Safety circuit, digital quantity output module and electronic equipment

Abstract

The invention provides a safety circuit, a digital quantity output module and electronic equipment, and is applied to the technical field of power electronics, the circuit comprises a first switching circuit, a second switching circuit and a first feedback circuit, the first switching circuit and the second switching circuit are connected in series to form a series branch, the series branch is connected between a contact power supply and a load contact of the digital quantity output module, the first feedback circuit feeds back the current conduction state of the series branch to the first switching circuit and the second switching circuit, and if the current conduction state is inconsistent with a target conduction state, the normally operating switching circuit in the series branch is switched off, the target conduction state corresponds to the conduction state of the first switching circuit and the second switching circuit in normal operation, compared with the prior art, the safety circuit meets the 1oo2 architecture requirement, control over a lower-level circuit can be achieved only through one external controller, the circuit implementation cost is reduced, the field wiring process is simplified, and manpower resources are saved.

Description

Technical Field

[0001] The present application relates to the field of power electronics technology, and in particular to a safety circuit, a digital output module and an electronic device. Background Art

[0002] In industrial control systems, DO (Digital Output) modules play an important role. By connecting a load to the load contacts of the DO module, the operating status of the external actuator can be controlled. In recent years, as the industry pays more and more attention to functional safety, the 1oo2 (1out of 2) architecture that can meet functional safety requirements has been widely adopted.

[0003] Combination Figure 1 As shown, the load contact (output contact) So0 and the load contact (ground contact) IOG0 of the first DO module A1 are connected to the external actuator 1, the load contact So1 and the load contact IOG1 of the second DO module B1 are connected to the external actuator 2, the external actuator 1 and the external actuator 2 are connected to the lower-level circuit, and the shutdown of any external actuator can stop the operation of the lower-level circuit, thereby meeting the 1oo2 architecture requirements.

[0004] It can be seen that the existing technology uses two DO modules in conjunction with two external actuators to build a safety loop for controlling the lower-level circuit. Not only is the circuit implementation cost high, but the on-site wiring is also complicated, and a lot of manpower is required to build the system. Summary of the invention

[0005] In view of this, the present application is committed to providing a safety circuit, a digital output module and an electronic device. The safety circuit itself meets the requirements of the 1oo2 architecture. Only one external controller is required to control the lower-level circuit, thereby reducing the circuit implementation cost, simplifying the on-site wiring process and saving human resources.

[0006] In a first aspect, the present application provides a safety circuit, comprising: a first switch circuit, a second switch circuit, and a first feedback circuit, wherein:

[0007] The first switch circuit and the second switch circuit are connected in series to form a series branch;

[0008] The series branch is connected between the contact power supply and the load contact of the digital output module;

[0009] The sampling end of the first feedback circuit is connected to the load contact, and the feedback end of the first feedback circuit is respectively connected to the first input end of the first switch circuit and the first input end of the second switch circuit;

[0010] The first feedback circuit is used to feed back the current conduction state of the series branch;

[0011] When the current conduction state is inconsistent with the target conduction state, the normally operating switch circuit in the series branch is turned off;

[0012] The target conduction state corresponds to the conduction state of the normally operating first switch circuit and the normally operating second switch circuit.

[0013] In a possible implementation manner, the first switch circuit and the second switch circuit are configured so that only one switch circuit is turned off within the diagnosis time, and the target conduction state is turned off;

[0014] If the first feedback circuit feeds back a first feedback signal indicating that the current conduction state is conduction, the switch circuit in the series branch that operates normally is turned off;

[0015] or,

[0016] The first switch circuit and the second switch circuit are configured to be turned on at the same time, and the target conduction state is on;

[0017] If the first feedback circuit feeds back a second feedback signal indicating that the current conduction state is off, the normally operating switch circuit in the series branch is turned off.

[0018] In a possible implementation manner, the first switch circuit includes a first control circuit and a first controllable switch;

[0019] The second switch circuit includes a second control circuit and a second controllable switch;

[0020] One end of the first controllable switch is connected to the contact power supply, the other end of the first controllable switch is connected to one end of the second controllable switch, and the other end of the second controllable switch is connected to the load contact;

[0021] The output end of the first control circuit is connected to the control end of the first controllable switch, and the first input end of the first control circuit serves as the first input end of the first switch circuit;

[0022] The output end of the second control circuit is connected to the control end of the second controllable switch, and the first input end of the second control circuit serves as the first input end of the second switch circuit.

[0023] In a possible implementation manner, the first control circuit outputs a first diagnostic signal that controls the conduction state of the first controllable switch;

[0024] The second control circuit outputs a second diagnostic signal for controlling the conduction state of the second controllable switch;

[0025] During the diagnosis time, only one of the first diagnosis signal and the second diagnosis signal controls the corresponding controllable switch to turn off.

[0026] In a possible implementation manner, the first control circuit outputs a third diagnostic signal for controlling a conducting state of the first controllable switch;

[0027] The second control circuit outputs a fourth diagnostic signal for controlling the conduction state of the second controllable switch;

[0028] The third diagnostic signal and the fourth diagnostic signal respectively control corresponding controllable switches to be turned on simultaneously.

[0029] In a possible implementation manner, the first control circuit and the second control circuit include the same control circuit, which includes a controller and an isolation circuit, wherein:

[0030] The output end of the controller is connected to the input end of the isolation circuit, and the output end of the isolation circuit serves as the output end of the control circuit;

[0031] The first input terminal of the controller is often the first input terminal of a corresponding control circuit.

[0032] In a possible implementation manner, the second controllable switch is further used to detect a current current of the series branch and output a trigger signal when the current current is abnormal.

[0033] In a possible implementation manner, the safety circuit provided in the first aspect of the present application further includes: a second feedback circuit, wherein:

[0034] The sampling end of the second feedback circuit is connected to the second switch circuit, and the feedback end of the second feedback circuit is respectively connected to the second input end of the first control circuit and the second input end of the second control circuit;

[0035] The second feedback circuit outputs a fault signal to the first control circuit and the second control circuit respectively in response to the trigger signal, so that the first control circuit and the second control circuit output an alarm signal.

[0036] In a possible implementation, the second feedback circuit includes: a first pull-up resistor, a first optical coupler, and a first voltage divider circuit, wherein the first voltage divider circuit includes a first voltage divider resistor and a second voltage divider resistor, wherein:

[0037] A first input terminal of the first optical coupler is connected to one end of the first voltage-dividing resistor, and a second input terminal of the first optical coupler is grounded;

[0038] The other end of the first voltage-dividing resistor is connected to one end of the second voltage-dividing resistor, and the other end of the second voltage-dividing resistor is connected to a first driving power supply, and the first driving power supply is used to provide a driving voltage for the first optical coupler;

[0039] A connection point between the first voltage-dividing resistor and the second voltage-dividing resistor serves as a sampling end of the second feedback circuit;

[0040] One end of the first pull-up resistor is connected to a second driving power supply, and the other end of the first pull-up resistor is connected to a first output end of the first optical coupler, wherein the second driving power supply is used to provide a high level;

[0041] The second output terminal of the first optical coupler is grounded;

[0042] A connection point between the first pull-up resistor and the first output end of the first optical coupler serves as a feedback end of the second feedback circuit.

