Redundant control system for safety controller, safety controller and subsea tree

Abstract

The application discloses a kind of redundancy control systems for safety controller, safety controller and underwater Christmas tree, it is related to electronic information technical field.The redundancy control system for safety controller at least includes: first control board card, second control board card, first CAN communication channel and second CAN communication channel;First control board card and second control board card are interacted by first CAN communication channel and second CAN communication channel;The structure of first control board card and second control board card is identical;First control board card includes first control module, second control module and double-channel isolation module;First control module and second control module are electrically connected by double-channel isolation module, and first control module and second control module are compared and checked by double-channel isolation module between data, and information is synchronized.It can provide reliable control board card for safety controller underwater operation.And provide redundant control board card, improve the reliability of system.

Description

Technical Field

[0001] This application relates to the field of electronic information technology, specifically to a redundant control system for a safety controller, a safety controller, and a subsea wellhead. Background Technology

[0002] Safety controllers are a key technology in subsea production trees, providing safety protection for equipment during start-up, shutdown, process disturbances, and normal maintenance. In the event of a dangerous situation, the safety controller reacts immediately and outputs the correct signal, bringing the equipment to a safe state or shutting it down. They are widely used in various industrial manufacturing sectors. The control board is a safety controller module capable of performing application logic processing, secure comparison of logic operation results, and secure processing of input and output data. It primarily provides various communication interfaces, data processing, event logging, and fault diagnosis functions.

[0003] Currently, the country is continuously promoting the development of underwater production systems. However, due to the late start of research on underwater production tree electrical control systems in China, there are currently no stable and reliable domestically produced products for underwater production tree safety controllers. The reliability needs to be further improved in harsh marine environments. Common faults of control boards include unstable signal acquisition, poor reliability, short safe service life, and inability to perform circuit diagnosis. To ensure the stable operation of underwater production, the emergence of highly reliable products is required. Summary of the Invention

[0004] Purpose of the invention: The embodiments of this application provide a redundant control system for a safety controller, which aims to overcome the technical problem of poor reliability of the control board of the safety controller when operating underwater in the prior art; another purpose of the embodiments of this application is to provide a safety controller; a third purpose of this application is to provide an underwater wellhead.

[0005] Technical solution: The redundant control system for a safety controller described in this application includes at least: a first control board, a second control board, a first CAN communication channel, and a second CAN communication channel; wherein the first control board and the second control board exchange information through the first CAN communication channel and the second CAN communication channel; the first control board and the second control board have the same structure;

[0006] The first control board includes a first control module, a second control module, and a dual-channel isolation module; the first control module and the second control module are electrically connected through the dual-channel isolation module, and the first control module and the second control module perform data comparison and verification and information synchronization through the dual-channel isolation module.

[0007] In some embodiments, the first control module includes a first control unit and a first programmable logic unit; the second control module includes a second control unit and a second programmable logic unit.

[0008] The first control unit and the first programmable logic unit are electrically connected, and the second control unit and the second programmable logic unit are electrically connected.

[0009] The first programmable logic unit is electrically connected to the second programmable logic unit, and the first programmable logic unit and the second programmable logic unit exchange data and synchronize information through the dual-channel isolation module.

[0010] In some embodiments, the first control module further includes a first communication unit, and the second control module further includes a second communication unit;

[0011] The first communication unit is electrically connected to the first control unit and the first programmable logic unit, respectively;

[0012] The second communication unit is electrically connected to the second control unit and the second programmable logic unit, respectively.

[0013] In some embodiments, the first communication unit includes a first CAN_FD communication isolation unit and a first CAN communication isolation unit; the second communication unit includes a second CAN_FD communication isolation unit and a second CAN communication isolation unit.

[0014] Both the first CAN_FD communication isolation unit and the first CAN communication isolation unit are electrically connected to the first control unit;

[0015] Both the second CAN_FD communication isolation unit and the second CAN communication isolation unit are electrically connected to the second control unit.

[0016] In some embodiments, the first communication unit further includes a first serial communication unit; the second communication unit further includes a second serial communication unit; the first serial communication unit is electrically connected to the first control unit and the first programmable logic unit respectively; the second serial communication unit is electrically connected to the second control unit and the second programmable logic unit respectively.

[0017] In some embodiments, the first communication unit further includes a first print debugging unit; the second communication unit further includes a second print debugging unit.

[0018] The first printing debugging unit is electrically connected to the first control unit, and the second printing debugging unit is electrically connected to the second control unit.

[0019] In some embodiments, the first control module further includes a first operating status monitoring unit; the second control module further includes a second operating status monitoring unit.

[0020] The first operating status monitoring unit is electrically connected to the first control unit, and the first operating status monitoring unit is used to monitor the operating status information of the first control unit and send it to the first control unit.

[0021] The second operating status monitoring unit is electrically connected to the second control unit. The second operating status monitoring unit is used to monitor the operating status information of the second control unit and send it to the second control unit.

[0022] In some embodiments, the first operating status monitoring unit includes a first temperature monitoring unit; the second operating status monitoring unit includes a second temperature monitoring unit.

[0023] The first temperature monitoring unit is electrically connected to the first control unit, and the first temperature monitoring unit is used to monitor the temperature of the first control unit and send it to the first control unit;

[0024] The second temperature monitoring unit is electrically connected to the second control unit, and the second temperature monitoring unit is used to monitor the temperature of the second control unit and send it to the second control unit.

[0025] In some embodiments, the first control module further includes a first power module; the second control module further includes a second power module.

[0026] The first power module is electrically connected to the first communication unit, the first control unit, and the first programmable logic unit, respectively, and is used to supply power to the first communication unit, the first control unit, and the first programmable logic unit.

[0027] The second power module is electrically connected to the second communication unit, the second control unit, and the second programmable logic unit, respectively, and is used to supply power to the second communication unit, the second control unit, and the second programmable logic unit.

[0028] In some embodiments, the first control module further includes a first clock unit; the second control module further includes a second clock unit.

[0029] The first clock unit is electrically connected to the first programmable logic unit; the second clock unit is electrically connected to the second programmable logic unit.

[0030] In some embodiments, the first control module further includes a first display unit; the second control module further includes a second display unit.

[0031] The first display unit is electrically connected to the first control unit; the second display unit is electrically connected to the second control unit.

[0032] Accordingly, the safety controller described in the embodiments of this application includes a redundant control system for the safety controller as described above.

