High-reliability control method and system

Abstract

The invention relates to a high-reliability control method and system, and the method comprises the following steps: S1, enabling an input signal to flow into a control unit through a first input circuit, and enabling the input signal to flow into the control unit through a second input circuit; s2, the control unit controls whether the first output circuit is conducted or not according to the signal input by the first input circuit, and the control unit controls whether the second output circuit is conducted or not according to the signal input by the second input circuit; and S3, controlling the execution mechanism according to an output signal obtained after the first output circuit and the second output circuit are connected in series. Only when effective signals are detected in the first input circuit and the second input circuit, the actuating mechanism is controlled to act; and false operation is effectively avoided while false alarm of input detection is avoided, the safety and the reliability of control are enhanced, and the method is suitable for occasions with high safety requirements.

Description

Technical Field

[0001] The present invention relates to the field of control, and in particular to a high-reliability control method and system. Background Art

[0002] In situations where safety is a concern, control reliability is also a concern, such as in the field of high-reliability control technology for rail transit, especially in the field of PEDC (door operator controller) technology for subway platform doors.

[0003] With the rapid development of rail transit and other fields, the reliability and safety requirements for platform door control systems are increasing. As one of the core components of the platform door control system, the performance of PEDC directly affects the normal operation of the platform door and the safety and punctuality of the train.

[0004] The traditional PEDC has problems such as low accuracy and reliability of input detection, which is easily disturbed and leads to misjudgment; the output circuit may fail under some complex working conditions, affecting the normal operation of the platform door; the control logic is not perfect, lacking effective redundancy and fault-tolerant mechanisms; the overall structural design is not flexible enough, which is not conducive to maintenance and upgrading, etc. These problems further limit the ability of PEDC to meet higher safety integrity levels.

[0005] Safety Integrity Level (SIL) is an important indicator for measuring system safety. In the existing technology, the functional integrity of previous PEDC can only reach SIL2 level. The SIL2 level cannot meet the strict requirements of the system for safety and reliability in some complex and safety-critical rail transit application scenarios. For example, on lines with high-density train operations, or in fully automatic unmanned rail transit systems, platform door control systems require a higher safety integrity level to ensure accurate control of platform doors and passenger safety during train operation.

[0006] In summary, there is an urgent need for a high-reliability control method and system suitable for application scenarios with high safety requirements.

[0007] Note: PEDC, Platform Edge Door Controller, Platform Door Controller. Summary of the invention

[0008] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a high-reliability control method and system, which enhances the safety and reliability of control and is suitable for occasions with high safety requirements.

[0009] The objective of the present invention is achieved through the following technical solutions:

[0010] A high reliability control method comprises the following steps:

[0011] S1: The input signal flows into the control unit via the first input circuit, and the input signal flows into the control unit via the second input circuit;

[0012] S2: the control unit controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the control unit controls whether the second output circuit is turned on according to the signal input by the second input circuit;

[0013] S3: controlling the actuator according to the output signal obtained by connecting the first output circuit and the second output circuit in series;

[0014] Furthermore, in step S2, the control unit also compares the signal input by the first input circuit with the signal input by the second input circuit to determine whether the first input circuit and the second input circuit are faulty.

[0015] Further, in step S2, the control unit controls whether the first output switch tube of the first output circuit is turned on, and the control unit controls whether the second output switch tube of the second output circuit is turned on.

[0016] Furthermore, in step S2, the control unit also performs fault detection on the first output circuit and the second output circuit. When the control unit detects that one of the first output circuit and the second output circuit fails, the other output circuit is disconnected.

[0017] Furthermore, in step S1, the first input circuit and the second input circuit output a high level or a low level state through a signal modulation module when there is no external input, and output a pulse signal when an external input occurs. In step S2, the control unit controls the first output circuit to be turned on only when the first input circuit inputs a pulse signal, and the control unit controls the second output circuit to be turned on only when the second input circuit inputs a pulse signal.

[0018] A high-reliability control system comprises an input signal end, a first input circuit, a second input circuit, a control unit, a first output circuit, a second output circuit and an output signal end; the input signal end, the first input circuit, the control unit and the first output circuit are electrically connected in sequence; the input signal end, the second input circuit, the control unit and the second output circuit are electrically connected in sequence; the first output circuit is connected in series with the second output circuit and then electrically connected to the output signal end, and the output signal end is electrically connected to an actuator; the control unit controls whether the first output circuit is turned on according to a signal input from the first input circuit, and the control unit controls whether the second output circuit is turned on according to a signal input from the second input circuit.

