shutdown control circuit is used to control a multi-channel functional drive output unit. For a system status monitoring unit, only one shutdown control output terminal is required to meet the multi-channel drive output control requirements.

[0084] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Any technician familiar with the art can make many possible changes and modifications to the technical solution of the present invention by using the above disclosed methods and technical contents without departing from the scope of the technical solution of the present invention, or modify it into an equivalent embodiment of equivalent changes. Therefore, all equivalent changes made according to the shape, structure and principle of the present invention without departing from the content of the technical solution of the present invention should be included in the protection scope of the present invention.

Claims

1. A safety shutdown control circuit, characterized in that: It includes a resistor R1, a resistor R2, a resistor R6, a resistor R7 and a transistor T2; One end of the resistor R1 is connected to the output end of the system function control unit, and the other end of the resistor R1 is connected to the input end of the function drive output unit; One end of the resistor R2 is connected to the output end of the system status monitoring unit, and the other end of the resistor R2 is connected to the input end of the system function control unit; One end of the resistor R6 is directly or indirectly connected to the output end of the system status monitoring unit, and the other end of the resistor R6 is connected to the base of the transistor T2; One end of the resistor R7 is connected to the base of the transistor T2, and the other end of the resistor R7 is connected to the power supply GND; The collector of the transistor T2 is connected to the function drive output unit; the emitter of the transistor T2 is connected to the power supply GND.

2. A safety shutdown control circuit as claimed in claim 1, characterized in that: When the resistor R6 is indirectly connected to the output end of the system state monitoring unit, a resistor R3, a resistor R4 and a transistor T1 are arranged between the resistor R6 and the output end of the system state monitoring unit; One end of the resistor R3 is connected to the signal logic power supply VCC, and the other end of the resistor R3 is connected to the output end of the system status monitoring unit; One end of the resistor R4 is connected to the base of the transistor T1, and the other end of the resistor R4 is connected to the output end of the system status monitoring unit; The emitter of the transistor T1 is connected to the signal logic power supply VCC, and the collector of the transistor T1 is connected to one end of the resistor R6.

3. A safety shutdown control circuit as claimed in claim 2, characterized in that: It also includes a resistor R5, one end of which is connected to the base of the transistor T1, and the other end of which is connected to the signal logic power supply VCC.

4. A safety shutdown control circuit as claimed in claim 1, characterized in that: When the resistor R6 is directly connected to the output end of the system state monitoring unit, the output end of the system state monitoring unit is connected to one end of the resistor R3, and the other end of the resistor R3 is connected to the power supply GND.

5. A safety shutdown control circuit as claimed in claim 1, characterized in that: The transistor T2 is configured as an NPN transistor.

6. A safety shutdown control circuit as claimed in claim 2, characterized in that: The transistor T1 is configured as a PNP transistor.

7. A safety shutdown control method based on the safety shutdown control circuit according to any one of claims 1 to 6, characterized in that: The following steps are involved: Step S1: setting N safety shutdown control circuits corresponding to N functional drive output units one by one, where N≥1; Step S2: the state monitoring output terminal of the system function control unit is connected to the state monitoring input terminal of the system state monitoring unit; The enable / disable control output terminal of the system function control unit is connected to the enable / disable control input terminal of the function drive output unit through the safety shutdown control circuit; The shutdown control output terminal of the system status monitoring unit is connected to the state feedback input terminal of the system function control unit through the safety shutdown control circuit; The shutdown control output terminal of the system status monitoring unit is connected to the enable / disable control input terminal of the function drive output unit through the safety shutdown control circuit; Step S3: When the system status monitoring unit monitors that the system operation status is normal: The system function control unit controls the function drive output unit to perform drive output, including: the enable / disable control output terminal of the system function control unit outputs a drive signal, and through a safety shutdown control circuit, the enable / disable control input terminal of the function drive output unit receives the drive signal, so that the function drive output unit performs drive output; The system function control unit controls the function drive output unit to shut down the drive output, including: the enable / disable control output terminal of the system function control unit outputs a shutdown signal, and through the safety shutdown control circuit, the enable / disable control input terminal of the function drive output unit receives the shutdown signal, so that the function drive output unit shuts down the drive output; Step S4: When the system status monitoring unit detects that the system operation status is abnormal, at the same time, the enable / disable control output terminal of the system function control unit outputs a driving signal: The system status monitoring unit controls the functional drive output unit to shut down the drive output, including: the shutdown control output terminal of the system status monitoring unit outputs a shutdown signal, and through the safety shutdown control circuit, the enable / disable control input terminal of the functional drive output unit receives the shutdown signal, so that the functional drive output unit shuts down the drive output.

8. A safety shutdown control method as claimed in claim 7, characterized in that: When the system status monitoring unit monitors that the system is running normally, at this time, the shutdown control output terminal of the system status monitoring unit outputs a high level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T1 is in the shutdown state under the action of the pull-up resistors R3 and R5, and the base of the transistor T2 has no start current and is in the shutdown state. The shutdown control of the system status monitoring unit has no effect on the enable / disable control input of the function drive output unit; The system function control unit controls the function drive output unit to drive output, including: the enable / disable control output terminal of the system function control unit outputs a high level, and through the resistor R1, the enable / disable control input terminal of the function drive output unit is a high level, so that the function drive output unit drives output; The system function control unit controls the function drive output unit to shut down the drive output, including: the enable / disable control output terminal of the system function control unit outputs a low level, and through the resistor R1, the disable control input terminal of the function drive output unit is at a low level, so that the function drive output unit shuts down the drive output; When the system status monitoring unit detects that the system operation status is abnormal, at the same time, the enable / disable control output terminal of the system function control unit outputs a high level. At this time, the shutdown control output terminal of the system status monitoring unit outputs a low level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T1 is in the on state under the bias of the resistors R4 and R5, and the base of the transistor T2 enters the on state through the VCC, transistor T1 and resistor R6 input turn-on current, forcing the enable control input terminal of the low-function drive output unit to be a low level, and shutting down the drive output.

9. A safety shutdown control method according to claim 7, characterized in that: When the system status monitoring unit monitors that the system is running normally, at this time, the shutdown control output terminal of the system status monitoring unit outputs a high level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T2 has no start current and is in the shutdown state. The shutdown control of the system status monitoring unit has no effect on the enable control input of the function drive output unit; The system function control unit controls the function drive output unit to drive output, including: the enable / disable control output terminal of the system function control unit outputs a high level, and through the resistor R1, the enable control input terminal of the function drive output unit is a high level, so that the function drive output unit drives output; The system function control unit controls the function drive output unit to shut down the drive output, including: the enable / disable control output terminal of the system function control unit outputs a low level, and through the resistor R1, the disable control input terminal of the function drive output unit is at a low level, so that the function drive output unit shuts down the drive output; When the system status monitoring unit detects that the system operation status is abnormal, at the same time, the enable / disable control output terminal of the system function control unit outputs a high level. At this time, the shutdown control output terminal of the system status monitoring unit outputs a high level, which is fed back to the system function control unit through the resistor R2. At the same time, the base of the transistor T2 enters the on state through the received high level and the input start current of the resistor R6, forcing the enable control input terminal of the low-function drive output unit to be a low level, and shutting down the drive output.

Images