[0043] In a possible implementation manner, the first feedback circuit includes: a driving circuit and an output circuit, wherein:

[0044] The input end of the driving circuit serves as a sampling end of the first feedback circuit, and the output end of the driving circuit is connected to the input end of the output circuit;

[0045] The output end of the output circuit serves as a feedback end of the first feedback circuit;

[0046] The drive circuit drives the output circuit to output a first feedback signal indicating that the current conduction state is on when the series branch is on, or drives the output circuit to output a second feedback signal indicating that the current conduction state is off when the series branch is off.

[0047] In a possible implementation, the driving circuit includes a third controllable switch and a second voltage-dividing circuit, and the second voltage-dividing circuit includes a third voltage-dividing resistor and a fourth voltage-dividing resistor, wherein:

[0048] One end of the third voltage-dividing resistor is connected to the contact power supply, and the other end of the third voltage-dividing resistor is connected to one end of the fourth voltage-dividing resistor;

[0049] The other end of the fourth voltage-dividing resistor is connected to the input end of the third controllable switch, and the output end of the third controllable switch is grounded;

[0050] The control end of the third controllable switch serves as the input end of the driving circuit;

[0051] Two ends of the fourth voltage-dividing resistor serve as output ends of the driving circuit;

[0052] The third controllable switch is turned on when the series branch is turned on, and is turned off when the series branch is turned off.

[0053] In a possible implementation, the output circuit includes: a second optical coupler and a second pull-up resistor, wherein:

[0054] The input end of the second optical coupler is connected in parallel with the fourth voltage-dividing resistor;

[0055] One end of the second pull-up resistor is connected to a second driving power supply, the other end of the second pull-up resistor is connected to a first output end of the second optical coupler, and the second driving power supply is used to provide a high level;

[0056] The second output terminal of the second optical coupler is grounded;

[0057] A connection point between the second pull-up resistor and the second optical coupler serves as an output end of the output circuit.

[0058] In a second aspect, the present application provides a digital output module, comprising: a contact power supply, a first load contact, a second load contact, and a safety circuit as described in any one of the first aspects of the present application, wherein:

[0059] The safety circuit is connected between the contact power supply and the first load contact;

[0060] The second load contact is grounded;

[0061] The first load contact and the second load contact are used to connect an external actuator.

[0062] In a third aspect, the present application provides an electronic device, comprising: at least one digital quantity output module as described in the second aspect of the present application.

[0063] Based on the above content, the safety circuit provided by the present application includes a first switch circuit, a second switch circuit and a first feedback circuit. The first switch circuit and the second switch circuit are connected in series to form a series branch, and the obtained series branch is connected between the contact power supply and the load contact of the digital output module. The first feedback circuit is respectively connected to the load contact, the first switch circuit and the second switch circuit. The first feedback circuit feeds back the current conduction state of the series branch. When the current conduction state is inconsistent with the target conduction state, the normally operating switch circuit in the series branch is turned off, wherein the target conduction state corresponds to the conduction state of the normally operating first switch circuit and the normally operating second switch circuit. Since the first switch circuit and the second switch circuit are connected in series, any switch circuit can shut down the series branch. Therefore, when the current conduction state is inconsistent with the target conduction state, there is a high probability that one of the switch circuits is in a normal state. By shutting down the normally operating switch circuit, the series branch can be shut down, thereby ensuring the safety of the lower-level circuit and meeting the 1oo2 architecture requirements. Compared with the prior art, the safety circuit itself meets the 1oo2 architecture requirements, and the single DO module implemented based on the safety circuit also meets the 1oo2 architecture requirements. Therefore, only one external controller is needed to control the lower-level circuit, reducing the circuit implementation cost, simplifying the on-site wiring process, and saving human resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0065] Figure 1 This is a connection diagram of a DO module in the prior art.

[0066] Figure 2 It is a structural block diagram of a safety circuit provided by an embodiment of the present invention.

[0067] Figure 3 It is a structural block diagram of another safety circuit provided by an embodiment of the present invention.

[0068] Figure 4 It is a circuit topology diagram of a safety circuit provided by an embodiment of the present invention.

[0069] Figure 5 It is a timing control diagram of the safety circuit provided by an embodiment of the present invention.

[0070] Figure 6 This is a structural block diagram of another safety circuit provided by an embodiment of the present invention.

[0071] Figure 7 It is a circuit topology diagram of another safety circuit provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0072] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0073] As mentioned above, in industrial control systems, DO (Digital Output) modules play an important role. By connecting the load at the load contact of the DO module, the operating state of the external actuator can be controlled. In recent years, as the industry pays more and more attention to functional safety, when building control systems with DO modules, the 1oo2 (1out of 2) architecture that meets functional safety requirements is usually adopted.

[0074] Combination Figure 1 As shown, Figure 1 Three groups of six DO modules are given as examples, that is, they include six DO channels, where A1 and B1 are the first group, A2 and B2 are the second group, and A3 and B3 are the third group. Any DO module includes two load contacts, where Sox, x=1, 2, 3, 4, represents the output contact of the corresponding DO module. In actual applications, the output contact is connected to the contact power supply inside the DO module. Correspondingly, IOGy, y=1, 2, 3, 4, represents the ground contact of the corresponding DO module. Taking the first group as an example, the load contact So0 and the load contact IOG0 of the DO module A1 are connected to the external actuator 1, and the load contact So1 and the load contact IOG1 of the second DO module B1 are connected to the external actuator 2. After the external actuator 1 and the external actuator 2 are connected to each other based on the 1oo2 architecture requirements, they are further connected to the lower-level circuit ( Figure 1 ), forming a complete safety loop based on Figure 1 The safety circuit constructed by the scheme shown can stop the operation of the lower-level circuit when any external actuator is turned off, thereby ensuring the safe operation of the lower-level circuit.

[0075] It can be seen that the existing technology requires the use of two DO modules in conjunction with two external actuators to build a safety loop for controlling the lower-level circuit. Not only is the circuit implementation cost high, but the on-site wiring is also complicated, and a lot of manpower is required to build the system.

[0076] In order to solve the above technical problems, the present application provides a safety circuit, including a first switch circuit, a second switch circuit and a first feedback circuit, wherein the first switch circuit and the second switch circuit are connected in series to form a series branch, wherein the obtained series branch is connected between a contact power supply and a load contact, wherein the first feedback circuit feeds back the current conduction state of the series branch to the first switch circuit and the second switch circuit, and if the current conduction state is inconsistent with the target conduction state, the switch circuit in normal operation in the series branch is turned off, wherein the target conduction state corresponds to the conduction state of the first switch circuit and the second switch circuit in normal operation. Since any switch circuit can turn off the series branch, therefore, when the current conduction state is inconsistent with the target conduction state, the series branch can be turned off by turning off the switch circuit in normal operation, thereby ensuring the safety of the lower circuit and meeting the 1oo2 architecture requirements. Compared with the prior art, the safety circuit itself meets the 1oo2 architecture requirements, and the single DO module implemented based on the safety circuit also meets the 1oo2 architecture requirements. Therefore, only one external controller is needed to control the lower circuit, thereby reducing the circuit implementation cost, simplifying the on-site wiring process, and saving human resources.

[0077] Based on the above, see Figure 2 , Figure 2 is a structural block diagram of a safety circuit provided in an embodiment of the present application. The safety circuit provided in this embodiment includes: a first switch circuit 10 , a second switch circuit 20 and a first feedback circuit 30 .