[0019] Furthermore, the first output circuit includes a first output switch tube, and the second output circuit includes a second output switch tube; the first output switch tube is connected in series with the second output switch tube; the control unit is connected to a first control module, the first control module is electrically connected to the first output switch tube, and the control unit is electrically connected to a second control module, and the second control module is electrically connected to the second output switch tube.

[0020] Further, the control unit is electrically connected to a first detection module, the first detection module is electrically connected to the first output circuit, and the first detection module performs fault detection on the first output circuit; the control unit is electrically connected to a second detection module, the second detection module is electrically connected to the second output circuit, and the second detection module performs fault detection on the second output circuit;

[0021] A signal modulation module is provided in the detection loop of the first input circuit and the second input circuit. The signal modulation module enables the first input circuit and the second input circuit to output a high level or a low level state when there is no external input, and output a pulse signal when there is an external input.

[0022] Furthermore, the first input circuit and the second input circuit are optocoupler input circuits, the signal modulation module comprises an optocoupler element, the optocoupler element is connected in series to the optocoupler input circuit, and the optocoupler element performs a switching operation at a fixed frequency.

[0023] Further, the control unit includes a first control circuit and a second control circuit;

[0024] The input signal terminal is electrically connected to the input terminal of the first input circuit, the output terminal of the first input circuit is electrically connected to the input terminal of the first control circuit, and the output terminal of the first control circuit is electrically connected to the first output circuit;

[0025] The input signal terminal is electrically connected to the input terminal of the second input circuit, the output terminal of the second input circuit is electrically connected to the input terminal of the second control circuit, and the output terminal of the second control circuit is electrically connected to the second output circuit.

[0026] The first control circuit is electrically connected to the second control circuit.

[0027] The beneficial effects of the present invention are:

[0028] The actuator is controlled to act only when valid signals are detected in both the first input circuit and the second input circuit; this can avoid false alarms in input detection and effectively avoid false actions, thus enhancing the safety and reliability of control and making it suitable for situations with high safety requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1This is the optocoupler input circuit diagram of the traditional PDEC;

[0030] Figure 2 Enter the circuit diagram for the relay of the conventional PDEC;

[0031] Figure 3 This is the output circuit diagram of the traditional PEDC;

[0032] Figure 4 This is the traditional PEDC control architecture diagram;

[0033] Figure 5 is a related circuit diagram of the first output circuit and the second output circuit;

[0034] Figure 6 is a schematic diagram of a first input circuit and a second input circuit;

[0035] Figure 7 is a circuit diagram of a first input circuit and a second input circuit;

[0036] Figure 8 is a circuit diagram between the first input circuit, the second input circuit and the control unit in Embodiment 3;

[0037] Fig. 9 This is the "2 out of 2" architecture diagram;

[0038] Fig.10 This is the framework diagram of the redundancy scheme of the traditional PEDC;

[0039] Fig.11 This is a framework diagram of the redundancy solution of PEDC in Example 3;

[0040] Fig.12 This is a modular design framework diagram of Embodiment 3;

[0041] Fig.13 This is the main view of the modular installation of Example 3.

[0042] In the figure, 1-first control module, 2-second control module, 3-first detection module, 4-second detection module. DETAILED DESCRIPTION

[0043] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0044] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0045] Comparative Example:

[0046] like Figures 1 to 4 As shown, the traditional PEDC input circuit often uses a single optocoupler element or relay element to detect the input signal, and uses a fixed level output method to determine whether the input signal is valid. Figure 1 The circuit principle of the existing PEDC using an optocoupler element as input is demonstrated.

[0047] When there is an input signal, U4 is in the on state, and the "signal output" acquisition point will output a low level. After detecting the low-level signal, the controller will determine that the input signal is valid and then output the control logic. However, this circuit has a defect, that is, even in the absence of an input signal, due to the inherent failure mode of electronic components, due to a short circuit failure in U4, the "signal output" acquisition point will also output a low level, causing the control circuit to make an incorrect judgment, and then output the wrong control logic, affecting driving safety.

