Drive recovery system, method, equipment and medium for vehicle-mounted safe output

Abstract

The invention relates to a driving recovery system, method and equipment for vehicle-mounted safe output and a medium, and the system comprises a relay module which is of a two-out-of-two structure; the driving recovery module adopts a two-out-of-two structure, is used for controlling the relay module and has a recovery detection function; the FPGA module is used for communicating with an external system, decoding a command of the external system so as to obtain a driving instruction, and sending state information of the system to the external system; the MCU module adopts a two-out-of-two structure and is used for receiving the driving instruction sent by the FPGA module and sending the driving instruction to the driving recovery module of the system; and the CPLD module is used for carrying out safety comparison on the information of the two channels of the MCU module, and cutting off a coil power supply of the relay module if the information is inconsistent. Compared with the prior art, the method has the advantages that the safety of the system is enhanced, and the fault processing response speed is remarkably increased.

Description

Technical Field

[0001] The present invention relates to a rail transit signal system, and in particular to a drive recovery system, method, device and medium for vehicle-mounted safety output. Background Art

[0002] In the rail transit signal industry, the input and output subsystem provides a safe connection with the vehicle for the on-board ATC system to realize automatic train protection and automatic driving. The safety output module is an important component. The control command and other drive outputs are driven by the safety output module, including EB (emergency braking) output, door opening enable output, train zero speed state output, etc. Its implementation method must meet the fail-safe principle. At present, the output of traditional on-board systems has the problems of long fault response time and high false alarm rate.

[0003] After searching, Chinese patent publication number CN116540520A discloses a safety output system based on forced-guided relays. Two processors are used to control the driving ends of two forced-guided relays at the same time. The two forced-guided relays are connected in series and then output. After each monostable circuit output signal and the corresponding two processor fixed-level output signals pass through a logic circuit, the result is used as the driving control signal of the forced-guided relay coil power supply; the other two processors each detect the power-on status of the two ends of the two forced-guided relay coils through a drive recovery circuit; the two processors each detect the output status of the two forced-guided relays through two node recovery circuits. However, the existing patent does not involve the dynamic detection process of the contacts, and it is impossible to test the drive recovery circuit. Therefore, how to further enhance the safety of the system and improve the fault handling response speed has become a technical problem that needs to be solved. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and to provide a drive recovery system, method, device and medium for vehicle-mounted safe output.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] According to a first aspect of the present invention, there is provided a drive recovery system for vehicle-mounted safety output, comprising:

[0007] Relay module, adopts 2-out-of-2 structure;

[0008] The drive recovery module adopts a 2-out-of-2 structure to control the relay module and has a recovery detection function;

[0009] FPGA module is responsible for communicating with the external system, decoding the commands of the external system to obtain the driving instructions, and sending the status information of the system to the external system;

[0010] The MCU module adopts a 2-out-of-2 structure to receive the drive instructions sent by the FPGA module and send the drive instructions to the drive recovery module of the system;

[0011] The CPLD module is used to safely compare the information of the dual channels of the MCU module. If there is any inconsistency, the coil power supply of the relay module is cut off.

[0012] As a preferred technical solution, the drive recovery module includes:

[0013] The coil drive circuit is used to isolate and amplify the drive signal sent by the MCU module, and generate a coil drive signal DRIVE_A according to the amplified signal to control whether the negative power supply RELAYDRIVE_A of the relay coil is grounded, thereby controlling the closing and opening of the relay;

[0014] The state recovery circuit is used to isolate the RELAYDRIVE_A signal and connect the relay state RELAYSTATE_A signal to the digital ground through the relay normally closed contact.

[0015] As a preferred technical solution, when DRIVE_A is at a low level, the relay is energized, and when DRIVE_A is at a high level, the relay is disconnected;

[0016] When the relay is closed, RELAYSTATE_A is in a high impedance state, and when the relay is disconnected, RELAYSTATE_A is in a low level.