[0078] The safety circuit provided in this embodiment is applied to the DO module, combined with Figure 2 As shown, the DO module includes a contact power supply 40 and two load contacts 50, one of which is used to connect the contact power supply 40, and the other load contact 50 is grounded. A lower circuit 60 is connected between the two load contacts 50, and the operation state of the lower circuit 60 can be controlled by the DO module. Further, in the case where the lower circuit 60 includes an inductive circuit such as a relay, in order to prevent the reverse electromotive force generated during the power-off process from damaging the internal circuit of the DO module, an anti-reverse diode D1 is also connected between the two load contacts 50 of the DO module, the cathode of D1 is connected to the load contact 50 close to the contact power supply 40, and the anode of D1 is grounded through another load contact 50.

[0079] As for the contact power supply 40 in the DO module, it is usually a 24V DC power supply. Of course, based on the different structures of the industrial control system, the contact power supply 40 can also choose other voltages. This application does not limit the output voltage and specific implementation method of the contact power supply 40.

[0080] Based on the above content, one end of the first switch circuit 10 is connected to the contact power supply 40 in the DO module, the other end of the first switch circuit 10 is connected to one end of the second switch circuit 20, and the other end of the second switch circuit 20 is connected to the load contact 50 in the DO module, that is, the first switch circuit 10 and the second switch circuit 20 are connected in series. For the convenience of expression, in this embodiment and subsequent embodiments, the circuit obtained by connecting the first switch circuit 10 and the second switch circuit 20 is defined as a series branch, and the obtained series branch is connected between the contact power supply 40 and the load contact 50.

[0081] Furthermore, the sampling end of the first feedback circuit 30 is connected to the load contact 50, and the Figure 2 As shown, the first feedback circuit 30 is specifically connected to the output contact of the two load contacts, and the feedback end of the first feedback circuit 30 is respectively connected to the first input end of the first switch circuit 10 and the first input end of the second switch circuit 20, so as to feed back the current conduction state of the series branch to the first switch circuit 10 and the second switch circuit 20.

[0082] In the present application, the conduction state of the series branch when both the first switch circuit 10 and the second switch circuit 20 are operating normally is defined as the target conduction state. Of course, the target conduction state corresponds to the conduction state of the first switch circuit 10 and the second switch circuit 20. Specifically, since the first switch circuit 10 and the second switch circuit 20 are connected in series, the series branch can only be turned on when both the first switch circuit 10 and the second switch circuit 20 are turned on, and its target conduction state is turned on; correspondingly, when at least one of the first switch circuit 10 and the second switch circuit 20 is turned off, the series branch is turned off, and its target conduction state is turned off.

[0083] It is understandable that in actual applications, it is inevitable that one of the two switch circuits, the first switch circuit 10 and the second switch circuit 20, will fail (in the field of functional safety, the probability of two switch circuits failing at the same time is extremely low and can be ignored in industrial production. Therefore, this application does not discuss the situation where two switch circuits fail at the same time). At this time, the current conduction condition of the series branch will be inconsistent with the aforementioned target conduction condition, thereby affecting the safe operation of the DO module.

[0084] In the safety circuit provided in this embodiment, when the current conduction state fed back by the first feedback circuit 30 is inconsistent with the target conduction state, the normally operating switch circuit in the series branch is turned off, thereby ensuring that the series branch is reliably turned off and ensuring the safety of the lower-level circuit 60 connected to the DO module.

[0085] In practical applications, there are two types of faults in the first switch circuit 10 and the second switch circuit 20, one is a normally closed fault, that is, it cannot be turned off, and the other is a normally open fault, that is, it cannot be turned on. For the lower circuit 60, in the case of an abnormality in the DO module, it is safe to power off, that is, to disconnect the electrical connection between the contact power supply 40 and the load contact 50 by shutting down the series branch. Therefore, it is sufficient to disconnect one of the first switch circuit 10 and the second switch circuit 20.

[0086] Based on the above content, it can be known that the normally closed faults of the first switch circuit 10 and the second switch circuit 20 are both dangerous failures. In the field of functional safety, the accumulation of faults cannot be considered for dangerous failures. After determining that a normally closed fault occurs in any switch circuit, the normally operating switch circuit must be controlled to be turned off to achieve reverse safety output, thereby satisfying the 1oo2 architecture. Among them, reverse safety means that for functional safety products, when an abnormality is diagnosed, the product stops working. For most functional safety products, it is safe to power off. For example, if a normally closed fault occurs in the first switch circuit 10, the second switch circuit 20 in the safety circuit must be turned off. If it is not turned off and the fault continues to accumulate, when a normally closed fault occurs in the second switch circuit 20, the first switch circuit 10 and the second switch circuit 20 will be out of control, and it is difficult to effectively turn off the series branch. The system no longer has the ability to be reverse safe, which is not allowed.

[0087] The normally open faults of the first switch circuit 10 and the second switch circuit 20 are safety failures. Since the series branches must be in the off state in this case, it will not affect the safety of the lower-level circuit 60. However, in order to ensure the safety of the entire system, the normally operating switch circuits still need to be turned off to ensure that the operation process of the entire system is controllable.

[0088] In practical applications, the safety circuit provided by the present application can be used for the diagnosis of circuit performance before the DO module is powered on, and can also be used for the diagnosis of circuit performance during the process of the DO module normally supplying power to the lower circuit 60. Specifically, regardless of the above-mentioned working conditions, the first switch circuit 10 and the second switch circuit 20 are configured so that only one switch circuit is turned off during the diagnosis time. In this case, the target conduction state is turned off. If the first feedback circuit 30 feeds back a first feedback signal indicating that the current conduction state is turned on, it means that one of the switch circuits has a normally closed fault, and the switch circuit that is normally operating in the series branch is turned off. Alternatively, the first switch circuit 10 and the second switch circuit 20 are configured to be turned on at the same time. In this case, the target conduction state is turned on. If the first feedback circuit 30 feeds back a second feedback signal indicating that the current conduction state is turned off, the switch circuit that is normally operating in the series branch is turned off, thereby realizing the diagnosis of the normally closed fault and the normally open fault of the switch circuit in the series branch, and at the same time, it can ensure that the DO module is effectively powered off, meeting the requirements of the 1oo2 architecture.

[0089] It should be noted that, when the DO module is powered on, the above-mentioned diagnostic process cannot affect the normal operation of the DO module, that is, the time for controlling any switch circuit to be turned off and for the first feedback circuit 30 to collect and feedback the current conduction state of the series branch should be extremely short, ensuring that the current conduction state can be collected within this time, but will not cause any impact on the lower circuit 60, and will not cause malfunction of the lower circuit 60 due to the diagnostic process. The specific implementation of this process will be detailed in the subsequent content combined with the specific circuit topology diagram, and will not be described in detail here.

[0090] To summarize, in the safety circuit provided in this embodiment, the first switch circuit and the second switch circuit are connected in series to form a series branch. Since any switch circuit can shut down the series branch, when the current conduction state is inconsistent with the target conduction state, the series branch can be shut down by shutting down the normally operating switch circuit, thereby ensuring the safety of the lower-level circuit and meeting the 1oo2 architecture requirements. Compared with the prior art, the safety circuit itself meets the 1oo2 architecture requirements, and the single DO module implemented based on the safety circuit also meets the 1oo2 architecture requirements. Therefore, only one external controller is needed to control the lower-level circuit, thereby reducing the circuit implementation cost, simplifying the on-site wiring process, and saving human resources.