[0048] For the input circuit using relays, the circuit diagram is as follows Figure 2 When there is an external input signal, relay KA1 is energized and OUT1 outputs a low level, thereby outputting the control logic.

[0049] Similar to the failure mode of optocouplers, if the relay contact KA1-B becomes stuck, the control circuit will detect a valid signal that should not exist when there is no external input signal, causing the control circuit to make an incorrect judgment and then output incorrect control logic, affecting driving safety.

[0050] The output circuit of traditional PEDC is shown in the attached figure. Figure 3 As shown in the figure, when the relay is closed, an output signal can be generated externally. This circuit is fine when applied to conventional consumer products, but it is insufficient in areas such as rail transit that have high safety requirements. This is because whether it is the adhesion of the relay contacts or the short circuit failure of the transistor, the output circuit will generate an effective signal that should not appear, thereby affecting driving safety.

[0051] Traditional PEDC control architecture such as Figure 4As shown in the figure, most of them are single electronic control systems, which are mainly composed of three parts: input circuit, control circuit and output circuit. In this architecture, signal detection errors in the input circuit, logical operation errors in the control circuit and component failures in the output circuit may all lead to abnormal output of the entire system. Therefore, the reliability of this architecture is poor and cannot meet the needs of scenarios with high reliability requirements.

[0052] The redundancy scheme of traditional PEDC (such as Fig.10 ) is to use two PEDCs and use a switch to achieve master-slave switching. Some manufacturers' products can switch automatically, while some require manual switching. However, no matter which switching method is used, there is a switching time. If the current PEDC is outputting a control signal, the switching process will cause an output interruption.

[0053] Traditional PEDC uses a method of centrally designing all functional circuits on a single board, which has the following significant defects:

[0054] Impact of the fault:

[0055] When any functional circuit on the board fails, it is very likely to trigger a chain reaction, affecting the normal operation of the entire system, causing the platform door to fail to work as expected. During maintenance work, since the functional circuits are tightly integrated, the entire system needs to be checked, which is time-consuming and labor-intensive, greatly extending the maintenance time.

[0056] Scalability:

[0057] If there is a need to expand or upgrade the system's functions at a later stage, due to the high level of integration in the initial design of the single board, it is difficult or even impossible to flexibly modify it and add new functional modules.

[0058] Maintenance difficulty:

[0059] Because all circuits are concentrated on the same single board, it is extremely challenging for maintenance personnel to accurately diagnose faults and carry out maintenance work, which requires maintenance personnel to have deep professional knowledge reserves and superb skills.

[0060] Embodiment 1:

[0061] like Figures 5 to 7 As shown, a high reliability control method comprises the following steps:

[0062] S1: The input signal flows into the control unit via the first input circuit, and the input signal flows into the control unit via the second input circuit;

[0063] S2: the control unit controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the control unit controls whether the second output circuit is turned on according to the signal input by the second input circuit;

[0064] S3: controlling the actuator according to the output signal obtained by connecting the first output circuit and the second output circuit in series;

[0065] The actuator is controlled to act only when valid signals are detected in both the first input circuit and the second input circuit; this can avoid false alarms in input detection and effectively avoid false actions, thus enhancing the safety and reliability of control and making it suitable for situations with high safety requirements.

[0066] In step S2, the control unit also compares the signal input from the first input circuit with the signal input from the second input circuit to determine whether the first input circuit and the second input circuit are faulty.

[0067] When the signals inputted by the first input circuit and the second input circuit are inconsistent, the fault alarm mechanism is triggered, for example, one of the signals inputted by the first input circuit and the second input circuit is determined to be a valid signal as a fault alarm state.

[0068] In this way, the control unit compares the signal input by the first input circuit (its detection result) with the signal input by the second input circuit (its detection result). For example, when the first input circuit detects a valid signal, but the second input circuit does not detect a relevant signal, it is determined in the comparison result that no signal is detected, and the first input circuit will be determined to be in a fault state.

[0069] In this way, the accuracy and reliability of input signal detection are ensured. Only when the detection results of the first input circuit and the second input circuit are consistent will it be regarded as a valid input. Otherwise, a fault alarm mechanism will be triggered to promptly discover and deal with possible problems in the input link, ensuring that the entire system performs subsequent control and operation processes based on accurate input information.