[0017] As a preferred technical solution, the state recovery circuit performs XOR on the RELAYDRIVE_A and RELAYSTATE_A signals to obtain the READBACK_A signal for the MCU module to read;

[0018] The state recovery circuit uses the negative state signal of the power supply of the relay coil to input the LED circuit, and observes the state of the relay through the LED. The LED is on when the relay is closed, and the LED is off when the relay is disconnected.

[0019] As a preferred technical solution, the drive recovery module includes two working modes, namely a steady-state output recovery mode and a dynamic loop detection mode.

[0020] As a preferred technical solution, in the steady-state output recovery mode, the relay output is driven according to the state of DRIVE_A, and the relay state is stable after waiting for a set time. At this time, the RELAYSTATE_A state is stable, and the READBACK_A signal is read back.

[0021] As a preferred technical solution, in the dynamic circuit detection mode, by flipping the DRIVE_A state and reading back the relay contact state and the relay drive circuit when the relay has not yet operated, the original DRIVE_A state is restored after the reading is completed.

[0022] As a preferred technical solution, in each cycle, the MCU module obtains the relay contact state of this system through the steady-state output recovery detection of the driving recovery module, and obtains the health state of the driving circuit of this system through the dynamic loop detection of the driving recovery module, and at the same time obtains the relay contact state of another system through the relay circuit of another system. The collection results of this system and the opposite system are sent to the CPLD module for dual-system comparison. If the comparison is wrong, the CPLD module immediately cuts off the relay power supply and notifies the CPU module to turn off the relay output of this system, and the system is guided to the safety side.

[0023] As a preferred technical solution, the MCU module includes:

[0024] The initialization and self-test module is used to initialize the internal and external devices and global variables used during the power-on process of the MCU module, and check the initial state of the relay;

[0025] The command acquisition and verification module is used to cyclically check whether the control command sent by the FPGA is received. If so, the control command is read and its security is checked. If the check is wrong, the error alarm module is entered. If the test passes, the drive instruction is generated;

[0026] The output and retrieval module is used to output the commands that have passed the safety check, retrieve the relay output status after the output circuit action is completed, and encode the retrieved data and write it into the FPGA specified register for reading by other systems;

[0027] Dynamic self-check module is used to check the MCU status and relay status during operation.

[0028] As a preferred technical solution, the relay module adopts a forced-guided safety relay, the power supply of its coil is controlled by the coil power supply control circuit of the CPLD module, and receives the control signal sent by the drive recovery module to drive the normally open contact output of the relay, and recovers through the normally closed contacts of the relay.

[0029] According to a second aspect of the present invention, there is provided a method for using the drive recovery system for vehicle-mounted safety output, comprising the following steps:

[0030] Step S1, receiving and decoding a control instruction sent by an external system;

[0031] Step S2, checking the safety of the instruction, and generating an output command of the relay to drive the relay output according to the checked instruction;

[0032] Step S3, performing steady-state output recovery on the circuit after the action, and performing dynamic loop detection on the drive recovery circuit;

[0033] Step S4, processing the recovery signal sent by the recovery driving circuit and making a judgment;

[0034] Step S5, completing loop control, and writing the system status into the specified register.

[0035] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0036] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program implements the method described when executed by a processor.

[0037] Compared with the prior art, the present invention has the following advantages:

[0038] 1) The drive recovery system of the present invention can not only recover the state of the output relay in a steady state, but also periodically use a dynamic loop detection mode to check the health of the drive recovery circuit. When the output recovery path has a state lock or a drive circuit break, etc., the loop problem can be discovered before receiving the pull-in command, thereby avoiding the system from working with a problem and significantly improving the fault handling response speed.

[0039] 2) The drive recovery system of the present invention adopts a 2oo2 architecture. While checking the output status of the system, the output status of another system is cross-checked, thereby enhancing the security of the system.

[0040] 3) The present invention introduces a KO mechanism into the detection method of relay electric shock, which can effectively avoid false alarms of the highly sensitive acquisition mechanism caused by external high-frequency interference, thereby improving the reliability of the system.