[0091] Furthermore, compared with the DO module in the prior art, by integrating the safety circuit provided in this embodiment, a single DO module can also meet the 1oo2 architecture requirement, thereby significantly improving the safety performance of the DO module.

[0092] Further, in Figure 2 Based on the embodiment shown, this embodiment provides another safety circuit, combining Figure 3 As shown, in the safety circuit provided by this embodiment, the first switch circuit 10 includes a first control circuit 101 and a first controllable switch 102 , and the second switch circuit 20 includes a second control circuit 201 and a second controllable switch 202 .

[0093] Combination Figure 3 As shown, one end of the first controllable switch 102 is connected to the contact power supply 40, and the other end is connected to one end of the second controllable switch 202, and the other end of the second controllable switch is connected to the load contact 50, that is, the first controllable switch 102 and the second controllable switch 202 are connected in series, and after being connected in series, the two are connected between the contact power supply 40 and the load contact 50.

[0094] Furthermore, the output end of the first control circuit 101 is connected to the control end of the first controllable switch 102, and the first control circuit 101 can control the conduction state of the first controllable switch 102. The first input end of the first control circuit 101 serves as the first input end of the first switch circuit 10 and is connected to the first feedback circuit 30.

[0095] The output end of the second control circuit 201 is connected to the control end of the second controllable switch 202. The second control circuit 201 can control the conduction state of the second switch circuit 202. The first input end of the second control circuit 201 serves as the first input end of the second switch circuit 20 and is connected to the first feedback circuit 30.

[0096] Based on the above connection relationship, in a possible implementation, the first control circuit 101 outputs a first diagnostic signal for controlling the conduction state of the first controllable switch 102, and the second control circuit 201 outputs a second diagnostic signal for controlling the conduction state of the second controllable switch 202. More importantly, during the diagnosis time, only one of the first diagnostic signal and the second diagnostic signal controls the corresponding controllable switch to turn off, that is, only one of the first switch circuit 10 and the second switch circuit 20 is turned off. Based on the above content, it can be known that the target conduction state of the series branch is turned off at this time. Further, the diagnosis of the normally closed fault can be realized according to the above content, which will not be repeated here.

[0097] Further, in another possible implementation, the first control circuit 101 outputs a third diagnostic signal for controlling the conduction state of the first controllable switch 102, and at the same time, the second control circuit 201 outputs a fourth diagnostic signal for controlling the conduction state of the second controllable switch 202. Since the third diagnostic signal and the fourth diagnostic signal respectively control the conduction of the corresponding controllable switches, the series branch should be in the conduction state at this time, that is, the target conduction state is conduction. The diagnosis process of whether the switch circuit has a normally open fault can also refer to the above content, and it will not be repeated here.

[0098] based on Figure 3 The structural block diagram of the embodiment shown in the figure provides an optional circuit topology of a safety circuit. For the specific circuit process, please refer to Figure 4 shown.

[0099] The first control circuit 101 and the second control circuit 201 have the same structure, that is, they include the same control circuit, which includes a controller and an isolation circuit. To facilitate the description of the scheme, this embodiment marks the controller (shown as MCU1) in the first control circuit 101 as 1011, and correspondingly, the isolation circuit in the first control circuit 101 is marked as 1012, and the controller (shown as MCU2) in the second control circuit 201 is marked as 2011, and correspondingly, the isolation circuit in the second control circuit 201 is marked as 2012.

[0100] Based on the above content, for the first switch circuit 10, the output end of the controller 1011 is connected to the input end of the isolation circuit 1012, and the output end of the isolation circuit 1012 is used as the output end of the first control circuit 101 and is connected to the control end of the first controllable switch 102. Wherein, the isolation circuit 1012 includes a resistor R3 and a third optical coupler U1, one end of the resistor R3 is used as the input end of the isolation circuit 1012, and the other end is connected to the first input end of the third optical coupler U1, and the second input end of the third optical coupler U1 is grounded. Further, the first output end of the third optical coupler U1 is used as the output end of the isolation circuit 1012, and the second output end is grounded. When the controller 1011 outputs a high level, the third optical coupler U1 is turned on, that is, the first output end and the second output end of the third optical coupler U1 are in a conducting state. Correspondingly, when the controller 1011 outputs a low level, the first output end and the second output end of the third optical coupler U1 are in a disconnected state.

[0101] It should be noted that, based on the basic working principles of the optocoupler and the relevant requirements of functional safety, in this embodiment and subsequent embodiments, the grounding point connected to the input side of the optocoupler is not the same as the grounding point connected to the output side. Specifically, the grounding point on the input side of the optocoupler is the signal ground, marked as SGND in the figure, and the grounding point on the output side of the optocoupler is a floating ground, marked as FGND in the figure. The grounding point setting of the optocoupler in this application is used here and will not be repeated in the subsequent content.

[0102] In a possible implementation, the first controllable switch 102 includes a resistor R1, a resistor R2 and a switch tube Q1, wherein in this embodiment, the switch tube Q1 is implemented by a PMOS (Positive channel Metal Oxide Semiconductor, P-channel metal oxide semiconductor field effect transistor) transistor. Of course, in practical applications, other switch tubes that can achieve the same function can also be selected, which are not listed here one by one.

[0103] One end of the resistor R1 is the input end of the first switch circuit 10 and is connected to the contact power supply 40, and the other end of the resistor R1 is connected to one end of the resistor R2, and the other end of the resistor R2 serves as the control end of the first controllable switch 102. The source of the switch tube Q1 is connected to the connection point between the resistor R1 and the contact power supply 40, the gate is connected to the connection point between the resistor R1 and the resistor R2, and the drain serves as the output end of the first switch circuit 10 and is connected to the second switch circuit 20.

[0104] It can be understood that, when the controller 1011 outputs a high level to turn on the first controllable switch 1012, the contact power supply 40, the resistor R1, the resistor R2, the third optical coupler U1 and the grounding point form a closed loop, and the current will generate a voltage across the resistor R1, thereby driving the switch tube Q1 to turn on, and the first switch circuit 10 is turned on; correspondingly, when the controller 1011 outputs a low level to turn off the first controllable switch 1012, no current will flow through the resistor R1, and no voltage will be generated across the resistor R1, the switch tube Q1 is turned off, and the first switch circuit 10 is turned off.

[0105] For the second switch circuit 20, the output end of the controller 2011 is connected to the input end of the isolation circuit 2012, and the output end of the isolation circuit 2012 is used as the output end of the second control circuit 201 and is connected to the control end of the second controllable switch 202. The isolation circuit 2012 includes a resistor R7 and a fourth optical coupler U2, one end of the resistor R7 is used as the input end of the isolation circuit 2012, and the other end is connected to the first input end of the fourth optical coupler U2, the second input end of the fourth optical coupler U2 is grounded, and further, the first output end of the fourth optical coupler U2 is connected to the first driving power supply F_5V, wherein the first driving power supply F_5V is used to provide a driving voltage for the optical coupler, and further, the second output end of the fourth optical coupler U2 is used as the output end of the isolation circuit 2012. When the controller 2011 outputs a high level, the fourth optical coupler U2 is turned on, that is, the first output terminal and the second output terminal of the fourth optical coupler U2 are in a conducting state. Correspondingly, when the controller 2011 outputs a low level, the first output terminal and the second output terminal of the fourth optical coupler U2 are in a disconnected state.