[0070] In step S2, the control unit controls whether the first output switch tube of the first output circuit is turned on, and the control unit controls whether the second output switch tube of the second output circuit is turned on.

[0071] When the control unit detects that the signal input by the first input circuit is a valid input signal, the control instruction is executed to turn on the first output switch tube; when the control unit detects that the signal input by the second input circuit is a valid input signal, the control instruction is executed to turn on the second output switch tube.

[0072] Since the first output switch tube and the second output switch tube are connected in series, after both switch tubes are turned on, the output circuit is in a conductive state. The unique physical property of the two switch tubes in series is used to complete the process of "2 out of 2" (that is, there are two independent judgment mechanisms, and only when both judgment mechanisms reach a valid conclusion, the whole is considered valid).

[0073] The 2-out-of-2 mechanism enhances the safety and reliability of control, effectively avoids false operation of platform doors, and ensures the safety of train operation.

[0074] In step S2, the control unit further performs fault detection on the first output circuit and the second output circuit. When the control unit detects that one of the first output circuit and the second output circuit fails, the control unit controls the other output circuit to be disconnected.

[0075] In this embodiment, the output circuit is changed to two output switch tubes for control, and the two output switch tubes are connected in series. The two output switch tubes are controlled by the control unit, and the output signal will only be generated when both output switch tubes are in the on state. The detection module will carry out fault detection work on the output switch tube. In the absence of a control signal, if an erroneous output occurs due to a fault in the output switch tube itself, the detection module can detect the error and set the other switch tube to a state of being disconnected all the time, so as to ensure that the circuit will not produce an erroneous output due to its own fault factors.

[0076] In step S1, the first input circuit and the second input circuit output a high level or a low level state through a signal modulation module when there is no external input, and output a pulse signal when an external input occurs. In step S2, the control unit controls the first output circuit to be turned on only when the first input circuit inputs a pulse signal, and the control unit controls the second output circuit to be turned on only when the second input circuit inputs a pulse signal.

[0077] A high-reliability control system comprises an input signal end, a first input circuit, a second input circuit, a control unit, a first output circuit, a second output circuit and an output signal end; the input signal end, the first input circuit, the control unit and the first output circuit are electrically connected in sequence; the input signal end, the second input circuit, the control unit and the second output circuit are electrically connected in sequence; the first output circuit is connected in series with the second output circuit and then electrically connected to the output signal end, and the output signal end is electrically connected to an actuator; the control unit controls whether the first output circuit is turned on according to a signal input from the first input circuit, and the control unit controls whether the second output circuit is turned on according to a signal input from the second input circuit.

[0078] The first output circuit includes a first output switch tube, and the second output circuit includes a second output switch tube; the first output switch tube and the second output switch tube are connected in series; the control unit is connected to a first control module 1, and the first control module 1 is electrically connected to the first output switch tube, and the control unit is electrically connected to a second control module 2, and the second control module 2 is electrically connected to the second output switch tube.

[0079] The control unit is electrically connected to a first detection module 3, the first detection module 3 is electrically connected to the first output circuit, and the first detection module 3 performs fault detection on the first output circuit; the control unit is electrically connected to a second detection module 4, the second detection module 4 is electrically connected to the second output circuit, and the second detection module 4 performs fault detection on the second output circuit.

[0080] In the initial stage when no control instructions are received, the first detection module 3 and the second detection module 4 continuously and uninterruptedly monitor the working status of the first output switch tube and the second output switch tube of the actuator in real time. Once any fault occurs in the first output switch tube and the second output switch tube, the first detection module 3 and the second detection module 4 can detect and feedback in time. This mechanism effectively ensures that when the control unit implements control operations on the first output switch tube and the second output switch tube, these two key output switch tubes are in a state where they can work normally.

[0081] The first output switch tube and the second output switch tube are both N-channel MOS tubes.

[0082] N-channel MOS tubes are selected as switch tubes, such as U15 and U14 in the relevant circuit diagrams of the first output circuit and the second output circuit.

