Safety type input and output control panel
By designing a safe input and output control board with a fully 2-bit hardware circuit and a dual CPU independent power supply, the problem of incomplete independence of hardware circuits in the prior art is solved, the reliability and availability of the system are improved, and the fault-oriented safety policy is realized through self-diagnosis function.
Patent Information
- Application Number
- CN202411753186.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-02
- Publication Date
- 2025-03-28
AI Technical Summary
In existing computer interlocking systems, the hardware circuit with a 2-by-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2-to-2
A safe input and output control board is designed, using a completely 2-bit hardware circuit and dual CPUs to independently power supply, and ensuring the reliability of safe power output through a safety AND gate control circuit and an overvoltage and undervoltage monitoring circuit. Use the 2-take 2-current limiting output channel circuit and the dynamic acquisition channel circuit with self-diagnosis function to realize the fault-oriented safety policy.
It improves the reliability of the redundant structure, reduces engineering wiring restrictions, ensures the reliability of safe power output, and implements a fault-oriented safety strategy through self-diagnosis function, improving the reliability and availability of the board.
Smart Images
Figure CN119717604A_ABST
Abstract
Description
Technical Field
[0001] This document relates to the field of computer technology, and more particularly to a safety-type input and output control board. Background Art
[0002] At present, the rail transit field uses a large number of computer interlocking systems to ensure the safety of trains and shunting operations in stations; the system has a 2x2-out-of-2 redundant structure, and the AB system is two independent 2-out-of-2 subsystems, each of which has two independent central processing units. The two central processing units are strictly synchronized and the processing results are compared interactively from time to time. When the two central processing units vote in agreement, the operation results are output externally, otherwise the system will be down and the backup system will be activated; the 2x2-out-of-2 redundant structure greatly improves the reliability and availability of the computer system; the 2-out-of-2 safety input and output control board plays a key role in the interlocking system and must meet the system's 2x2-out-of-2 redundant structure requirements. As a 2-out-of-2 redundant structure, it should have completely independent hardware circuits and software logic in terms of communication, power supply, output control, and input acquisition; the current related technologies have problems such as incomplete independence of hardware circuits. Summary of the invention
[0003] The purpose of the present invention is to provide a safe input and output control board, aiming to solve the above-mentioned problems in the prior art.
[0004] The present invention provides a safety input and output control board, comprising:
[0005] The first CPU and the second CPU are connected to the computer interlocking host, the safety AND gate circuit, the input channel and the output channel respectively, and are used to control the safety AND gate circuit and the input channel, and perform collection control of the input channel, perform interactive voting on the collection results of the two CPUs, judge whether the input channel is normal according to whether they are consistent, and perform clock synchronization of the two CPUs through the clock synchronization channel;
[0006] A safety AND gate circuit, the input end of which is respectively connected to the first CPU and the second CPU, and the output end of which is connected to the safety power supply module, and is used to process the isolated 24V DC based on the control of the first CPU and the second CPU to supply power to the power supply module;
[0007] The power module is connected to the safety AND gate circuit and the output channel, and is used to generate a safety power supply through the PWM chip, and determine whether the safety power supply is normal. If it is normal, it supplies the output channel. If it is abnormal, the board shuts off the safety power supply and shuts down to the safety side;
[0008] An output channel connected to the power module, the first CPU and the second CPU, for current limiting under the control of the first CPU, controlling the on and off of the MOSFET under the control of the second CPU, and outputting the safety power to an external output interface;
[0009] The input channel is connected to the first CPU and the second CPU, and is used for performing independent dynamic acquisition of the dual CPUs, and feeding back the acquisition results to the first CPU and the second CPU.