[0033] Accordingly, the subsea production tree described in this application includes a safety controller as described above.

[0034] Beneficial Effects: Compared with the prior art, the redundant control system for a safety controller, the safety controller, and the subsea wellhead in this application embodiment include at least: a first control board, a second control board, a first CAN communication channel, and a second CAN communication channel; wherein the first control board and the second control board interact with each other through the first CAN communication channel and the second CAN communication channel; the first control board and the second control board have the same structure; wherein the first control board includes a first control module, a second control module, and a dual-channel isolation module; the first control module and the second control module are electrically connected through the dual-channel isolation module, and the first control module and the second control module perform data comparison verification and information synchronization through the dual-channel isolation module. Therefore, this application provides a redundant control system for a safety controller that can provide a reliable control board for the safety controller during underwater operations. Furthermore, by setting up a first control board, a second control board, and a first CAN communication channel, redundant control boards are provided for the safety controller, so that when one control board fails during underwater operations, the other control board can ensure that the safety controller continues to operate underwater, thereby improving the reliability of the system. Furthermore, each control board is equipped with a first control module, a second control module, and a dual-channel isolation module to achieve mutual verification and redundancy between data, thereby further improving the reliability of the system. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1This is a schematic diagram of the redundant control system for a safety controller provided in the embodiments of this application;

[0037] Figure 2 This is a schematic diagram of the external structure of a control board provided in an embodiment of this application;

[0038] Figure 3 This is a schematic diagram of another redundant control system for a safety controller provided in the embodiments of this application;

[0039] Figure 4 This is a flowchart of an FPGA provided in the embodiments of this application;

[0040] Figure 5 This is a schematic block diagram of the dual-channel isolation module provided in the embodiments of this application;

[0041] Figure 6 This is a block diagram of a CAN-FD communication isolation unit provided in the embodiments of this application;

[0042] Figure 7 This is a block diagram of a CAN communication isolation unit provided in the embodiments of this application;

[0043] Figure 8 This is a schematic block diagram of an RS485 unit provided in the embodiments of this application;

[0044] Figure 9 This is a block diagram of a DBG_UART unit provided in the embodiments of this application;

[0045] Figure 10 This is a block diagram of the temperature monitoring unit provided in the embodiments of this application;

[0046] Figure 11 This is a block diagram of the RTC unit provided in the embodiments of this application;

[0047] Figure 12 This is a schematic block diagram of the display unit provided in the embodiments of this application;

[0048] Figure 13 This is a schematic diagram of the structure of a control board provided in an embodiment of this application;

[0049] Figure 14 This is a schematic diagram of a partial peripheral circuit of the CPU provided in the embodiments of this application;

[0050] Figure 15 This is a schematic diagram of the CPU local peripheral circuit two provided in the embodiments of this application;

[0051] Figure 16This is a schematic diagram of the CPU local peripheral circuit three provided in the embodiments of this application;

[0052] Figure 17 This is a schematic diagram of a partial peripheral circuit of an FPGA provided in an embodiment of this application;

[0053] Figure 18 This is a schematic diagram of the second local peripheral circuit of the FPGA provided in the embodiments of this application;

[0054] Figure 19 This is a diagram showing the composition and connection relationship of the HT-SKE500 safety controller module provided in the embodiments of this application.

[0055] Figure label:

[0056] 10-First control board; 20-Second control board; 30-First CAN communication channel; 40-First dual-channel isolation module; 50-Second dual-channel isolation module; 100-First control module; 200-Second control module; 300-Third control module; 400-Fourth control module; 101-First control unit; 102-First programmable logic unit; 103-First communication unit; 104-First operating status monitoring unit; 105-First power supply module; 106-First clock unit; 107-First display unit; 1031-First CAN_FD communication isolation unit; 1032-... 1033 - First CAN communication isolation unit; 1034 - First printing and debugging unit; 1041 - First temperature monitoring unit; 201 - Second control unit; 202 - Second programmable logic unit; 203 - Second communication unit; 204 - Second operating status monitoring unit; 205 - Second power module; 206 - Second clock unit; 207 - Second display unit; 2031 - Second CAN_FD communication isolation unit; 2032 - Second CAN communication isolation unit; 2033 - Second serial communication unit; 2034 - Second printing and debugging unit; 2041 - Second temperature monitoring unit. Detailed Implementation

[0057] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0058] It should be understood that although the terms first, second, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any and more of the associated listed items.

[0059] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments and may not be to scale. The modules or processes shown in the drawings are not necessarily essential for implementing this application and therefore should not be used to limit the scope of protection of this application.

[0060] Figure 1 This is a schematic block diagram of a redundant control system for a safety controller provided in an embodiment of this application. Please refer to... Figure 1 The redundant control system for the safety controller includes at least: a first control board 10, a second control board 20, a first CAN communication channel 30, and a second CAN communication channel 60; wherein the first control board 10 and the second control board 20 exchange information through the first CAN communication channel 30 and the second CAN communication channel 60; the first CAN communication channel 30 and the second CAN communication channel 60 are mutually redundant and operate simultaneously, and the failure of any one communication channel does not affect the normal operation of the other channel; the first control board 10 and the second control board 20 have the same structure; wherein the first control board 10 includes a first control module 100, a second control module 200, and a dual-channel isolation module; the first control module 100 and the second control module 200 are electrically connected through the dual-channel isolation module, and the first control module 100 and the second control module 200 perform data comparison verification and information synchronization through the dual-channel isolation module.

[0061] The first control board 10 and the second control board 20 are redundantly configured, with identical settings. Both boards can connect to external analog input boards, digital input boards, and digital output boards for data acquisition and external drive functions. External boards are not within the scope of this design. The first control board 10 and the second control board 20 communicate via the first CAN communication channel 30 and the second CAN communication channel 60. If one control board fails, the other board can continue to perform normal data acquisition and drive functions, ensuring the safety controller can continue operating underwater. The first control board 10 and the second control board 20 communicate via a dedicated CAN communication channel (2oo2), which enhances security and improves system reliability.

[0062] For example, see Figure 1 The first control board 10 includes a first control module 100, a second control module 200, and a first dual-channel isolation module 40. The first control module 100 and the second control module 200 are electrically connected via the first dual-channel isolation module 40. Data exchange and information synchronization between the first control module 100 and the second control module 200 are achieved through the first dual-channel isolation module 40. This enables data interaction and information synchronization between the first control module 100 and the second control module 200. On the one hand, it allows for mutual verification, ensuring the reliability of data transmission. On the other hand, it provides redundancy, so that if one control module fails, the other control module can continue to ensure the safety controller continues to operate normally underwater, thereby improving the system's reliability.