[0106] In a possible implementation, the second controllable switch 202 includes a resistor R4, a resistor R6, a resistor R5 and a high-side switch U4. It should be emphasized that in this embodiment, the high-side switch U4 is not only controllable in on and off states, but also can detect the current current flowing through the series branch, that is, flowing through itself, and output a trigger signal when the current current is abnormal. Specifically, the current abnormality mentioned in this application mainly refers to abnormal conditions such as no-load, overload, and light load, and the current threshold used to determine whether the current is abnormal is configurable. In practical applications, the high-side switch U4 can be implemented by using an integrated circuit that can meet the above requirements in the relevant technology. This application does not limit the specific selection of the high-side switch U4. It should also be noted that the aforementioned resistor R4 and resistor R6 are both protective resistors, which play a current limiting role and protect the safe operation of the high-side switch U4. The resistor R5 is mainly used to configure the aforementioned current threshold. In practical applications, the selection of the high-side switch U4 is different, and the peripheral circuits that need to be set are correspondingly different. It needs to be set in combination with the specific pin configuration and performance requirements of the high-side switch U4. Figure 4The examples shown are for reference only, and the specific implementation can be referred to the relevant technology, which will not be described in detail here. As for the application of the high-side switch U4 output trigger signal, it will be expanded in the subsequent content and will not be described in detail here.

[0107] Combination Figure 4 As shown, one end of the resistor R4 is connected to the first driving power supply F_5V, and the other end is connected to the power supply terminal EN2 of the high side switch U4. The first driving power supply F_5V is also used to provide working power for the high side switch U4. One end of the resistor R6 serves as the control end of the second controllable switch 202, and the other end is connected to the enable terminal EN1 of the high side switch U4. One end of the resistor R5 is connected to the configuration terminal Ilim of the high side switch U4, and the other end is grounded. In combination with the foregoing content, by setting the resistor R5 of different resistance values, different current thresholds can be configured for the high side switch U4. The input terminal IN of the high side switch U4 serves as the input terminal of the second controllable switch 202, and the output terminal of the high side switch U4 serves as the output terminal of the second controllable circuit 202.

[0108] Based on the above connection relationship, when the fourth optical coupler U2 is turned on, the voltage of the first driving power supply F_5V is directly output to the high-side switch U4, and the high-side switch U4 is turned on, that is, the second switch circuit 20 is turned on; correspondingly, when the fourth optical coupler U2 is turned off, the enable terminal EN1 of the high-side switch U4 is connected to a low level, and the high-side switch U4 is turned off, thereby turning off the second switch circuit 20.

[0109] It should be noted that, in a possible implementation, the first controllable switch 102 can be implemented in the same manner as the second controllable switch 202, that is, the first controllable switch 102 also has a current detection function. However, in actual applications, considering that the first controllable switch 102 and the second controllable switch 202 are connected in series, the current flowing through the two is the same, and the implementation cost of the second controllable switch 202 is relatively high, it is usually required that only one of the first controllable switch 102 and the second controllable switch 202 has a current detection function.

[0110] Furthermore, the first feedback circuit 30 includes a driving circuit 301 and an output circuit 302, Figure 4 As shown, the input end of the driving circuit 301 is connected to the load contact 50 as the sampling end of the first feedback circuit 30, the output end of the driving circuit 301 is connected to the input end of the output circuit 302, and the output end of the output circuit 302 is connected to the first input end of the first switch circuit 10 and the first input end of the second switch circuit 20 as the feedback end of the first feedback circuit 30. The driving circuit 301 drives the output circuit 302 to output a first feedback signal indicating that the current conduction state is on when the series branch is turned on, or drives the output circuit 302 to output a second feedback signal indicating that the current conduction state is off when the series branch is turned off.

[0111] Specifically, the driving circuit 301 includes a third controllable switch and a second voltage divider circuit, combined with Figure 4 As shown, the second voltage-dividing circuit includes a third voltage-dividing resistor R10 and a fourth voltage-dividing resistor R11, and the third controllable switch includes a resistor R8, a resistor R9 and a switch tube Q2. In this embodiment, the switch tube Q2 is implemented by a triode. In practical applications, other switch tubes that can achieve the same function can also be selected. Under the premise of not exceeding the core idea of ​​the present application, they also fall within the scope of protection of the present application.

[0112] One end of the resistor R8 serves as the control end of the third controllable switch, that is, as the input end of the drive circuit 301 connected to the load contact 50, the other end of the resistor R8 is grounded via the resistor R9, the base of the switch tube Q2 is connected to the connection point between the resistor R8 and the resistor R9, and the emitter of the switch tube Q2 is grounded as the output end of the third controllable switch.

[0113] One end of the third voltage-dividing resistor R10 is connected to a contact power source 40 (for simplified illustration, Figure 4 The two contact power supplies 40 shown in the figure are the same power supply), and the other end is connected to one end of the fourth voltage-dividing resistor R11, and the other end of the fourth voltage-dividing resistor R11 is connected to the input end of the third controllable switch Q2 (i.e., the collector of the transistor). Both ends of the fourth voltage-dividing resistor R11 serve as the output ends of the driving circuit 301 and are connected to the input end of the output circuit 302.

[0114] Combination Figure 4 As shown, when the series branch formed by the first switch circuit 10 and the second switch circuit 20 is turned on, the output end of the second switch circuit 20 and the load contact 50 are both high voltages. After the series branch formed by the resistor R8 and the resistor R9 divides the voltage, the two ends of the resistor R9 output a high voltage, driving the switch tube Q2 to turn on, that is, the third controllable switch is turned on. Correspondingly, the contact power supply 40, the second voltage-dividing circuit and the grounding point form a closed loop, and the two ends of the fourth voltage-dividing resistor R11 in the second voltage-dividing circuit output a high level; correspondingly, when the series branch formed by the first switch circuit 10 and the second switch circuit 20 is turned off, the output end of the second switch circuit 20 and the load contact 50 are both low voltages (0V), the two ends of the resistor R9 output a low voltage, the switch tube Q2 is turned off, that is, the third controllable switch is turned off, the contact power supply 40, the second voltage-dividing circuit and the grounding point cannot form a closed loop, and the two ends of the fourth voltage-dividing resistor R11 in the second voltage-dividing circuit output a low level.

[0115] Furthermore, the output circuit 302 includes a second optical coupler U3 and a second pull-up resistor R12. Figure 4As shown, the input end of the second optical coupler U3 is connected in parallel with the fourth voltage-dividing resistor R11 in the driving circuit 301, one end of the second pull-up resistor R12 is connected to the second driving power supply Vcc, the other end of the second pull-up resistor R12 is connected to the first output end of the second optical coupler U3, and the second output end of the second optical coupler U3 is grounded, wherein the second driving power supply Vcc is used to provide a high level, and the connection point between the second pull-up resistor R12 and the second optical coupler U3 serves as the output end of the output circuit 302. It should be noted that, in order to ensure the safety of the controller 1011 and the controller 2011, the output end of the output circuit 302 is also connected to the resistor R13 and the resistor R14, which play a certain current limiting protection role.