[0010] The embodiment of the present invention adopts a complete 2-out-of-2 hardware circuit, dual CPU independent power supply, and independent operation control of the output channel and input channel to improve the reliability of the redundant structure and reduce engineering wiring restrictions. The safety and gate control circuit and the overvoltage and undervoltage monitoring circuit are used to ensure the reliability of the safe power supply output. The 2-out-of-2 current limiting output channel circuit with self-diagnosis function and the dynamic acquisition channel circuit with self-diagnosis function are used to implement the fault-oriented safety strategy, thereby improving the reliability and availability of the board. BRIEF DESCRIPTION OF THE DRAWINGS
[0011] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0012] Figure 1 is a schematic structural diagram of a safety input and output control board according to an embodiment of the present invention;
[0013] Figure 2 is a schematic diagram of a safety door and a safety power supply according to an embodiment of the present invention;
[0014] Figure 3 is a schematic diagram of an output channel of an embodiment of the present invention;
[0015] Figure 4 Schematic diagram of an input channel according to an embodiment of the present invention. DETAILED DESCRIPTION
[0016] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.
[0017] According to an embodiment of the present invention, a safety input and output control board is provided. Figure 1 Schematic diagram of a safety input and output control board according to an embodiment of the present invention. Figure 1 As shown, the safety input and output control board according to the embodiment of the present invention specifically includes:
[0018] The first CPU 10 and the second CPU 11 are connected to the computer interlocking host, the safety AND gate circuit, the input channel and the output channel respectively, and are used to control the safety AND gate circuit and the input channel, and perform collection control of the input channel, perform interactive voting on the collection results of the dual CPUs, judge whether the input channel is normal according to whether they are consistent, and perform clock synchronization of the dual CPUs through the clock synchronization channel; specifically used for:
[0019] Dynamic signals are respectively sent to the safety AND gate circuit, the first CPU output channel control signal and the second CPU output channel control signal are respectively sent to the output channel, the first dynamic acquisition signal and the second dynamic acquisition signal are sent to the input channel, and the first dynamic input acquisition signal and the second dynamic input acquisition signal are received from the input channel. The results collected from the input channel are subjected to interactive voting of dual CPU acquisition results through SPI communication. After the vote is consistent, the input is determined to be valid and uploaded to the computer interlocking host. If the interactive voting of dual CPU acquisition results is inconsistent, the board determines that the input channel is abnormal, the board crashes and is directed to the safety side, and the clock synchronization of the dual CPUs is performed through the clock synchronization channel.
[0020] The first CPU and the second CPU are further used to: send a first CPU output channel control recovery signal and a second CPU output channel control recovery signal to the output channel respectively;
[0021] The safety AND gate circuit 12 has input ends connected to the first CPU and the second CPU respectively, and an output end connected to the safety power supply module, and is used to process the isolated 24V DC based on the control of the first CPU and the second CPU to supply power to the power supply module; specifically used for:
[0022] Receive dynamic signals sent by the first CPU and the second CPU, control the on and off of the isolated gate driver based on the dynamic signals, so that the isolated 24V DC power forms a square wave signal, transform the square wave signal through a transformer, and then generate a stable DC power supply through a rectifier and filter circuit, and input the DC power supply into the safety power supply module to power the PWM chip therein.
[0023] The power module 13 is connected to the safety AND gate circuit and the output channel, and is used to generate a safety power supply through the PWM chip, and determine whether the safety power supply is normal. If it is normal, it supplies the output channel. If it is abnormal, the board shuts off the safety power supply and shuts down to the safety side; specifically used for:
[0024] The PWM chip generates a pulse control signal with the same frequency and opposite phase to control the MOS push-pull circuit, and then generates a safety power supply through a transformer. The safety power supply is rectified and filtered by a rectifier and filter circuit, and then supplied to the output channel when it is determined to be normal by a voltage-undervoltage circuit. When it is determined to be abnormal by a voltage-undervoltage circuit, the board shuts off the safety power supply and shuts down to the safety side.
[0025] The output channel 14 is connected to the power module, the first CPU and the second CPU, and is used to limit the current under the control of the first CPU, control the on and off of the MOSFET under the control of the second CPU, and output the safe power to the external output interface; specifically used for:
[0026] The PWM chip generates a pulse control signal with the same frequency and opposite phase to control the MOS push-pull circuit, and then generates a safety power supply through a transformer. The safety power supply is rectified and filtered by a rectifier and filter circuit, and then supplied to the output channel when it is determined to be normal by a voltage-undervoltage circuit. When it is determined to be abnormal by a voltage-undervoltage circuit, the board shuts off the safety power supply and shuts down to the safety side.