[0063] The second control board 20 has the same structure as the first control board 10. (Continue reading...) Figure 1 The second control board 20 includes a third control module 300, a fourth control module 400, and a second dual-channel isolation module 50. The third control module 300 and the fourth control module 400 are electrically connected via the second dual-channel isolation module 50. Data exchange and information synchronization between the third control module 300 and the fourth control module 400 are achieved through the second dual-channel isolation module 50. This enables data interaction and information synchronization between the third control module 300 and the fourth control module 400, allowing for mutual verification and ensuring the reliability of data transmission. Furthermore, it provides redundancy, ensuring that if one control module fails, the other control module can continue to operate the safety controller underwater, thereby improving system reliability.

[0064] This application provides a redundant control system for a safety controller. This redundant control system includes at least: a first control board 10, a second control board 20, a first CAN communication channel 30, and a second CAN communication channel 60. The first control board 10 and the second control board 20 exchange information via the first CAN communication channel 30 and the second CAN communication channel 60. The first control board 10 and the second control board 20 have identical structures. The first control board 10 includes a first control module 100, a second control module 200, and a dual-channel isolation module. The first control module 100 and the second control module 200 are electrically connected via the dual-channel isolation module, and data comparison, verification, and information synchronization between the first control module 100 and the second control module 200 are performed via the dual-channel isolation module. Therefore, this application provides a redundant control system for a safety controller, providing a reliable control board for underwater operations. Furthermore, by setting up a first control board 10, a second control board 20, and a first CAN communication channel 30, redundant control boards are provided for the safety controller. This ensures that if one control board fails during underwater operations, the other control board can guarantee continued operation of the safety controller, thereby improving system reliability. Additionally, each control board is equipped with a first control module 100, a second control module 200, and a dual-channel isolation module to achieve data cross-verification and redundancy, further enhancing system reliability.

[0065] Figure 2 This is a schematic diagram of the external structure of a control board provided in an embodiment of this application. The first control board 10 and the second control board 20 have the same size and structure. For example, taking the first control board 10 as an example, see [link to documentation]. Figure 2 The control board adopts a 3U width design, with a width of 100mm and a length of 180mm. It has no front panel mounting, a PCB board thickness of 1.6mm, and the largest component is no more than 20mm in height. The rear connector uses a 53-pin connector, and the board adopts a fanless passive heat dissipation design.

[0066] Figure 3 This is a schematic diagram of another redundant control system for a safety controller provided in this application embodiment. In the technical solution of this application embodiment, the first control board 10 and the second control board 20 are identical and redundantly configured. For example, the structure of the control board is described in detail below using the first control board 10 as an example (the same applies below, and will not be repeated). Based on the above embodiments, please refer to... Figure 3The first control module 100 includes a first control unit 101 and a first programmable logic unit 102; the second control module 200 includes a second control unit 201 and a second programmable logic unit 202; wherein the first control unit 101 and the first programmable logic unit 102 are electrically connected, and the second control unit 201 and the second programmable logic unit 202 are electrically connected; the first programmable logic unit 102 and the second programmable logic unit 202 are electrically connected, and the first programmable logic unit 102 and the second programmable logic unit 202 exchange data and synchronize information through a dual-channel isolation module.

[0067] The first control unit 101 and the second control unit 201 are identical and redundantly configured. The first control unit 101 and the second control unit 201 can be control chips such as microcontrollers; their specific configuration can be determined based on actual needs and is not limited here.

[0068] The first programmable logic unit 102 and the second programmable logic unit 202 are identical and redundantly configured. The first programmable logic unit 102 and the second programmable logic unit 202 can be field-programmable gate arrays (FPGAs).

[0069] For example, see Figure 3 The first programmable logic unit 102 and the second programmable logic unit 202 exchange data and synchronize information through the first dual-channel isolation module 40, which can improve the reliability of the control board and thus improve the reliability of the safety controller in underwater operation.

[0070] The first programmable logic unit 102 and the first control unit 101 can exchange data via an external bus EMIF. This isolation is used for synchronization and data exchange between the two FPGA channels, power status detection, and other functions. Similarly, the second programmable logic unit 202 and the second control unit 201 can also exchange data via the external bus EMIF.

[0071] The first programmable logic unit 102 and the first control unit 101 can exchange data via an external bus EMIF. Matching resistors are designed on the data and address lines to ensure signal integrity. Similarly, matching resistors are also designed on the data and address lines between the second programmable logic unit 202 and the second control unit 201.

[0072] The first programmable logic unit 102 provides Clear and Reset signals to the first control unit 101. After the control board is powered on, these two pins can receive high-level signals, which are used as clear and reset signals for the internal logic of the first programmable logic unit 102. Similarly, the second programmable logic unit 202 provides Clear and Reset signals to the second control unit 201.

[0073] The first programmable logic unit 102 receives GPIO signals sent by the first control unit 101 for synchronization between the two CPUs. Similarly, the second programmable logic unit 202 receives GPIO signals sent by the first control unit 101 for synchronization between the two CPUs.

[0074] Figure 4 This is a flowchart of an FPGA provided in an embodiment of this application. See also... Figure 4 The FPGA between the two channels is also equipped with synchronization and communication lines, which are isolated for synchronization and data exchange between the two channels. Dual-mode communication involves the CPU communicating with the FPGA via EMIF, and the FPGA communicating with the peer FPGA via a serial port; the FPGA operates on a transparent transmission basis. The FPGA hardware functional circuitry mainly includes the FPGA chip EP4CE15F17I7N, a configuration chip, and an RTC module. Two crystal oscillators, 20MHz and 30MHz respectively, provide independent clocks for the logic channels within the FPGA after passing through a PLL.

[0075] Figure 5 This is a schematic block diagram of the dual-channel isolation module provided in the embodiments of this application. For example, see [link to relevant documentation]. Figure 5 The dual-channel isolation module is electrically connected to FPGA1 (i.e., the first programmable logic unit 102) and FPGA2 (i.e., the second programmable logic unit 202), respectively. The dual-channel isolation module completes the isolation of dual-channel data exchange and synchronization. Specifically, the dual-channel isolation module uses an isolation chip for signal isolation, with an isolation rating of 1KVrms and a maximum data rate of 25Mbps.