[0116] Based on the above connection relationship, when both the first switch circuit 10 and the second switch circuit 20 are turned on, the driving circuit 301 in the first feedback circuit 30 outputs a high level, the driving output circuit 302 is turned on, the second pull-up resistor R12 is grounded via the output end of the second optical coupler U3, and the connection point between the second pull-up resistor R12 and the second optical coupler U3 is a low level, so the first feedback signal described in the above embodiment is a low level; correspondingly, when the first switch circuit 10 or the second switch circuit 20 is turned off, the driving circuit 301 in the first feedback circuit 30 outputs a low level, the output circuit 302 is turned off, and the connection point between the second pull-up resistor R12 and the second optical coupler U3 is a high level (amplitude, i.e., Vcc voltage), so the second feedback signal described in the above embodiment is a high level. Thus, the second feedback circuit 30 realizes the collection of the current conduction state of the series branch.

[0117] After the current conduction state of the series branch is fed back to the first switch circuit 10 and the second switch circuit 20 , the first switch circuit 10 and the second switch circuit 20 can implement the safety function according to the above content.

[0118] It should be noted that in the field of functional safety, the input and output ends of the optocoupler should be connected to different driving power supplies. The present application meets this basic requirement by setting a first driving power supply and a second driving power supply.

[0119] Combine the following Figure 5 The diagnostic signal shown is Figure 4 The operation process of the safety circuit of the illustrated embodiment is described.

[0120] The first diagnostic signal and the second diagnostic signal are in the form of pulse voltage. Figure 5Two diagnostic cycles are shown. Of course, each diagnostic cycle corresponds to the pulse cycle of the pulse voltage. Usually, the diagnostic process is carried out after the DO module is powered on, that is, when the first switch circuit 10 and the second switch circuit 20 are both in the on state. Therefore, for any diagnostic cycle, the duration that the first switch circuit 10 and the second switch circuit 20 are both in the on state can be defined as the idle duration. Correspondingly, the duration that the first switch circuit 10 or the second switch circuit 20 is in the off state is the diagnostic duration. Based on the foregoing, it can be seen that in order to avoid the diagnostic process affecting the normal operation of the DO module, the value of the diagnostic duration needs to be small enough.

[0121] Based on the above content, when both the first switch circuit 10 and the second switch circuit 20 are in the on state, the first control circuit 101 outputs the first diagnostic signal, and at the same time, the second control circuit 201 outputs the second diagnostic signal, and, within the diagnostic time, the first diagnostic signal controls the first controllable switch 102 to be turned off, and the second diagnostic signal controls the second controllable switch 202 to be turned on, that is, only one of the first switch circuit 10 and the second switch circuit 20 is in the off state within the diagnostic time. At this time, the target on state of the series circuit should be off. When both the first switch circuit 10 and the second switch circuit 20 are normal, the current on state fed back by the first feedback circuit 30 should also be off. If the first controllable switch 102 has a normally closed fault and cannot be controlled to be turned off, the current on state fed back at this time is on, which is inconsistent with the target on state, then it can be determined that the first controllable switch 102 has a normally closed fault, and the first control circuit 101 controls the first controllable switch 102 to be turned off, ensuring the reverse safety of the safety circuit and meeting the 1oo2 architecture requirements.

[0122] Furthermore, if the current conduction state fed back by the first feedback circuit 30 in the first diagnostic cycle is consistent with the target conduction state, it can be determined that the first switch circuit 10 has not had a normally closed fault. Of course, at this time, the series branch is still in the conduction state. After entering the second diagnostic cycle, the first control circuit 101 controls the first controllable switch 102 to be turned on, and the second control circuit 201 controls the second controllable switch 202 to be turned off. At this time, the target conduction state of the series circuit should be turned off. When both the first switch circuit 10 and the second switch circuit 20 are normal, the current conduction state fed back by the first feedback circuit 30 should also be turned off. If the second controllable switch 202 has a normally closed fault and cannot be turned off reliably, the current conduction state fed back at this time should be turned on, which is inconsistent with the target conduction state. It can be determined that the second controllable switch 202 has a normally closed fault, and the second control circuit 201 controls the second controllable switch 202 to be turned off, ensuring the reverse safety of the safety circuit and meeting the 1oo2 architecture requirements.

[0123] The truth table corresponding to the above diagnostic process can be shown in Table 1:

[0124]

[0125] Among them, 0 means off, and 1 means on.

[0126] Furthermore, after the DO module is powered on, it is also possible to diagnose whether the first switch circuit 10 and the second switch circuit 20 have a normally open fault. Figure 4 As shown, when the series branch is turned on, the driving circuit 301 in the first feedback circuit 30 outputs a high level, the driving output circuit is turned on, the second driving power supply Vcc is grounded, and the first feedback circuit 30 outputs a low level indicating that the target conduction state is turned on to the first control circuit 101 and the second control circuit 201 respectively. Based on this, if a normally open fault occurs in the first switch circuit 10 or the second switch circuit 20, the first feedback circuit 30 should feedback a high level, which is inconsistent with the aforementioned target conduction state, and the first control circuit 101 and the second control circuit 201 can determine that a normally open fault occurs. Since it is unclear which specific switch circuit has failed, the first control circuit 101 and the second control circuit 201 can respectively control the corresponding controllable switches to turn off, ensure that the series branch can be controlled to turn off, and ensure the safety of the lower circuit 60.

[0127] In a possible implementation, it is also possible to determine whether a normally open fault occurs in the safety circuit before the DO module is powered on. In this scenario, the first control circuit 101 outputs a third diagnostic signal for controlling the conduction state of the first controllable switch 102, and the second control circuit 201 outputs a fourth diagnostic signal for controlling the conduction state of the second controllable switch 202, wherein the third diagnostic signal and the fourth diagnostic signal respectively control the corresponding controllable switches to be turned on at the same time. When both the first controllable switch 102 and the second controllable switch 202 are normal, the target conduction state of the series branch is on. Referring to the above content, if the current conduction state fed back by the first feedback circuit 30 is off, it can be determined that a normally open fault occurs in the first controllable switch 102 or the second controllable switch 202, and the first control circuit 101 and the second control circuit 201 can respectively control their corresponding controllable switches to be turned off, thereby ensuring that the series branch can be controlled to be turned off and ensuring the safety of the lower-level circuit 60.

[0128] It should be noted that based on Figure 4 It can be seen from the circuit topology shown that the conduction states of the first switch circuit 10 and the second switch circuit 20 are independently controlled. Under this premise, the first switch circuit 10 and the second switch circuit 20 are required to meet the aforementioned diagnostic requirements that only one switch circuit is turned off within the diagnostic time, or both switch circuits are turned on at the same time. In practical applications, this process can be achieved in many ways.

[0129] In a possible implementation, the controller 1011 and the controller 2011 are connected in communication, such as using an SPI bus for signal synchronization, the controller 1011 is used as a master device, and the controller 2011 is used as a slave device, and a CRC (Cyclic Redundancy Check) 32 check is used to ensure the reliability of the synchronization signal, and each output of the diagnostic signal or acquisition of the feedback signal of the first feedback circuit 30 is performed synchronously. Before operation, the host computer configures the diagnostic function, including configuring the parameters of the aforementioned diagnostic pulse, the timing of the diagnosis, etc. The controller 1011 and the controller 2011 strictly output the diagnostic signal and read back the feedback signal according to the configuration parameters, and finally realize the above control process.

[0130] In another possible implementation, controller 1011 and controller 2011 may not communicate, and the parameters of each controller may be configured by the host computer before operation. The configuration parameters may be set so that the synchronously running controllers 1011 and 2011 meet the above conditions, that is, the first switch circuit 10 and the second switch circuit 20 operate independently, but according to the configuration information, the target conduction state of the series branch may be determined according to its own state in a normal state. Taking the first switch circuit 10 as an example, after starting the diagnosis, the controller 1011 outputs a first diagnostic signal to control the first controllable switch 102 to turn off. At this time, the controller 1011 may determine that the target conduction state of the series branch is off according to its own configuration information, and further determine the diagnostic result according to the current conduction state fed back by the first feedback circuit 30.