[0027] The output channel 14 is further used for: the first CPU and the second CPU respectively perform periodic sampling of the first CPU output channel control signal and the second CPU output channel control signal, and perform self-diagnosis by performing logical judgment on the sampling results. When the self-diagnosis is abnormal, the board shuts off the safety power supply and shuts down to the safety side.
[0028] The input channel 15 is connected to the first CPU and the second CPU, and is used for performing independent dynamic acquisition of the dual CPUs, and feeding back the acquisition results to the first CPU and the second CPU. Specifically used for:
[0029] A dynamic acquisition hardware circuit is used to receive a first dynamic acquisition signal from the first CPU and a second dynamic acquisition signal from the second CPU, perform independent dynamic acquisition on both CPUs, and feed back the acquisition results to the first CPU and the second CPU via a first dynamic input acquisition signal and a second dynamic input acquisition signal.
[0030] The safety input and output control board of the embodiment of the present invention further comprises:
[0031] A first isolated power supply 16, connected to the first CPU and the first conversion unit, for converting a 24V power supply into a 3.3V power supply, and supplying power to the first CPU through a first VCCIO channel;
[0032] The second isolated power supply 17 is connected to the second CPU and the second converted power supply, and is used for converting the 24V power supply into a 3.3V power supply, and supplies power to the second CPU through the second VCCIO channel.
[0033] 10. The safety input-output control board according to claim 9, further comprising:
[0034] A first conversion power supply 18, connected to the first CPU, for converting a 3.3V power supply into a 1.2V power supply, and supplying power to the first CPU through a first VCC channel;
[0035] The second conversion power supply 19 is connected to the second CPU and is used for converting the 3.3V power supply into a 1.2V power supply and supplying power to the second CPU through a second VCC channel.
[0036] The above technical solution of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings.
[0037] like Figure 1 As shown, in the embodiment of the present invention, the 2-out-of-2 safety input and output control board is an object control and status monitoring module of the computer interlocking system, which is used for trackside equipment control in the field of rail transportation control, and includes two independent CPUs ( Figure 1 Part5, part6), safe 24V power supply ( Figure 1 Part 7), dual-machine communication circuit ( Figure 1 Part 10), clock synchronization circuit ( Figure 1 part11), drive circuit, that is, output channel ( Figure 1 Part 8), acquisition circuit, i.e. input channel ( Figure 1 part9).
[0038] The two CPUs of the 2-out-of-2 safety input and output control board use mutually isolated power supplies; the dual CPUs communicate with the computer interlocking host through independent communication channels; the dual CPUs output dynamic signals to drive the safety AND gate circuit ( Figure 1 part11) to power the PWM chip; push-pull safety power supply outputs a stable 24V drive power supply; the input channel uses dual CPU independent dynamic acquisition method ( Figure 4 ), the output channel uses dual CPU two-level independent control mode ( Figure 3 ); The dual CPUs exchange the calculation results in real time through dual-machine SPI communication ( Figure 1 Part 10), when the interactive voting is unanimous, the result will be output to the computer interlocking host.
[0039] 2-out-of-2 safety input and output control board has fault self-diagnosis function and fault-oriented safety strategy; always monitor the quality of safe 24V power output ( Figure 2 ), when the safety power supply output is abnormal, its output is shut down and directed to the safety side. The output channel periodic self-check ensures the normal operation of the channel components; when the channel components are abnormal, the board will shut down and direct to the safety side; the input channel adopts dynamic acquisition, when the channel components are abnormal, the board will shut down and direct to the safety side.