[0041] 4) The present invention describes a drive circuit design for a vehicle-mounted safety output relay, which can actually be expanded to multiple outputs, all of which are dry contact outputs and have strong compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a structural schematic diagram of the system of the present invention;

[0043] Figure 2 This is a schematic diagram of the structure of the A series drive recovery module of the present invention;

[0044] Figure 3 It is a data flow diagram of the system of the present invention;

[0045] Figure 4 A schematic diagram of a software module of the MCU module of the present invention;

[0046] Figure 5 is a flow chart of the method of the present invention;

[0047] Figure 6 It is the signal timing waveform diagram of the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0049] The present invention provides a drive recovery system for vehicle-mounted safety output, so as to solve the problems of long fault response time and high false alarm rate of output of traditional vehicle-mounted system.

[0050] The present invention adopts combined fault safety technology to ensure the safety of system operation, adopts 2oo2 dual-system architecture, and adds AB system mutual inspection while recovering the system to enhance system safety. The recovery module not only checks the state of relay contacts but also has a self-checking function, thereby improving the fault response time of the system. It adopts the control technology of dual-chip microcomputer + FPGA + CPLD, and can filter the collected signals to reduce the false alarm rate.

[0051] like Figure 1 As shown, the drive recovery system of the present invention mainly includes the following modules:

[0052] 1. Relay module: The power supply of the coil of the relay module is controlled by the coil power supply control circuit of the CPLD module. It receives the control signal sent by the drive recovery module to drive the normally open contact output of the relay, and recovers through the normally closed contact of the relay; the normally open contacts of the A\B series relays are connected in series to achieve 2-out-of-2 control; the contact recovery signal is sent to the A\B series at the same time to achieve cross detection; the relay is a forced-guided safety relay to ensure that the normally open and normally closed contacts cannot be closed at the same time to prevent electric shock adhesion, which is in line with safety guidance;

[0053] 2. Drive recovery module: It realizes the control of the relay and is the transfer execution module for weak current to control strong current. It also has the recovery detection function, which determines whether the relay coil is energized and whether the drive module itself is normal through the normally closed electric shock state of the relay and the state of the coil drive circuit.

[0054] 3. MCU module: Receive the drive command sent by FPGA, and send the command to the drive acquisition module of this system; receive and process the contact acquisition signal of A\B system and the drive circuit acquisition signal of this system, and send the judgment result to the CPLD module of A\B system at the same time to realize cross detection. If the circuit state is detected to be wrong, turn off the output command.

[0055] 4. CPLD module: Performs safety comparison on the information of dual channels. If there is inconsistency, the power supply of the relay coil is cut off through the coil power supply control circuit. The independent safety comparison unit ensures the reliability of the comparison result.

[0056] 5. FPGA module: responsible for communicating with the external system, decoding the commands of the external system to obtain driving instructions, and sending the status information of the system to the external system.

[0057] like Figure 2 As shown in the figure, it is the circuit diagram of the A series drive recovery module. The design of the B series drive recovery module circuit is the same as that of the A series drive recovery module circuit. Figure 2 The circuit design of the A series drive recovery module is explained.

[0058] The drive recovery module consists of two parts: the coil drive circuit and the state recovery circuit. The main functions of the coil drive circuit are: isolating and amplifying the drive signal sent by the MCU, sending the amplified signal to the drive circuit to generate the drive signal of MOSFETQ1, and controlling whether the negative power supply RELAYDRIVE_A of the relay coil is grounded, thereby controlling the closing and disconnection of the relay. When DRIVE_A is low, the relay is closed, and when DRIVE_A is high, the relay is disconnected.

[0059] The main functions of the state recovery circuit are: isolating the RELAYDRIVE_A signal, and connecting the RELAYSTATE_A signal to the digital ground through the normally closed contact of the relay, that is, RELAYSTATE_A is in high impedance state when the relay is energized, and RELAYSTATE_A is in low level when the relay is disconnected. The recovery circuit performs XOR on the RELAYDRIVE_A and RELAYSTATE_A signals to obtain the READBACK_A signal for the MCU module to read. The negative power state signal of the relay coil is used as the input of the LED circuit, and the state of the relay can be observed through the LED. The LED is on when the relay is energized and off when the relay is disconnected.