[0131] In another possible implementation, controller 1011 and controller 2011 may establish a more complex communication mechanism. For example, they may transmit their own diagnostic information to each other through messages, and inform the other party of the expected conduction state of the controllable switch to which they are connected through the diagnostic information. Based on this, for any controller, based on its own diagnostic signal and the other party's diagnostic information obtained, it can determine the target conduction state of the series branch, and further implement the above-mentioned circuit control process with the current conduction state fed back by the first feedback circuit 30, so as to meet the 1oo2 architecture requirements.

[0132] Of course, other methods can also be used to ensure that the first switch circuit and the second switch circuit can implement the above-mentioned diagnostic process, and ensure that the safety circuit can fall back to safety when the above-mentioned fault occurs, so as to meet the requirements of the 1oo2 architecture. They are not listed one by one here, and they also fall within the scope of protection of this application without exceeding the scope of the core idea of ​​this application.

[0133] In a possible implementation, a safety circuit F1 is also connected between the contact power supply 40 and the first switch circuit 10. When the series branch current is too large, the safety circuit F1 is disconnected to prevent the first switch circuit 10 and the second switch circuit 20 from failing simultaneously due to common cause failure and being unable to reverse to safety.

[0134] Furthermore, the present application also provides another safety circuit, see Figure 6 As shown, in Figure 3 On the basis of the illustrated embodiment, the safety circuit provided in this embodiment further includes a second feedback circuit 70 .

[0135] Combination Figure 6 As shown, the sampling end of the second feedback circuit 70 is connected to the second switch circuit 20, and the feedback end of the second feedback circuit 70 is respectively connected to the second input end of the first control circuit 101 and the second input end of the second control circuit 201. As mentioned above, the second switch circuit can also detect the current current of the series branch and output a trigger signal when the current current is abnormal. Based on this, the second feedback circuit 70 outputs a fault signal to the first control circuit 101 and the second control circuit 201 in response to the trigger signal, and the first control circuit 101 and the second control circuit 201 output an alarm signal in response to the fault signal. In practical applications, the alarm signal can be output to the host computer of the DO module, or it can also be used to trigger the sound and light alarm module set by the DO module itself. Of course, it can also be used for other alarm methods, which are not listed here one by one.

[0136] based on Figure 6 The circuit structure block diagram shown in the embodiment provides another circuit topology diagram of the safety circuit. Figure 4 Based on the circuit topology shown in the figure, Figure 7 The illustrated embodiment shows an optional implementation of the second feedback circuit 70, wherein the second feedback circuit includes: a first pull-up resistor R17, a first optocoupler U5, and a first voltage divider circuit, wherein the first voltage divider circuit includes a first voltage divider resistor R16 and a second voltage divider resistor R15.

[0137] Combination Figure 7As shown, the first input end of the first optical coupler U4 is connected to one end of the first voltage-dividing resistor R16, the second input end of the first optical coupler U5 is grounded, the other end of the first voltage-dividing resistor R16 is connected to one end of the second voltage-dividing resistor R15, the other end of the second voltage-dividing resistor R15 is connected to the first driving power supply F_5V, and the connection point between the first voltage-dividing resistor R16 and the second voltage-dividing resistor R15 serves as a sampling end of the second feedback circuit 70, and is connected to the second controllable switch 202 in the second switch circuit 20. In this embodiment, the second controllable switch 20 includes a high-side switch U4, which is not only controllable in on and off states, but also can detect the current current flowing through the series branch, that is, flowing through itself, and output a trigger signal when the current current is abnormal. Specifically, the current abnormality mentioned in this application mainly refers to abnormal conditions such as no-load, overload, and light load.

[0138] Furthermore, one end of the first pull-up resistor R17 is connected to the second driving power supply Vcc, and the other end is connected to the first output end of the first optical coupler U5. The second output end of the first optical coupler U5 is grounded. The connection point between the first pull-up resistor R17 and the first output end of the first optical coupler U5 serves as the feedback end of the second feedback circuit 70, and is respectively connected to the second input end of the first control circuit 101 and the second input end of the second control circuit 201. Figure 4 In the embodiment shown, the connection mode of the first feedback circuit 30 is similar to that of the switch circuit. The output end of the second feedback circuit 70 can also be provided with a resistor R18 and a resistor R19 for current limiting protection. For specific connection relationship, see Figure 7 As shown, it will not be expanded here.

[0139] Based on the above circuit configuration, in practical applications, if the high-side switch U4 detects that the current current of the series branch is normal, that is, no overload, light load, or no-load fault occurs, the high-side switch U4 outputs a high level, the first optical coupler U5 is turned on, the second drive power supply Vcc is grounded via the first pull-up resistor R17, and the connection point between the first pull-up resistor R17 and the first output end of the first optical coupler U5 is a low level. The first control circuit 101 and the second control circuit 201 collect the low level and do not output an alarm signal. Correspondingly, if the high-side switch U4 detects that the current current of the series branch is abnormal, and any of the overload, light load, or no-load faults occurs, the high-side switch U4 outputs a low level, the first optical coupler U5 is turned off, and the second drive power supply Vcc feeds back a high level to the first control circuit 101 and the second control circuit 201 via the first pull-up resistor R17, that is, outputs a fault signal, and the first control circuit 101 and the second control circuit 201 respectively output alarm signals to complete the alarm of the non-safe fault.

[0140] As for Figure 7The other circuit structures and operation processes of the illustrated embodiment can be implemented with reference to the aforementioned contents and will not be repeated here.

[0141] To sum up, the safety circuit provided in this embodiment can not only meet the functional safety requirements and achieve reverse safety when any switching circuit fails, but also realize fault diagnosis and alarm of non-safety functions such as overload, light load and no load, effectively improve the reliability and availability of the circuit, and play an important role in the early warning and elimination of minor faults.

[0142] Furthermore, the present application also provides a digital output module, comprising: a contact power supply, a first load contact, a second load contact, and a safety circuit provided by any of the above embodiments, wherein:

[0143] The safety circuit is connected between the contact power supply and the first load contact;

[0144] The second load contact is grounded;

[0145] The first load contact and the second load contact are used to connect an external actuator.

[0146] Furthermore, the present application also provides another electronic device, including: at least one digital quantity output module provided in the above embodiment.

[0147] Those skilled in the art will appreciate that the contents disclosed in this disclosure may be subject to various modifications and improvements. For example, the various devices or components described above may be implemented by hardware, or by software, firmware, or a combination of some or all of the three.

[0148] In addition, although the present disclosure makes various references to certain units in the system according to embodiments of the present disclosure, any number of different units can be used and run on the client and / or server. The units are only illustrative, and different aspects of the system and method can use different units.

[0149] Flowcharts are used in this disclosure to illustrate the steps of the method according to the embodiments of the present disclosure. It should be understood that the preceding or following steps are not necessarily performed precisely in order. On the contrary, various steps may be processed in reverse order or simultaneously. At the same time, other operations may also be added to these processes.

[0150] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, etc. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of a software functional module. The present disclosure is not limited to any particular form of combination of hardware and software.