[0083] The first control module 1 mainly includes an optical coupler (shown as U10). The optical coupler serves to isolate the control circuit from the execution circuit, and the related N-channel MOS tube (shown as U15) serves to perform the execution function. The composition and control principle of the second control module 2 are the same as those of the first control module 1.

[0084] The first detection module 3 is mainly composed of a voltage-stabilizing diode (D14 shown in the figure) and an optocoupler (U11 shown in the figure). The function of the voltage-stabilizing diode is to provide a specific threshold value to prevent the circuit from being falsely triggered. The optocoupler is responsible for level conversion and electrical isolation of the detected signal, and then transmits the processed signal to the control loop to ensure that the control loop can accurately receive the effectively processed and safely isolated detection signal, thereby realizing accurate detection of the actuator. The composition and principle of the second detection module 4 are the same as those of the first detection module 3.

[0085] The first output circuit and the second output circuit realize a high-reliability output circuit, ensuring that the platform door actuator can obtain a stable and reliable driving signal, thereby improving the accuracy and reliability of the platform door movement.

[0086] A signal modulation module is provided in the detection loop of the first input circuit and the second input circuit. The signal modulation module enables the first input circuit and the second input circuit to output a high level or a low level state when there is no external input, and output a pulse signal when there is an external input.

[0087] In this way, the input circuit is configured in a dynamic acquisition mode. That is, the output signal of the input circuit is not a constant high level or low level, but a pulse signal of a specific frequency. When there is an input signal at the input end of the input circuit, its output end will output a pulse signal of a specific frequency.

[0088] A signal modulation module is added to the detection loop of the input circuit so that the detection loop continuously cuts off the detection loop according to the switching cycle of the signal modulation module. When there is no external input, the output continues to maintain a high level state; once there is an external input, the output is the same pulse signal as the modulation circuit. Once the controller detects the pulse signal, it determines that the input is valid.

[0089] It can be clearly seen from the schematic diagrams of the first input circuit and the second input circuit that when any component fails or fails, such a pulse signal to be detected cannot be generated, thereby significantly improving the reliability of the input circuit.

[0090] The first input circuit and the second input circuit are optocoupler input circuits. The signal modulation module includes an optocoupler element. The optocoupler element is connected in series to the optocoupler input circuit. The optocoupler element performs a switching operation at a fixed frequency.

[0091] Specifically, an optocoupler element (such as U4 in the figure) is connected in series in the input loop. The corresponding control circuit controls U4 to switch at a fixed frequency. The input signal is detected by the optocoupler element U2. In the absence of external input, the output will continue to maintain a high level state; when there is an external input, while U4 is continuously switched at a fixed frequency, the output end will output a pulse signal with the same frequency as U4.

[0092] The first input circuit and the second input circuit realize a high-reliability input detection circuit, which can accurately detect input signals, reduce misjudgment, and improve the adaptability of the platform door control system to changes in the external environment.

[0093] Embodiment 2:

[0094] like Figures 5 to 7 As shown, the second embodiment has all the features of the first embodiment, except that:

[0095] The control unit is a single chip microcomputer.

[0096] Embodiment three:

[0097] like Figures 5 to 13 As shown, the third embodiment has all the features of the first embodiment, except that:

[0098] The control unit includes a first control circuit and a second control circuit;

[0099] The input signal terminal is electrically connected to the input terminal of the first input circuit, the output terminal of the first input circuit is electrically connected to the input terminal of the first control circuit, and the output terminal of the first control circuit is electrically connected to the first output circuit;

[0100] The input signal terminal is electrically connected to the input terminal of the second input circuit, the output terminal of the second input circuit is electrically connected to the input terminal of the second control circuit, and the output terminal of the second control circuit is electrically connected to the second output circuit.

[0101] In this embodiment, the first control circuit is electrically connected to the first control module 1 , and the second control circuit is electrically connected to the second control module 2 .

[0102] The first control circuit is electrically connected to the second control circuit.

[0103] The two exchange data to compare the signal input by the first input circuit with the signal input by the second input circuit, so as to determine whether the first input circuit and the second input circuit are faulty.

[0104] The first control circuit and the second control circuit both include a control chip.

[0105] In this embodiment, the input signal enters two MCUs (Microcontroller Unit, commonly known as control chip in circuits) through two completely independent channels. The two MCUs will complete independent detection operations and compare their respective detection results.