[0060] The drive recovery module has two working modes: steady-state output recovery and dynamic loop detection. In the steady-state output recovery mode, the relay output is driven according to the state of DRIVE_A, and the relay state is stable after waiting for 30ms. At this time, the RELAYSTATE_A state is stable, and the READBACK_A signal is read back.

[0061] In the dynamic loop detection mode, since it takes time for the relay to act, when the DRIVE_A instruction changes, the state of RELAYSTATE_A usually takes more than 10ms to respond, while the recovery circuit can complete the recovery in the microsecond range. Therefore, by flipping the DRIVE_A state, the relay contact state and the relay drive circuit can be read back when the relay has not yet acted. After the readback is completed, the original DRIVE_A state is restored. This step can detect the relay contact state and the health of the drive circuit in real time.

[0062] like Figure 3 As shown, the data flow of the system of the present invention is as follows:

[0063] The execution of drive detection is mainly completed by MCU, the control of safety comparison and coil power supply is completed by CPLD, and FPGA is mainly responsible for external communication and decoding of drive commands. In each cycle, MCU obtains the relay contact state of this system through the steady-state output acquisition detection of the drive acquisition module, obtains the health status of the drive circuit of this system through the dynamic loop detection of the drive acquisition module, and obtains the relay contact state of another system through the relay circuit of another system. The acquisition results of this system and the opposite system are sent to CPLD for dual-system comparison. If the comparison is wrong, CPLD immediately cuts off the power supply of the relay and notifies CPU to turn off the relay output of this system. The system is guided to the safety side, realizing combined fault safety. The addition of cross-acquisition while acquiring dual systems improves the safety and response speed of the circuit.

[0064] like Figure 4 As shown, the software inside MCU_A specifically includes: Initialization & self check: initialization and self-check module; Command get & verify: command acquisition and verification module; Output & readback: output and readback module; BIT: dynamic self-check module; Error handle & alarm: error handling and alarm module;

[0065] Initialization & self check: Initialize all on-chip peripherals and global variables used during MCU power-on, and check the initial state of the relays. The initial state of all relays should be disconnected. If the state does not match, enter the error handling and alarm module.

[0066] Command get&verify: Loop checks whether the control command sent by FPGA is received. If yes, read the control command and check its security. If the check is wrong, enter the error alarm module. If the test passes, generate the drive instruction.

[0067] Output&readback: Output the commands that pass the safety check, and retrieve the relay output status after the output circuit action is completed (steady-state output retrieval), and encode the retrieved data and write it to the FPGA specified register for other systems to read.

[0068] BIT: Check the MCU status and relay status during operation (dynamic loop detection). Since the relay status acquisition is mainly realized by collecting the normally closed contact of the relay, and the high-frequency interference on the line may cause the highly sensitive acquisition mechanism to report false alarms, if the first dynamic loop detection acquisition result does not meet expectations, the KO mechanism is activated: that is, three more operations are performed. If the readback judgment passes, the inspection passes, otherwise the KO number is increased by 1, and the above operation is continued. If the KO number exceeds 2 times, the detection error is reported and the error handling and alarm module is entered.

[0069] Error handle&alarm: After the MCU detects an error, all outputs are turned off, the system is directed to the safe side, and the error status is encoded and written into the FPGA specified register for other systems to read.

[0070] The above is an introduction to the system embodiment. The following is a method embodiment to further illustrate the solution of the present invention.

[0071] like Figure 5 As shown, a working method of a driving recovery system for vehicle-mounted safety output of the present invention comprises the following steps:

[0072] Step 1: Receive and decode control instructions from the external system.

[0073] Step 2: Check the safety of the instruction, and generate the output command of the relay to drive the relay output according to the checked instruction.

[0074] Step 3: Perform steady-state output recovery on the circuit after the action, and perform dynamic loop detection on the drive recovery circuit.

[0075] Step 4: Process the recovery signal sent by the drive recovery circuit and make a judgment.

[0076] Step 5: Complete loop control and write the system status to the specified register.