[0076] In some embodiments, please continue reading Figure 3 The first control module 100 further includes a first communication unit 103, and the second control module 200 further includes a second communication unit 203; the first communication unit 103 is electrically connected to the first control unit 101 and the first programmable logic unit 102 respectively; the second communication unit 203 is electrically connected to the second control unit 201 and the second programmable logic unit 202 respectively.

[0077] The first control module 100 and the second control module 200 are respectively provided with a first communication unit 103 and a second communication unit 203, which can be used to realize the basic communication of the first control board 10, such as communication between internal components and communication with external devices, thereby ensuring the communication function of the control board, and thus ensuring the communication function of the safety controller and ensuring the reliability of the safety controller in underwater operation.

[0078] In some embodiments, please continue reading Figure 3 The first communication unit 103 includes a first CAN_FD communication isolation unit 1031 and a first CAN communication isolation unit 1032; the second communication unit includes a second CAN_FD communication isolation unit 2031 and a second CAN communication isolation unit 2032; both the first CAN_FD communication isolation unit 1031 and the first CAN communication isolation unit 1032 are electrically connected to the first control unit 101; both the second CAN_FD communication isolation unit 2031 and the second CAN communication isolation unit 2032 are electrically connected to the second control unit 201.

[0079] The first control module 100 includes a first CAN_FD communication isolation unit 1031 for internal CAN communication and CAN communication with external devices, improving data transmission rate and ensuring communication reliability of the safety controller during underwater operations. The second control module 200 includes a second CAN_FD communication isolation unit 2031 for CAN communication redundancy, ensuring communication can continue even if the first CAN_FD isolation unit 1031 fails, thus improving the reliability of the control board and safety controller. Similarly, the first control module 100 includes a first CAN communication isolation unit 1032, and the second control module 200 includes a second CAN communication isolation unit 2032. This provides multiple backup CAN communication channels, suitable for situations where equipment updates and maintenance are inconvenient in underwater environments. Furthermore, the redundancy ensures communication reliability by allowing communication to continue even if one CAN communication isolation unit fails.

[0080] Figure 6 This is a block diagram illustrating the principle of a CAN-FD communication isolation unit provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 6The CAN-FD communication isolation unit provided in this application embodiment is used for internal system communication via the CAN-FD interface, enabling data interaction with external modules such as digital input / output and analog input. The CAN-FD communication isolation unit adopts an external interface expansion approach, utilizing the SPI interface to extend the CAN-FD interface. The principle of the CAN-FD communication isolation unit is as follows: Figure 6 As shown. Each CPU unit (i.e., the first control unit 101 and the second control unit 201) is connected to the CAN_FD interface on the backplane of the control board through an SPI isolation chip and an SPI-to-CAN_FD chip, respectively.

[0081] Figure 7 This is a block diagram illustrating the principle of a CAN communication isolation unit provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 7 Each CPU unit (i.e., the first control unit 101 and the second control unit 201) provides two CAN channels, and each uses two CAN transceiver chips to achieve signal isolation and communication.

[0082] In some embodiments, please continue reading Figure 3 The first communication unit 103 further includes a first serial communication unit 1033; the second communication unit 203 further includes a second serial communication unit 2033; the first serial communication unit 1033 is electrically connected to the first control unit 101 and the first programmable logic unit 102 respectively; the second serial communication unit 2033 is electrically connected to the second control unit 201 and the second programmable logic unit 202 respectively.

[0083] The first serial communication unit 1033 and the second serial communication unit 2033 are redundantly configured to provide serial communication for the first control board 10, such as external data communication. Therefore, in the embodiment of this application, by setting the first CAN_FD communication isolation unit 1031, the first CAN communication isolation unit 1032, and the first serial communication unit 1033 in the first control module 100, a variety of communication methods can be provided for the first control board 10, meeting various communication needs of the control board and thus improving the reliability of the first control board 10 and the safety controller. Similarly, the second control board 20 is also equipped with CAN_FD, CAN, and serial communication, which can improve the reliability of the second control board 20 and the safety controller.

[0084] The first serial communication unit 1033 and the second serial communication unit 2033 can be 485 serial communication.

[0085] Figure 8 This is a schematic block diagram of an RS485 unit provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 8The first serial communication unit 1033 and the second serial communication unit 2033 adopt RS485 communication isolation modules, which can be used to control the external data communication of the control board. The RS485 unit includes two RS485 channels, and uses two RS485 transceiver chips to achieve signal isolation and communication.

[0086] In some embodiments, please continue reading Figure 3 The first communication unit 103 further includes a first printing debugging unit 1034; the second communication unit 203 further includes a second printing debugging unit 2034; wherein the first printing debugging unit 1034 is electrically connected to the first control unit 101, and the second printing debugging unit 2034 is electrically connected to the second control unit 201.

[0087] The first print debugging unit 1034 and the second print debugging unit 2034 can be used to debug print data and are redundant to each other.

[0088] The first printing debugging unit 1034 and the second printing debugging unit 2034 can adopt a UART serial communication interface.

[0089] Figure 9 This is a block diagram of a DBG_UART unit provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 9 The first print debugging unit 1034 and the second print debugging unit 2034 use DBG_UART units for debugging print data. Each channel on the first control board 10 provides one DBG_UART interface for debugging print data.

[0090] Therefore, in the solution of this application embodiment, by setting a first CAN_FD communication isolation unit 1031, a first CAN communication isolation unit 1032, a first serial communication unit 1033, and a first printing and debugging unit 1034 in the first control module 100, a variety of communication methods can be provided for the first control board 10, which can meet the various communication needs of the control board, thereby improving the reliability of the first control board 10 and the safety controller. Similarly, the second control board 20 is also equipped with CAN_FD, CAN, and serial communication, which can improve the reliability of the second control board 20 and the safety controller.

[0091] In some embodiments, please continue reading Figure 3The first control module 100 further includes a first operating status monitoring unit 104; the second control module 200 further includes a second operating status monitoring unit 204; wherein, the first operating status monitoring unit 104 is electrically connected to the first control unit 101, and the first operating status monitoring unit 104 is used to monitor the operating status information of the first control unit 101 and send it to the first control unit 101; the second operating status monitoring unit 204 is electrically connected to the second control unit 201, and the second operating status monitoring unit 204 is used to monitor the operating status information of the second control unit 201 and send it to the second control unit 201.