[0040] like Figure 2 As shown, the safety AND gate and safety 24V power supply circuit: the safety AND gate circuit is controlled by the dynamic signal output by CPU1-IO11 and CPU2-IO11 to control the isolated gate driver to turn on and off, so that the isolated 24V DC forms a square wave signal. The square wave signal is rectified and filtered by the transformer to generate a stable DC power supply to power the PWM chip in the safety 24V power supply circuit. The PWM chip generates a pulse control signal with the same frequency and opposite phase to control the MOS push-pull circuit; then it is transformed into a safe +24V power supply through the transformer. When this power supply is judged to be normal by the undervoltage circuit, it is supplied to the drive circuit. When the overvoltage and undervoltage circuit judges to be abnormal, the board shuts down the safety 24V power supply and shuts down to the safety side.
[0041] like Figure 3 The circuit of 2-out-of-2 current-limited output channels with self-diagnosis function shown in the figure: 16 output channels need to be controlled by CPU1-OUT[16..1] and CPU2-OUT[16..1] in a 2-out-of-2 manner. CPU1-OUT[16..1] controls the switch circuit with current-limiting function after being isolated by optocouplers, and each channel has a current limit of 100mA; CPU2-OUT[16..1] controls the on-off of MOSFET after being isolated by optocouplers; after the switch circuit with current-limiting function and MOSFET two-stage dual CPU control, the safe +24V power supply is supplied to the external output interface; the dual CPUs periodically sample the control signal through CPU1-IN[16..1] and CPU2-IN[16..1], and realize the self-diagnosis function by performing logical judgment on the driving result of the control signal. When the self-diagnosis judgment is abnormal, the board shuts off the safe 24V power supply and shuts down to the safe side.
[0042] The output channel truth table is as follows:
[0043] Table 1
[0044]
[0045]
[0046] like Figure 4As shown in the figure, the dynamic acquisition channel circuit with self-diagnosis function: 32 input channels adopt dynamic acquisition hardware circuit, and the same channel is independently dynamically acquired by dual CPUs. The acquired results are interactively voted by the dual CPUs through SPI communication. After the vote is unanimous, the input is determined to be valid and uploaded to the computer interlocking host; if the acquisition results of the dual CPUs are inconsistent, the board determines that the acquisition channel is abnormal, and the board crashes and leads to the safety side.
[0047] In summary, with the help of the technical solution of the embodiment of the present invention, a complete 2-out-of-2 hardware circuit, independent power supply of dual CPUs, and independent operation and control of output channels and input channels are adopted to improve the reliability of the redundant structure and reduce engineering wiring restrictions. The safety and gate control circuit and the overvoltage and undervoltage monitoring circuit are used to ensure the reliability of the safe power supply output. The 2-out-of-2 current limiting output channel circuit with self-diagnosis function and the dynamic acquisition channel circuit with self-diagnosis function are used to implement the fault-oriented safety strategy and improve the reliability and availability of the board.
[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A safety input and output control board, characterized in that: include: The first CPU and the second CPU are connected to the computer interlocking host, the safety AND gate circuit, the input channel and the output channel respectively, and are used to control the safety AND gate circuit and the input channel, and perform collection control of the input channel, perform interactive voting on the collection results of the two CPUs, judge whether the input channel is normal according to whether they are consistent, and perform clock synchronization of the two CPUs through the clock synchronization channel; A safety AND gate circuit, the input end of which is respectively connected to the first CPU and the second CPU, and the output end of which is connected to the safety power supply module, and is used to process the isolated 24V DC based on the control of the first CPU and the second CPU to supply power to the power supply module; The power module is connected to the safety AND gate circuit and the output channel, and is used to generate a safety power supply through the PWM chip, and determine whether the safety power supply is normal. If it is normal, it supplies the output channel. If it is abnormal, the board shuts off the safety power supply and shuts down to the safety side; An output channel connected to the power module, the first CPU and the second CPU, for current limiting under the control of the first CPU, controlling the on and off of the MOSFET under the control of the second CPU, and outputting the safety power to an external output interface; The input channel is connected to the first CPU and the second CPU, and is used for performing independent dynamic acquisition of the dual CPUs, and feeding back the acquisition results to the first CPU and the second CPU.