[0077] Taking system A as an example, the timing relationship between the relay output signal (DRIVE_A), relay contact state signal (RELAYSTATE_A), and readback signal (READBACK_A) is as follows: Figure 6 As shown:

[0078] like Figure 6 As shown, at T1, the drive instruction DRIVE_A is issued, and at T2, the relay completes the action (closed or disconnected). The TE SR6 series safety relay with forced electric shock guidance is selected. The difference between T1 and T2 is within 30ms, and steady-state recovery begins after T2. After the steady-state recovery is completed, the DRIVE_A signal is flipped at T3, and DRIVE_A is restored after 0.3ms. The DRIVE_A pulse signal can be obtained, which can trigger the same READBACK_A pulse signal. The dynamic circuit check is performed between T3 and T4, and all drive recovery is completed at T4.

[0079] The logical relationship between the relay output signal (DRIVE_A), relay contact state signal (RELAYSTATE_A / RELAYSTATE_B), and readback signal (READBACK_A) in the steady-state output readback mode is shown in Table 1, and the logical relationship in the dynamic loop detection mode is shown in Table 2.

[0080] Table 1

[0081] Signal Steady State Steady State DRIVE_A 1 0 RELAYSTATE_A 0 High resistance RELAYSTATE_B 0 High resistance READBACK_A 0 0

[0082] Table 2

[0083] Signal Steady State Dynamic instant Steady State Dynamic instant DRIVE_A 1 0 0 1 RELAYSTATE_A 0 0 High resistance High resistance READBACK_A 0 1 0 1

[0084] It can be seen from Table 1 and Table 2 that in the steady-state output recovery mode, READBACK_A is always at a low level. If it is a low level, the acquisition is normal, and if it is a high level, the acquisition is reported. When DRIVE_A is 1, RELAYSTATE_A / RELAYSTATE_B is 0, the relay state is normal, and if it is a high-impedance state, the acquisition is reported. When DRIVE_A is 0, RELAYSTATE_A / RELAYSTATE_B is a high-impedance state, the relay state is normal, and if it is 0, the acquisition is reported.

[0085] In the dynamic loop check mode, by flipping the pulse signal of the steady-state output instruction DRIVE_A, the high-level pulse of READBACK_A can be collected. If a high level is collected, the acquisition loop is healthy. If a low level is collected, the acquisition loop detection error is reported.

[0086] Therefore, the relay operating state can be determined by reading back the READBACK and RELAYSTATE signals through the steady-state dual output inspection, and the health of the drive recovery circuit can be determined by reading back the READBACK signal during the dynamic loop inspection.

[0087] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific structure of the described modules can refer to the corresponding content in the aforementioned system embodiment and will not be repeated here.

[0088] The embodiment of the present invention also provides an electronic device including a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or computer program instructions loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0089] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0090] The processing unit performs the various methods and processes described above, such as the method of the present invention. For example, in some embodiments, the method of the present invention can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of the method of the present invention described above can be performed. Alternatively, in other embodiments, the CPU can be configured to perform the method of the present invention by any other appropriate means (e.g., by means of firmware).

[0091] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0092] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0093] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0094] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A drive recovery system for vehicle-mounted safety output, characterized in that: include: Relay module, adopts 2-out-of-2 structure; The drive recovery module adopts a 2-out-of-2 structure to control the relay module and has a recovery detection function; FPGA module is responsible for communicating with the external system, decoding the commands of the external system to obtain the driving instructions, and sending the status information of the system to the external system; The MCU module adopts a 2-out-of-2 structure to receive the drive instructions sent by the FPGA module and send the drive instructions to the drive recovery module of the system; The CPLD module is used to safely compare the information of the dual channels of the MCU module. If there is any inconsistency, the coil power supply of the relay module is cut off.

2. According to claim 1, a drive recovery system for vehicle-mounted safety output is characterized in that: The drive recovery module includes: The coil drive circuit is used to isolate and amplify the drive signal sent by the MCU module, and generate a coil drive signal DRIVE_A according to the amplified signal to control whether the negative power supply RELAYDRIVE_A of the relay coil is grounded, thereby controlling the closing and opening of the relay; The state recovery circuit is used to isolate the RELAYDRIVE_A signal and connect the relay state RELAYSTATE_A signal to the digital ground through the relay normally closed contact.