[0092] Specifically, the first operating status monitoring unit 104 monitors the operating status information of the first control unit 101 in real time and sends it to the first control unit 101. After receiving its operating status information, the first control unit 101 determines whether its operating status is abnormal based on the information. If an abnormality occurs, it takes appropriate measures in a timely manner to ensure the reliability of the first control unit 101's operation, thereby ensuring the reliability of the safety controller during underwater operations. Similarly, the second operating status monitoring unit 204 monitors the operating status information of the second control unit 201 in real time and sends it to the second control unit 201. After receiving its operating status information, the second control unit 201 determines whether its operating status is abnormal based on the information. If an abnormality occurs, it takes appropriate measures in a timely manner to ensure the reliability of the second control unit 201's operation, thereby ensuring the reliability of the safety controller during underwater operations.

[0093] The operating status information can include temperature, voltage, current, etc., and can be set according to the actual situation. No specific limitations are made here.

[0094] In some embodiments, please continue reading Figure 3 The first operating status monitoring unit 104 includes a first temperature monitoring unit 1041; the second operating status monitoring unit 204 includes a second temperature monitoring unit 2041; wherein, the first temperature monitoring unit 1041 is electrically connected to the first control unit 101, and the first temperature monitoring unit 1041 is used to monitor the temperature of the first control unit 101 and send it to the first control unit 101; the second temperature monitoring unit 2041 is electrically connected to the second control unit 201, and the second temperature monitoring unit 2041 is used to monitor the temperature of the second control unit 201 and send it to the second control unit 201.

[0095] Specifically, the first temperature monitoring unit 1041 monitors the temperature information of the first control unit 101 in real time and sends it to the first control unit 101. Upon receiving the temperature information, the first control unit 101 determines whether the temperature is abnormal (e.g., overheating, or exceeding a preset temperature). If an abnormality occurs, it takes appropriate action to ensure the reliability of the first control unit 101's operation, thereby ensuring the reliability of the safety controller during underwater operation. Similarly, the second temperature monitoring unit 2041 monitors the temperature information of the second control unit 201 in real time and sends it to the second control unit 201. Upon receiving the temperature information, the second control unit 201 determines whether the temperature is abnormal. If an abnormality occurs, it takes appropriate action to ensure the reliability of the second control unit 201's operation, thereby ensuring the reliability of the safety controller during underwater operation. The specific value of the preset temperature can be set according to actual conditions and is not specifically limited here.

[0096] The first temperature monitoring unit 1041 and the second temperature monitoring unit 2041 can be temperature sensors.

[0097] Figure 10 This is a block diagram illustrating the principle of a temperature monitoring unit provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 10 The temperature detection module communicates with the CPU via the I2C bus. The CPU unit utilizes its built-in I2C module to achieve data interaction with the temperature sensor.

[0098] In some embodiments, please continue reading Figure 3 The first control module 100 further includes a first power supply module 105; the second control module 200 further includes a second power supply module 205; wherein the first power supply module 105 is electrically connected to the first communication unit 103, the first control unit 101 and the first programmable logic unit 102 respectively, and is used to supply power to the first communication unit 103, the first control unit 101 and the first programmable logic unit 102; wherein the second power supply module 205 is electrically connected to the second communication unit 203, the second control unit 201 and the second programmable logic unit 202 respectively, and is used to supply power to the second communication unit 203, the second control unit 201 and the second programmable logic unit 202.

[0099] The first power module 105 and the second power module 205 are used to perform voltage conversion and provide various voltage inputs to the first control board 10. The first control board 10 is connected to a 24VDC power supply through a baseboard connector and has two power channels.

[0100] The power modules for both power channels operate on the same principle. The power allocation for one of the channels is explained below: First, to ensure the independence of the two channels on the first control board 10, an isolated power module with an output voltage of 12VDC is used when the 24V power supply is connected to both channels. Second, the 12VDC±2% power output from the isolated power module is processed by three power chips to output 5VDC±5%, 3.3VDC±5%, and 1.2VDC, meeting the operational needs of subsequent chips. Third, the 1.2VDC±3% voltage is used by the FPGA and MCU. Fourth, the 3.3VDC±5% power supply is used by the MCU. Fifth, the 5VDC is converted to 2.5VDC±1% for the FPGA. Sixth, the 5VDC power supply mainly powers the communication isolation chip on the control board.

[0101] The 24V power isolation module has an isolation withstand voltage of 2KVDC and can provide a maximum power of 6W. The power consumption of each channel of the first control board 10 does not exceed 4W. The power module can meet the power supply requirements of the first control board 10 across its entire operating temperature range. Additionally, a 5V power supply is provided for communication and signal transmission between the isolated devices and other modules, and is directly used on the first control board 10. A 0.5A fast-blow fuse is connected in series with the 24V input power supply for overcurrent protection. The power module does not have a switch enable and automatically supplies power upon power-up.

[0102] In some embodiments, please continue reading Figure 3 The first control module 100 further includes a first clock unit 106; the second control module 200 further includes a second clock unit 206; wherein the first clock unit 106 is electrically connected to the first programmable logic unit 102; and the second clock unit 206 is electrically connected to the second programmable logic unit 202.

[0103] The first clock unit 106 and the second clock unit 206 are used to provide a time reference for the system.

[0104] The first clock unit 106 and the second clock unit 206 can be real-time clock chips.

[0105] Figure 11 This is a block diagram of the RTC unit provided in the embodiments of this application. For example, see [link to relevant documentation]. Figure 11 The RTC uses a real-time clock chip, with a 32.768K crystal oscillator providing real-time pulses. A battery powers the real-time clock chip, which is connected to the FPGA via I2C.

[0106] In some embodiments, please continue reading Figure 3The first control module 100 further includes a first display unit 107; the second control module 200 further includes a second display unit 207; wherein the first display unit 107 is electrically connected to the first control unit 101; and the second display unit 207 is electrically connected to the second control unit 201.

[0107] The first display unit 107 and the second display unit 207 are used to control the status display of the board and are redundant to each other.

[0108] The first display unit 107 and the second display unit 207 can be display devices or equipment such as LED lights.