2. The safety input and output control board according to claim 1, characterized in that: The first CPU and the second CPU are specifically used for: Dynamic signals are respectively sent to the safety AND gate circuit, the first CPU output channel control signal and the second CPU output channel control signal are respectively sent to the output channel, the first dynamic acquisition signal and the second dynamic acquisition signal are sent to the input channel, and the first dynamic input acquisition signal and the second dynamic input acquisition signal are received from the input channel. The results collected from the input channel are subjected to interactive voting of dual CPU acquisition results through SPI communication. After the vote is consistent, the input is determined to be valid and uploaded to the computer interlocking host. If the interactive voting of dual CPU acquisition results is inconsistent, the board determines that the input channel is abnormal, the board crashes and is directed to the safety side, and the clock synchronization of the dual CPUs is performed through the clock synchronization channel.
3. The safety input and output control board according to claim 1, characterized in that: The safety and gate circuit is specifically used for: Receive dynamic signals sent by the first CPU and the second CPU, control the on and off of the isolated gate driver based on the dynamic signals, so that the isolated 24V DC power forms a square wave signal, transform the square wave signal through a transformer, and then generate a stable DC power supply through a rectifier and filter circuit, and input the DC power supply into the safety power supply module to power the PWM chip therein.
4. The safety input / output control board according to claim 1, characterized in that: The power module is specifically used for: The PWM chip generates a pulse control signal with the same frequency and opposite phase to control the MOS push-pull circuit, and then generates a safety power supply through a transformer. The safety power supply is rectified and filtered by a rectifier and filter circuit, and then supplied to the output channel when it is determined to be normal by a voltage-undervoltage circuit. When it is determined to be abnormal by a voltage-undervoltage circuit, the board shuts off the safety power supply and shuts down to the safety side.
5. The safety input and output control board according to claim 1, characterized in that: The output channels are specifically used for: 2-out-of-2 control is performed through the first CPU output channel control signal and the second CPU output channel control signal. The first CPU output channel control signal is received, and after optical coupling isolation, a switch circuit with a current limiting function is controlled to limit the current of each current limit. The second CPU output channel control signal is received, and after optical coupling isolation, the MOSFET is controlled to be turned on and off. After the two-stage dual CPU control of the switch circuit with a current limiting function and the MOSFET, the safety power supply is output to the external output interface.
6. The safety input and output control board according to claim 1, characterized in that: The input channels are specifically used for: A dynamic acquisition hardware circuit is used to receive a first dynamic acquisition signal from the first CPU and a second dynamic acquisition signal from the second CPU, perform independent dynamic acquisition on both CPUs, and feed back the acquisition results to the first CPU and the second CPU via a first dynamic input acquisition signal and a second dynamic input acquisition signal.
7. The safety input-output control board according to claim 1, characterized in that: The first CPU and the second CPU are further used to send a first CPU output channel control recovery signal and a second CPU output channel control recovery signal to the output channel respectively.
8. The safety input-output control board according to claim 7, characterized in that: The output channel is further used for: The first CPU and the second CPU respectively perform periodic sampling of the control signal of the first CPU output channel and the periodic sampling of the control signal of the second CPU output channel, and perform self-diagnosis by making logical judgments on the sampling results. When the self-diagnosis is abnormal, the board shuts off the safety power supply and shuts down to the safety side.
9. The safety input-output control board according to claim 1, characterized in that: Further including: A first isolated power supply, connected to the first CPU and the first conversion unit, for converting a 24V power supply into a 3.3V power supply, and supplying power to the first CPU through a first VCCIO channel; The second isolated power supply is connected to the second CPU and the second conversion power supply, and is used for converting the 24V power supply into a 3.3V power supply, and supplying power to the second CPU through a second VCCIO channel.
10. The safety input-output control board according to claim 9, characterized in that: Further including: A first conversion power supply, connected to the first CPU, for converting a 3.3V power supply into a 1.2V power supply, and supplying power to the first CPU through a first VCC channel; The second conversion power supply is connected to the second CPU and is used for converting the 3.3V power supply into a 1.2V power supply and supplying power to the second CPU through a second VCC channel.