[0106] The micro control unit 1 (MCU1) of the first control circuit has control authority over the first output switch tube, and the micro control unit 2 (MCU2) of the second control circuit has control authority over the second output switch tube.

[0107] When MCU1 successfully detects a valid input signal and MCU2 also detects a valid input signal at the same time, MCU1 executes the control instruction to turn the first output switch tube into a conducting state, and MCU2 controls the second output switch tube to turn on.

[0108] The first control module 1 is connected to the control 1 port of the MCU1 , and the first detection module 3 is connected to the detection 1 port of the MCU1 .

[0109] The second control module 2 is connected to the control 2 port of the MCU2, and the second detection module 4 is connected to the detection 2 port of the MCU2.

[0110] In this embodiment, PEDC adopts a 2-out-of-2 architecture in terms of input circuit, control circuit and output circuit, as shown in the attached figure. The input circuit is divided into two independent channels, which enter two independent control circuits (including processors) respectively. Each control circuit controls an output switch tube, and the two output switch tubes are connected in series. Only when both control circuits give correct control signals, the two output switch tubes are turned on to generate an output signal. This 2-out-of-2 architecture significantly improves the control reliability of the entire PEDC system. Since there are two channels and processors working in parallel and checking each other, compared with the traditional single architecture, the risk of the system outputting an erroneous signal due to a single component failure or error is greatly reduced.

[0111] The PEDC redundancy design in this embodiment (such as Fig.11 ) adopts a completely independent module hot standby redundancy mode. The input boards, output boards, and control boards of the two PEDCs are redundant and mutually verified. When any PEDC detects a fault in itself or the other party, it will issue a fault alarm in time and automatically stop the faulty PEDC from working. Under normal circumstances, the two PEDCs are in working state at the same time, and any failure of one will not affect the other.

[0112] Specifically, the input boards, output boards and control boards of the two PEDCs are mutually redundant and mutually verified. Once any PEDC detects a fault in itself or the other party, it will immediately issue a fault alarm message and automatically stop the operation of the faulty PEDC. Under normal circumstances, both PEDCs are in working condition, and a fault in either party will not affect the other party, thereby achieving the purpose of redundant design.

[0113] The redundant design greatly improves the reliability and availability of the PEDC device, reduces platform door system failures caused by equipment failures, and improves train punctuality and operational efficiency.

[0114] The first input circuit and the second input circuit are arranged on the input board, the first output circuit and the second output circuit are arranged on the output board, and the first control circuit and the second control circuit are arranged on the control board.

[0115] The modular design of this embodiment adopts the method of designing the input, output and control of PEDC according to modules respectively, which has the following significant advantages:

[0116] Fault isolation:

[0117] Once a module fails, due to the relatively independent characteristics of each module, it will not affect the normal operation of other modules. And the faulty module can be quickly and accurately located, and then it can be directly replaced or repaired, greatly reducing the system downtime caused by the failure.

[0118] Scalability:

[0119] New modules can be added flexibly and conveniently according to actual usage needs to expand system functions. In the process of adding new modules, due to the strong independence of the modules, they will not cause excessive interference or damage to the stable operation and overall architecture of the existing system.

[0120] Maintenance convenience:

[0121] The independence of each module enables maintenance personnel to directly carry out maintenance work on the module with specific faults when facing equipment failures, without the need for complex overall troubleshooting as in traditional single-board designs. This effectively reduces the difficulty of maintenance work and significantly improves the efficiency of maintenance work.

[0122] In the modular design of this embodiment, the PEDC is disassembled into four parts: input board, output board, control board and back board. The functions of each part are as follows:

[0123] Input board: It has the function of collecting status information from various input interfaces such as hard wires, buttons, switches, etc., and transmits this information to the control board via the bus.

[0124] Output board: Receives control logic signals from the control board and converts them into electrical signals to drive external devices. The output board uses electronic switching elements such as safety relays and MOSFETs to ensure precise control of the opening and closing of the platform door.

[0125] Control panel: undertakes the important tasks of data processing, logical operations and system coordination.

[0126] Backplane: A key component responsible for interconnecting various boards and external interfaces. It ensures stable and reliable data transmission and power supply between boards through high-density interface design and reliable electrical connections.