[0109] Figure 12 This is a block diagram of the display unit provided in the embodiments of this application. For example, see [link to relevant documentation]. Figure 12 The display unit is used to control the status display of the control board. The display unit mainly consists of two groups of six LEDs each, for a total of 12 LEDs. Each group includes five LEDs for channel indicator lights to control the board's operating status and one power indicator light.

[0110] Figure 13 This is a schematic diagram of the structure of a control board provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 13 The control board adopts a 2oo2D architecture. To meet functional safety design requirements and API 17F standard recommendations, the control board is designed according to a redundant hardware architecture. The schematic diagram is as follows. Figure 13 As shown, to identify failures causing errors in the processing unit results, data exchange (including results, intermediate results, and test data) between the two processing units, core0 and core1, is used to detect failures in the processing unit as early as possible. CPU0 / CPU1 sends the exchange data to FPGA0 / FPGA1, and the data exchanged between them is then sent back to their respective connected CPUs. The data exchange between FPGA0 and FPGA1 includes synchronization lines and communication lines, which are isolated for synchronization and data exchange between the two channels. The control board CPU sends the hard-wired signals and communication messages between the two modules to its local FPGA via the EMIF bus. The FPGA forwards the signals and messages to the peer FPGA via a direct-connect serial bus to achieve synchronization between Core 0 and Core 1. CPU0 and CPU1 are the first control unit 101 and the second control unit 201, respectively, and FPGA0 and FPGA1 are the first programmable logic unit 102 and the second programmable logic unit 202, respectively.

[0111] The control board can be divided into the following units according to its function: power supply unit, CPU unit, FPGA unit, CAN_FD communication isolation unit, CAN communication isolation unit, DBG_UART unit, display unit, RTC unit, dual-channel isolation unit, and temperature monitoring unit, etc.

[0112] According to functional safety requirements, control board failures are categorized into critical and general failures. Critical failures include: abnormal voltage, temperature, memory, stack, registers, and instruction operations of the processor itself, as well as application calls to crash functions. General failures include: communication link anomalies, abnormal received data verification, and all other failures that do not affect safety control and computation, excluding critical failures. The main control board should have a restart function after a failure. During restart, a startup self-test should be performed. If the self-test passes, it is allowed to enter the normal cycle operation state. If the self-test fails, the main control board enters a safe state. In the safe state, the main control board stops receiving and sending data from external sources and is prohibited from automatic restart. The operation of the control board is divided into two phases: the initialization phase and the cycle operation phase. During startup, the control board performs self-tests, including monitoring and testing the control board voltage and temperature, checking the status of each configured functional board, and checking the system memory, processor registers, and instructions. If the checks fail, the system outputs a fault message and crashes. During stable operation, periodic self-checks are required, including self-checks of control board voltage and temperature monitoring, checks on the status of each configured functional module, and checks on system memory, processor registers, and instructions. If a check fails, the system outputs a fault message and crashes. The minimum operating cycle is 50ms. Within one operating cycle, the following tasks must be completed sequentially: input data parsing, logical processing and security comparison, control data transmission, inter-system synchronization, primary / backup status and dual-system switchover judgment. During the periodic operation phase, the control board uses a hardware watchdog with a time window (300-900ms, time window not configurable) for timeout protection. The watchdog needs to be fed periodically to ensure it does not time out under normal operating conditions.

[0113] The CPU unit, built around an embedded microprocessor, is responsible for the data communication and processing of the control board. Therefore, the CPU must meet the required communication interface resources and possess a processing power of at least 400 DMIPS. Besides data communication and processing, the CPU unit performs the following functions: 1. LED indicator control: The CPU unit controls the LED display via corresponding GPIO ports based on the control board's operating status. 2. Synchronization logic processing between two channels: The CPU units of the two channels synchronize via pulse handshake during operation. 3. Reading voltage values ​​on the board: The CPU has two built-in ADC modules with 10-bit accuracy, using the ADCs to collect all operating voltages on the circuit board and sending the converted values ​​back to the CPU for processing. 4. Reading temperature signals from the control board: The CPU has a built-in I2C module, using the I2C bus to collect temperature data from a temperature sensor and process it accordingly. 5. Control board ID acquisition: The CPU unit acquires the ID number via GPIO, reading the ID information composed of a resistor network on the board for function board identification and communication address configuration. Sixth, the CPU unit supports internal resource self-testing. During system power-on and normal operation, the CPU unit performs self-tests of its internal chip functions. Seventh, an external hardware watchdog module. The CPU unit feeds the watchdog by sending periodic pulses through a pin. A watchdog chip is used to monitor CPU operation, with a delayed startup upon power-on, providing a hardware watchdog with a time window. Eighth, communication with the FPGA. The CPU unit uses an EMIF interface to exchange data with the FPGA. Ninth, data interaction with the Flash chip. An external Flash chip is connected to the CPU unit via an SPI interface for storing log data.

[0114] Figure 14 This is a schematic diagram of a partial peripheral circuit of the CPU provided in an embodiment of this application. For example, see [link to relevant documentation]. Figure 14 It is connected to the FLASH chip U1 via the CPU's SPI pin for storing log data. The FLASH chip U1 is an SPI FLASH chip with a storage capacity of 512Mb.

[0115] Figure 15 This is a schematic diagram of the CPU local peripheral circuit two provided in the embodiments of this application. For example, see [link to relevant documentation]. Figure 15 It connects to the temperature sensor U2 via the CPU's I2C bus to collect temperature data and perform corresponding processing.

[0116] Figure 16 This is a schematic diagram of the CPU local peripheral circuit three provided in the embodiments of this application. For example, see [link to relevant documentation]. Figure 16The CPU's EMIF bus is used to realize information exchange between the CPU and the FPGA.

[0117] The FPGA unit and CPU unit exchange data via an external bus EMIF. Isolation is used for synchronization and data exchange between the two FPGA channels. Power status detection is also included. The main functions of the FPGA unit include: data communication between the FPGA and CPU units via the EMIF bus; matching resistors are designed on the address and data lines to ensure signal integrity; the FPGA unit provides Clear and Reset signals to the CPU unit; high-level signals are received by these two pins after power-on, serving as clear and reset signals for the internal logic of the FPGA unit; the FPGA unit receives GPIO signals from the CPU unit for synchronization between the two CPUs; and synchronization and data exchange between the two FPGA channels. The FPGA unit also has synchronization and communication lines between the two channels, which are isolated for synchronization and data exchange. In dual-mode communication, the CPU communicates with the FPGA via the EMIF, and the FPGA communicates with the peer FPGA via a serial port; the FPGA performs pass-through.