[0151] Unless otherwise defined, all terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present disclosure belongs. It should also be understood that terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an idealized or highly formal sense, unless explicitly defined as such herein.

[0152] The above is an explanation of the present disclosure and should not be considered as a limitation thereof. Although several exemplary embodiments of the present disclosure are described, it will be readily understood by those skilled in the art that many modifications may be made to the exemplary embodiments without departing from the novel teachings and advantages of the present disclosure. Therefore, all such modifications are intended to be included within the scope of the present disclosure as defined in the claims. It should be understood that the above is an explanation of the present disclosure and should not be considered to be limited to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. The present disclosure is defined by the claims and their equivalents.

Claims

1. A safety circuit, characterized in that: include: A first switch circuit, a second switch circuit and a first feedback circuit, wherein: The first switch circuit and the second switch circuit are connected in series to form a series branch; The series branch is connected between the contact power supply and the load contact of the digital output module; The sampling end of the first feedback circuit is connected to the load contact, and the feedback end of the first feedback circuit is respectively connected to the first input end of the first switch circuit and the first input end of the second switch circuit; The first feedback circuit is used to feed back the current conduction state of the series branch; When the current conduction state is inconsistent with the target conduction state, the normally operating switch circuit in the series branch is turned off; The target conduction state corresponds to the conduction state of the normally operating first switch circuit and the normally operating second switch circuit.

2. The safety circuit according to claim 1, characterized in that: The first switch circuit and the second switch circuit are configured so that only one switch circuit is turned off within the diagnosis time, and the target conduction state is turned off; If the first feedback circuit feeds back a first feedback signal indicating that the current conduction state is conduction, the switch circuit in the series branch that operates normally is turned off; or, The first switch circuit and the second switch circuit are configured to be turned on at the same time, and the target conduction state is on; If the first feedback circuit feeds back a second feedback signal indicating that the current conduction state is off, the normally operating switch circuit in the series branch is turned off.

3. The safety circuit according to claim 2, characterized in that: The first switch circuit includes a first control circuit and a first controllable switch; The second switch circuit includes a second control circuit and a second controllable switch; One end of the first controllable switch is connected to the contact power supply, the other end of the first controllable switch is connected to one end of the second controllable switch, and the other end of the second controllable switch is connected to the load contact; The output end of the first control circuit is connected to the control end of the first controllable switch, and the first input end of the first control circuit serves as the first input end of the first switch circuit; The output end of the second control circuit is connected to the control end of the second controllable switch, and the first input end of the second control circuit serves as the first input end of the second switch circuit.

4. The safety circuit according to claim 3, characterized in that: The first control circuit outputs a first diagnostic signal for controlling the conduction state of the first controllable switch; The second control circuit outputs a second diagnostic signal for controlling the conduction state of the second controllable switch; During the diagnosis time, only one of the first diagnosis signal and the second diagnosis signal controls the corresponding controllable switch to turn off.

5. The safety circuit according to claim 3, characterized in that: The first control circuit outputs a third diagnostic signal for controlling the conduction state of the first controllable switch; The second control circuit outputs a fourth diagnostic signal for controlling the conduction state of the second controllable switch; The third diagnostic signal and the fourth diagnostic signal respectively control corresponding controllable switches to be turned on simultaneously.

6. The safety circuit according to claim 3, characterized in that: The first control circuit and the second control circuit include the same control circuit, which includes a controller and an isolation circuit, wherein: The output end of the controller is connected to the input end of the isolation circuit, and the output end of the isolation circuit serves as the output end of the control circuit; The first input terminal of the controller is often the first input terminal of a corresponding control circuit.

7. The safety circuit according to claim 3, characterized in that: The second controllable switch is further used to detect the current of the series branch and output a trigger signal when the current current is abnormal.

8. The safety circuit according to claim 7, characterized in that: Also includes: The second feedback circuit, wherein The sampling end of the second feedback circuit is connected to the second switch circuit, and the feedback end of the second feedback circuit is respectively connected to the second input end of the first control circuit and the second input end of the second control circuit; The second feedback circuit outputs a fault signal to the first control circuit and the second control circuit respectively in response to the trigger signal, so that the first control circuit and the second control circuit output an alarm signal.

9. The safety circuit according to claim 8, characterized in that: The second feedback circuit includes: a first pull-up resistor, a first optical coupler, and a first voltage divider circuit, wherein the first voltage divider circuit includes a first voltage divider resistor and a second voltage divider resistor, wherein: A first input terminal of the first optical coupler is connected to one end of the first voltage-dividing resistor, and a second input terminal of the first optical coupler is grounded; The other end of the first voltage-dividing resistor is connected to one end of the second voltage-dividing resistor, and the other end of the second voltage-dividing resistor is connected to a first driving power supply, and the first driving power supply is used to provide a driving voltage for the first optical coupler; A connection point between the first voltage-dividing resistor and the second voltage-dividing resistor serves as a sampling end of the second feedback circuit; One end of the first pull-up resistor is connected to a second driving power supply, and the other end of the first pull-up resistor is connected to a first output end of the first optical coupler, wherein the second driving power supply is used to provide a high level; The second output terminal of the first optical coupler is grounded; A connection point between the first pull-up resistor and the first output end of the first optical coupler serves as a feedback end of the second feedback circuit.

10. The safety circuit according to any one of claims 1 to 9, characterized in that: The first feedback circuit includes: a driving circuit and an output circuit, wherein: The input end of the driving circuit serves as a sampling end of the first feedback circuit, and the output end of the driving circuit is connected to the input end of the output circuit; The output end of the output circuit serves as a feedback end of the first feedback circuit; The drive circuit drives the output circuit to output a first feedback signal indicating that the current conduction state is on when the series branch is on, or drives the output circuit to output a second feedback signal indicating that the current conduction state is off when the series branch is off.

11. The safety circuit according to claim 10, characterized in that The driving circuit includes a third controllable switch and a second voltage-dividing circuit, and the second voltage-dividing circuit includes a third voltage-dividing resistor and a fourth voltage-dividing resistor, wherein: One end of the third voltage-dividing resistor is connected to the contact power supply, and the other end of the third voltage-dividing resistor is connected to one end of the fourth voltage-dividing resistor; The other end of the fourth voltage-dividing resistor is connected to the input end of the third controllable switch, and the output end of the third controllable switch is grounded; The control end of the third controllable switch serves as the input end of the driving circuit; Two ends of the fourth voltage-dividing resistor serve as output ends of the driving circuit; The third controllable switch is turned on when the series branch is turned on, and is turned off when the series branch is turned off.

12. The safety circuit according to claim 11, characterized in that The output circuit includes: a second optical coupler and a second pull-up resistor, wherein: The input end of the second optical coupler is connected in parallel with the fourth voltage-dividing resistor; One end of the second pull-up resistor is connected to a second driving power supply, the other end of the second pull-up resistor is connected to a first output end of the second optical coupler, and the second driving power supply is used to provide a high level; The second output terminal of the second optical coupler is grounded; A connection point between the second pull-up resistor and the second optical coupler serves as an output end of the output circuit.

13. A digital output module, characterized in that: include: A contact power supply, a first load contact, a second load contact, and a safety circuit as claimed in any one of claims 1 to 12, wherein: The safety circuit is connected between the contact power supply and the first load contact; The second load contact is grounded; The first load contact and the second load contact are used to connect an external actuator.

14. An electronic device, characterized in that: include: At least one digital output module as claimed in claim 13.

Images