[0127] The modular design makes the design, manufacture, testing and maintenance of PEDC devices more convenient and faster, reduces costs and improves the scalability and flexibility of the system.

[0128] Through a series of innovative designs, the functional integrity of PEDC has reached SIL4 level, thus better meeting the high safety and reliability requirements of modern rail transit for platform door control systems.

[0129] The above-mentioned embodiments only express the specific implementation of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A high reliability control method, characterized in that: The following steps are involved: S1: The input signal flows into the control unit via the first input circuit, and the input signal flows into the control unit via the second input circuit; S2: the control unit controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the control unit controls whether the second output circuit is turned on according to the signal input by the second input circuit; S3: Controlling the actuator according to the output signal obtained by connecting the first output circuit and the second output circuit in series.

2. A high reliability control method according to claim 1, characterized in that: In step S2, the control unit also compares the signal input from the first input circuit with the signal input from the second input circuit to determine whether the first input circuit and the second input circuit are faulty.

3. A high reliability control method according to claim 1, characterized in that: In step S2, the control unit controls whether the first output switch tube of the first output circuit is turned on, and the control unit controls whether the second output switch tube of the second output circuit is turned on.

4. A high reliability control method according to claim 1, characterized in that: In step S2, the control unit further performs fault detection on the first output circuit and the second output circuit. When the control unit detects that one of the first output circuit and the second output circuit fails, the control unit controls the other output circuit to be disconnected.

5. A high reliability control method according to claim 1, characterized in that: In step S1, the first input circuit and the second input circuit output a high level or a low level state through a signal modulation module when there is no external input, and output a pulse signal when an external input occurs. In step S2, the control unit controls the first output circuit to be turned on only when the first input circuit inputs a pulse signal, and the control unit controls the second output circuit to be turned on only when the second input circuit inputs a pulse signal.

6. A high reliability control system, using a high reliability control method according to claim 1, characterized in that: It includes an input signal terminal, a first input circuit, a second input circuit, a control unit, a first output circuit, a second output circuit and an output signal terminal; the input signal terminal, the first input circuit, the control unit and the first output circuit are electrically connected in sequence; the input signal terminal, the second input circuit, the control unit and the second output circuit are electrically connected in sequence; the first output circuit and the second output circuit are connected in series and then electrically connected to the output signal terminal, and the output signal terminal is electrically connected to an actuator; the control unit controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the control unit controls whether the second output circuit is turned on according to the signal input by the second input circuit.

7. A high reliability control system according to claim 6, characterized in that: The first output circuit includes a first output switch tube, and the second output circuit includes a second output switch tube; the first output switch tube and the second output switch tube are connected in series; the control unit is connected to a first control module, the first control module is electrically connected to the first output switch tube, and the control unit is electrically connected to a second control module, and the second control module is electrically connected to the second output switch tube.

8. A high reliability control system according to claim 1, characterized in that: The control unit is electrically connected to a first detection module, the first detection module is electrically connected to the first output circuit, and the first detection module performs fault detection on the first output circuit; the control unit is electrically connected to a second detection module, the second detection module is electrically connected to the second output circuit, and the second detection module performs fault detection on the second output circuit; A signal modulation module is provided in the detection loop of the first input circuit and the second input circuit. The signal modulation module enables the first input circuit and the second input circuit to output a high level or a low level state when there is no external input, and output a pulse signal when there is an external input.

9. A high reliability control system according to claim 8, characterized in that: The first input circuit and the second input circuit are optocoupler input circuits. The signal modulation module includes an optocoupler element. The optocoupler element is connected in series to the optocoupler input circuit. The optocoupler element performs a switching operation at a fixed frequency.

10. A high reliability control system according to claim 6, characterized in that: The control unit includes a first control circuit and a second control circuit; The input signal terminal is electrically connected to the input terminal of the first input circuit, the output terminal of the first input circuit is electrically connected to the input terminal of the first control circuit, and the output terminal of the first control circuit is electrically connected to the first output circuit; The input signal terminal is electrically connected to the input terminal of the second input circuit, the output terminal of the second input circuit is electrically connected to the input terminal of the second control circuit, and the output terminal of the second control circuit is electrically connected to the second output circuit; The first control circuit is electrically connected to the second control circuit.

Images