[0118] The FPGA hardware function-related circuits mainly include the FPGA chip, configuration chip, and RTC module. The two crystal oscillators are 20MHz and 30MHz respectively, and after passing through a PLL, they provide independent clocks for the logic channels in the FPGA.

[0119] Figure 17 This is a schematic diagram of a partial peripheral circuit of an FPGA provided in this embodiment. For example, the FPGA configuration chip U3 uses an EPCS16SI8N. Figure 17 The peripheral circuitry of the FPGA configuration chip U3 using the EPCS16SI8N is shown.

[0120] Figure 18 This is a schematic diagram of the second local peripheral circuit of the FPGA provided in this embodiment. For example, Figure 18 The synchronization and communication lines of the FPGA are isolated and used for synchronization and data exchange between the two channels.

[0121] Furthermore, the interface definitions of this control board are shown in Table 1. For example, the analog input board uses a 53-pin connector on the back, as specifically defined in Table 1.

[0122] Table 1 Interface Definition

[0123]

[0124] For example, in the technical solution of this application embodiment, the control board is applied in the HT-SKE500 safety controller for subsea production trees, and is mainly used for the analysis and processing of data collected by modules such as AI, DI, RS485, and CAN communication within the system, as well as the drive control of the DO board and other functions.

[0125] Figure 19 This is a diagram showing the composition and connection relationships of the HT-SKE500 safety controller module provided in this embodiment. For example, see [link to relevant documentation]. Figure 19 The safety controller adopts a redundant A and B series structure, that is, the internal structure of the A and B series is consistent, and it adopts a single internal structure, consisting of a control board, AI board, DI board, DO board, CAN communication board and RS485 communication board.

[0126] The control board provided in this embodiment adopts a 2oo2D architecture and mainly performs application logic processing, secure comparison of logic operation results, and secure processing of input and output data. It provides parameter configuration and logic configuration functions. The module has built-in diagnostic testing and an independent watchdog timer. Faults do not affect the operation of other channels. Two CAN_FD interfaces are used for communication with other electronic modules within the SEM. This CAN_FD bus must meet functional safety requirements and have high-speed communication capabilities.

[0127] The following are the functions of the control board:

[0128] Firstly, regarding the power supply function, the control board receives two 24VDC power supplies to power its internal logic circuits. The power input range is 16.8V~32V. The 24VDC power supply to the control board requires an additional fuse to prevent damage caused by internal short circuits. If either power supply fails and no power is provided, the other power supply should still support the normal operation of the control board, and the control board should not restart due to power fluctuations when switching from dual power supplies to single power supplies.

[0129] Second, regarding the user interface, the control board provides a crash interface function to the application software. This function should be able to send the crash reason to the logging module before the crash occurs. The control board also provides an application program execution interface to the application software. Furthermore, the control board provides communication interface functions between the control board and various functional boards within the department. Finally, the control board provides application data transfer interface functions between control boards within the department.

[0130] Thirdly, the system supports the application's business logic cycle operation via the control board, with a system timing accuracy of 1ms. The control board has a startup self-test capability. During startup, it should monitor the processor's voltage and temperature, and perform tests on memory, stack, registers, and instructions. It should also respond to faults detected during the self-test.

[0131] The control board has a periodic self-test capability during operation. During periodic operation, it should monitor the processor's voltage and temperature, periodically check the status of functional boards, and periodically self-test the memory, stack, registers, and instructions. Fault response should be initiated when a fault occurs during self-test.

[0132] The control board should have a fault recovery function. During restart, a self-test should be performed. If the self-test passes, the board is allowed to enter normal cycle operation. If the self-test fails, the control board enters a safe state. In the safe state, the control board stops receiving and sending data from external sources and is prohibited from automatic restart.

[0133] The control board has a hardware watchdog with a time window to monitor the system processing cycle.

[0134] The control board should have a real-time clock (RTC) and support the configuration and reading functions of the real-time clock.

[0135] Fourthly, regarding intra-system communication, the control board has two independent CAN_FD communication channels, supporting baud rates of 500kbps, 800kbps, 1Mbps, 2Mbps, and 2.5Mbps, with 1.5kV isolation protection. These two CAN_FD communication channels are redundant, and the control board should communicate with other functional boards through these two channels.

[0136] Each control board should have a configurable ID, serving as the ID address for CAN_FD, to identify different control boards. Intra-system communication between the control board and various functional boards should have a unified protocol link layer above the redundant two-channel physical communication layer of CAN_FD. Once the protocol link layer connection is successful, the control board can communicate with other functional boards. The failure of one of the two CAN_FD communication channels on the control board should not affect the protocol link layer communication status or the communication link itself. The frame loss rate between the control board and various functional boards should be less than 0.1%.

[0137] Fifth, regarding inter-system communication and switching, the two control boards in both systems employ dual-redundant CAN communication, supporting baud rates (125kbps, 250kbps, 500kbps, and 1Mbps) and 1.5kV isolation protection. Each control board has a configurable ID, which serves as the CAN ID address to identify different control boards. The master / standby status of the dual-system control boards is determined based on: the communication status between the two systems, the master / standby status of the other system, and the CAN ID size of both systems. In the redundant communication between control boards, a failure of one communication channel should not affect the protocol link layer communication status or the communication link itself.

[0138] Redundant communication between control boards should include their own CAN ID, their own primary / backup status, and cycle time information, along with a security checksum. If the time, CAN ID, or security checksum exceeds tolerance limits or fails verification during the verification process, the message is discarded. The receiving board considers the message unreceived.

[0139] Before a control board in a certain department fails and restarts or crashes, it needs to send this information to the control board in the other department via redundant inter-department CAN communication. If the faulty board is the primary system, the original standby system's control board, upon receiving the message, should remain in standby mode during the current processing cycle and become the primary system at the start of the next processing cycle. If the faulty board is the standby system, the primary / standby status of the primary system's control board remains unchanged.

[0140] During operation, if the standby control board does not receive a fault restart or crash message from the primary control board, and also does not receive a periodic synchronization message from the primary control board, it will be promoted to primary after tolerating three consecutive cycles of communication loss, and will simultaneously provide the application with an indicator of this promotion. If a valid control board message is received again within the tolerance period, the standby system will remain unchanged. The frame loss rate between the two control boards should be less than 0.1%.