3. According to claim 2, a drive recovery system for vehicle-mounted safety output is characterized in that: When DRIVE_A is at a low level, the relay is energized, and when DRIVE_A is at a high level, the relay is disconnected; When the relay is closed, RELAYSTATE_A is in a high impedance state, and when the relay is disconnected, RELAYSTATE_A is in a low level.

4. A drive recovery system for vehicle-mounted safety output according to claim 2, characterized in that: The state recovery circuit performs XOR on the RELAYDRIVE_A and RELAYSTATE_A signals to obtain the READBACK_A signal for the MCU module to read; The state recovery circuit uses the negative state signal of the power supply of the relay coil to input the LED circuit, and observes the state of the relay through the LED. The LED is on when the relay is closed, and the LED is off when the relay is disconnected.

5. A drive recovery system for vehicle-mounted safety output according to claim 2, characterized in that: The drive recovery module includes two working modes, namely a steady-state output recovery mode and a dynamic loop detection mode.

6. A drive recovery system for vehicle-mounted safety output according to claim 5, characterized in that: In the steady-state output recovery mode, the relay output is driven according to the state of DRIVE_A, and the relay state is stable after waiting for a set time. At this time, the RELAYSTATE_A state is stable, and the READBACK_A signal is read back.

7. A drive recovery system for vehicle-mounted safety output according to claim 5, characterized in that: In the dynamic circuit detection mode, the DRIVE_A state is flipped and the relay contact state and the relay drive circuit are read back when the relay has not yet been actuated. After the read back is completed, the original DRIVE_A state is restored.

8. The drive recovery system for vehicle-mounted safety output according to claim 1, characterized in that: In each cycle, the MCU module obtains the relay contact status of this system through the steady-state output recovery detection of the driving recovery module, and obtains the health status of the driving circuit of this system through the dynamic loop detection of the driving recovery module. At the same time, it obtains the relay contact status of another system through the relay circuit of another system. The collection results of this system and the opposite system are sent to the CPLD module for dual-system comparison. If the comparison is wrong, the CPLD module immediately cuts off the power supply of the relay and notifies the CPU module to turn off the relay output of this system, and the system is guided to the safety side.

9. The drive recovery system for vehicle-mounted safety output according to claim 1, characterized in that: The MCU module includes: The initialization and self-test module is used to initialize the internal and external devices and global variables used during the power-on process of the MCU module, and check the initial state of the relay; The command acquisition and verification module is used to cyclically check whether the control command sent by the FPGA is received. If so, the control command is read and its security is checked. If the check is wrong, the error alarm module is entered. If the test passes, the drive instruction is generated; The output and retrieval module is used to output the commands that have passed the safety check, retrieve the relay output status after the output circuit action is completed, and encode the retrieved data and write it into the FPGA specified register for reading by other systems; Dynamic self-check module is used to check the MCU status and relay status during operation.

10. A drive recovery system for vehicle-mounted safety output according to claim 1, characterized in that: The relay module adopts a forced-guided safety relay, the power supply of its coil is controlled by the coil power supply control circuit of the CPLD module, receives the control signal sent by the drive recovery module to drive the normally open contact output of the relay, and recovers through the normally closed contact of the relay.

11. A method using the drive recovery system for vehicle-mounted safety output according to claim 1, characterized in that: The following steps are involved: Step S1, receiving and decoding a control instruction sent by an external system; Step S2, checking the safety of the instruction, and generating an output command of the relay to drive the relay output according to the checked instruction; Step S3, performing steady-state output recovery on the circuit after the action, and performing dynamic loop detection on the drive recovery circuit; Step S4, processing the recovery signal sent by the recovery driving circuit and making a judgment; Step S5, completing loop control, and writing the system status into the specified register.

12. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to claim 11 is implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 11 is implemented.

Images