[0141] Sixth, the control board has two RS485 communication interfaces to connect to external systems, supports baud rate configuration (configuration range is 1200 to 115200bps), and has 1.5kV isolation protection.

[0142] The control board's RS485 communication supports the Modbus RTU protocol. The two communication ports are independent and can use the Modbus RTU protocol by configuring the serial port addresses.

[0143] The control board has two 10M / 100M Ethernet communication channels for connecting to external systems and features 1.5kV isolation protection.

[0144] Each Ethernet communication channel of the control board is independent, and each port can use the Modbus TCP protocol by configuring an IP address.

[0145] As a transparent transmission channel for upper-layer application messages, Type I RS485 and Ethernet have no security requirements; the specific implementation of security for upper-layer data messages is completed by the application layer protocol.

[0146] The frame loss rate of the control board's external RS485 and Ethernet communication should be less than 0.1%.

[0147] Therefore, the control board provided in this application supports redundant power input and has high reliability. Adopting a 2oo2D configuration, it offers enhanced security. It features two Ethernet interfaces, two RS485 communication interfaces, and two CAN_FD interfaces. The module includes built-in diagnostic testing and an independent watchdog timer, and has temperature detection capabilities. This completes the domestic development of the safety controller control board.

[0148] Accordingly, this application also provides a safety controller, which includes the redundant control system for the safety controller described in any embodiment of this application.

[0149] Accordingly, this application also provides a subsea production tree, which includes the safety controller described in any embodiment of this application.

[0150] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0151] The redundant control system, safety controller, and subsea wellhead provided in the embodiments of this application have been described in detail above, and specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the technical solutions and core ideas of this application. Those skilled in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A redundant control system for a safety controller, characterized in that, Applications include underwater operations of underwater wellhead safety controllers; The system includes at least: a first control board, a second control board, a first CAN communication channel, and a second CAN communication channel; wherein the first control board and the second control board exchange information through the first CAN communication channel and the second CAN communication channel; the first control board and the second control board have the same structure and are redundant with each other; The first control board includes a first control module, a second control module, and a dual-channel isolation module. The first control module and the second control module are electrically connected through the dual-channel isolation module, and data comparison, verification, and information synchronization between the first control module and the second control module are performed through the dual-channel isolation module. The first control module includes a first control unit and a first programmable logic unit. The second control module includes a second control unit and a second programmable logic unit. The first control unit and the first programmable logic unit are electrically connected, and the second control unit and the second programmable logic unit are electrically connected. The first programmable logic unit is electrically connected to the second programmable logic unit. The first programmable logic unit and the second programmable logic unit exchange data and synchronize information through the dual-channel isolation module. The dual-channel isolation module completes the isolation of dual-channel data exchange and synchronization. The first control module and the second control module are redundant with each other, the first control unit and the second control unit are redundant with each other, and the first programmable logic unit and the second programmable logic unit are redundant with each other.

2. The redundant control system for a safety controller according to claim 1, characterized in that, The first control module further includes a first communication unit, and the second control module further includes a second communication unit; The first communication unit is electrically connected to the first control unit and the first programmable logic unit, respectively; The second communication unit is electrically connected to the second control unit and the second programmable logic unit, respectively.

3. The redundant control system for a safety controller according to claim 2, characterized in that, The first communication unit includes a first CAN_FD communication isolation unit and a first CAN communication isolation unit; the second communication unit includes a second CAN_FD communication isolation unit and a second CAN communication isolation unit. Both the first CAN_FD communication isolation unit and the first CAN communication isolation unit are electrically connected to the first control unit; Both the second CAN_FD communication isolation unit and the second CAN communication isolation unit are electrically connected to the second control unit.

4. The redundant control system for a safety controller according to claim 2, characterized in that, The first communication unit further includes a first serial communication unit; the second communication unit further includes a second serial communication unit; the first serial communication unit is electrically connected to the first control unit and the first programmable logic unit respectively; the second serial communication unit is electrically connected to the second control unit and the second programmable logic unit respectively.

5. The redundant control system for a safety controller according to claim 2, characterized in that, The first communication unit further includes a first printing debugging unit; the second communication unit further includes a second printing debugging unit; The first printing debugging unit is electrically connected to the first control unit, and the second printing debugging unit is electrically connected to the second control unit.

6. The redundant control system for a safety controller according to claim 1, characterized in that, The first control module further includes a first operating status monitoring unit; the second control module further includes a second operating status monitoring unit. The first operating status monitoring unit is electrically connected to the first control unit, and the first operating status monitoring unit is used to monitor the operating status information of the first control unit and send it to the first control unit. The second operating status monitoring unit is electrically connected to the second control unit. The second operating status monitoring unit is used to monitor the operating status information of the second control unit and send it to the second control unit.

7. The redundant control system for a safety controller according to claim 6, characterized in that, The first operating status monitoring unit includes a first temperature monitoring unit; the second operating status monitoring unit includes a second temperature monitoring unit; The first temperature monitoring unit is electrically connected to the first control unit, and the first temperature monitoring unit is used to monitor the temperature of the first control unit and send it to the first control unit; The second temperature monitoring unit is electrically connected to the second control unit, and the second temperature monitoring unit is used to monitor the temperature of the second control unit and send it to the second control unit.

8. The redundant control system for a safety controller according to claim 2, characterized in that, The first control module further includes a first power supply module; the second control module further includes a second power supply module. The first power module is electrically connected to the first communication unit, the first control unit, and the first programmable logic unit, respectively, and is used to supply power to the first communication unit, the first control unit, and the first programmable logic unit. The second power module is electrically connected to the second communication unit, the second control unit, and the second programmable logic unit, respectively, and is used to supply power to the second communication unit, the second control unit, and the second programmable logic unit.

9. The redundant control system for a safety controller according to claim 1, characterized in that, The first control module further includes a first clock unit; the second control module further includes a second clock unit. The first clock unit is electrically connected to the first programmable logic unit; the second clock unit is electrically connected to the second programmable logic unit.

10. The redundant control system for a safety controller according to claim 1, characterized in that, The first control module further includes a first display unit; the second control module further includes a second display unit. The first display unit is electrically connected to the first control unit; the second display unit is electrically connected to the second control unit.

11. A safety controller, characterized in that, Includes a redundant control system for a safety controller as described in any one of claims 1-10.

12. A subsea oil production tree, characterized in that, Includes the security controller as described in claim 11.

Images