DO module of triple modular redundant system and output voting circuit of DO module

Abstract

The embodiment of the invention discloses a DO module of a triple modular redundant system and an output voting circuit thereof, which comprises an A channel output driving circuit, a B channel output driving circuit, a C channel output driving circuit, a first controllable switch, a second controllable switch, a third controllable switch, a fourth controllable switch, a fifth controllable switch and a sixth controllable switch, the input end of each drive circuit is connected with the output end of the A channel main control unit, the output end of the B channel main control unit and the output end of the C channel main control unit. Each driving circuit controls one controllable switch, each main control unit controls one controllable switch, the six controllable switches form a two-series and three-parallel circuit structure, and when at least one group of input signals in a first group of input signals corresponding to a channel A, a second group of input signals corresponding to a channel B and a third group of input signals corresponding to a channel C are normal, the first group of input signals correspond to the channel A, the second group of input signals correspond to the channel B, and the third group of input signals correspond to the channel C; and at least one path of the two-series three-parallel circuit structure is conducted, so that a 3-2-1-0 degradation operation mode can be realized, and the safety performance of the system is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of security systems, and particularly to a DO module and its output voting circuit in a triple modular redundancy system. Background Art

[0002] The triple redundant system, abbreviated as TMR (Triple Modular Redundancy), is one of the most commonly used fault-tolerant design techniques. Three modules perform the same operation simultaneously, and the majority of the same outputs are used as the correct output of the voting system. The DO (Digital out) module in the triple redundant system is designed with three redundant and fault-tolerant channels implemented on one IO (Input / Output) board. In the prior art, the output voting circuit of the DO module is composed of a six-way drive circuit consisting of six electronic switching tubes and executes a 3-2-0 degradation operation mode. For details, please refer to Figure 1 .

[0003] Figure 1 In, A, B, and C respectively represent the 3 channels of the DO module in the triple modular redundancy system. Each channel is provided with a channel-level microprocessor uC corresponding to that channel. The output signal of the microprocessor uC of each channel is output to the CPLD (Complex Programmable Logic Device) device of the corresponding channel's output drive circuit. In this CPLD device, the signal is replicated and output in 2 copies. One copy of the output is sent to the corresponding normally open electronic switching tube, and the other copy is sent to the corresponding normally closed electronic switching tube after passing through a NOT gate. These two normally open electronic switching tubes and normally closed electronic switching tubes are respectively in different branches of the output voting circuit, as shown in Figure 1 .

[0004] Finally, the output result of the six-way drive voting circuit is:

[0005] OUT load = A&C + B&A + C&B (1)

[0006] In the formula:

[0007] A, B, and C are respectively the output signals of the output drive circuits of channel A, channel B, and channel C.

[0008] The degradation operation mode executed by the output voting circuit in the prior art is 3-2-0. It can be seen from the output result logic expression of formula (1) that when one IO channel fails, the final output channel can operate with normal power supply. For example, when A fails, the logic represented by the third term on the right side of the formula can operate with normal power supply. However, when two IO channels fail simultaneously, the final output channel will enter a power-off safety state. For example, when A and B fail, even if C is normal, the logic represented by the three terms on the right side of the formula cannot operate with normal power supply, resulting in an unplanned shutdown of the factory and thus bringing greater economic losses to users.

[0009] In view of this, how to provide a DO module of a triple modular redundant safety system and its output voting circuit to solve the above technical problems has become an issue that needs to be addressed by those skilled in the art. Summary of the Invention

[0010] The object of the present invention is to provide a DO module of a triple modular redundant safety system and its output voting circuit, which can ensure that when two IO channels fail during use, the final output channel can still operate with normal power supply, realizing a degradation operation mode of 3-2-1-0, improving the safety performance of the system, and thus largely avoiding the economic losses caused by unplanned shutdowns of the factory.

[0011] To solve the above technical problems, in the first aspect of the present invention, an output voting circuit is provided, including: a master control unit for channel A, a master control unit for channel B, a master control unit for channel C, a first controllable switch A, a second controllable switch B, a third controllable switch C, a fourth controllable switch A1, a fifth controllable switch B1, and a sixth controllable switch C1;

[0012] The first controllable switch A and the fourth controllable switch A1 are connected in series to form a first controllable unit 1, the second controllable switch B and the fifth controllable switch B1 are connected in series to form a second controllable unit (2), and the third controllable switch C and the sixth controllable switch C1 are connected in series to form a third controllable unit (3); the first controllable unit (1), the second controllable unit (2), and the third controllable unit (3) are connected in parallel and used as the output end of the output voting circuit;

[0013] The master control unit for channel A, the master control unit for channel B, and the master control unit for channel C respectively control the first controllable switch A, the second controllable switch B, and the third controllable switch C; by integrating the output signals of the master control unit for channel A, the master control unit for channel B, and the master control unit for channel C with the communication signal to the upper layer, the fourth controllable switch A1, the fifth controllable switch B1, and the sixth controllable switch C1 are respectively controlled, so that at least one of the first controllable unit, the second controllable unit, and the third controllable unit is turned on.

[0014] Preferably, the output voting circuit includes: an A-channel output driving circuit, a B-channel output driving circuit, and a C-channel output driving circuit, which are used to fuse the output signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit with the upstream communication signals;

[0015] The output end of the A-channel master control unit is connected to the input ends of the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit; the output end of the B-channel master control unit is connected to the input ends of the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit; the output end of the C-channel master control unit is connected to the input ends of the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit.

[0016] Preferably, the output signal of the A-channel output driving circuit and the A-channel master control unit is the first group of input signals, the output signal of the B-channel output driving circuit and the B-channel master control unit is the second group of input signals, and the output signal of the C-channel output driving circuit and the C-channel master control unit is the third group of input signals;

[0017] The logical OR of the three groups of input signals constitutes the output result of the voting circuit;

[0018] When at least one group of the three groups of input signals, namely the first group of input signals, the second group of input signals, and the third group of input signals, is normal, each driving circuit controls its corresponding controllable switch accordingly, so that at least one of the first controllable unit 1, the second controllable unit 2, and the controllable unit 3 is turned on.

[0019] Preferably, the output end of the A-channel master control unit is connected to the control end of the first controllable switch A, the output end of the B-channel master control unit is connected to the control end of the second controllable switch B, and the output end of the C-channel master control unit is connected to the control end of the third controllable switch C; the output end of the A-channel output driving circuit is connected to the control end of the fourth controllable switch A1, the output end of the B-channel output driving circuit is connected to the control end of the fifth controllable switch B1, and the output end of the C-channel output driving circuit is connected to the control end of the sixth controllable switch C1.

[0020] Preferably, the first controllable switch A, the second controllable switch B, the third controllable switch C, the fourth controllable switch A1, the fifth controllable switch B1, and the sixth controllable switch C1 are all PMOS transistors.

[0021] Preferably, the logics of the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit are as follows:

[0022]

[0023] In the formula:

[0024] DRIVER_A, DRIVER_B, and DRIVER_C are the output driver circuits for Channel A, Channel B, and Channel C respectively;

[0025] A, B, and C are the output signals of the master control unit for Channel A, the master control unit for Channel B, and the master control unit for Channel C respectively;

[0026] I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are the communication signals of the master control unit for Channel A, the master control unit for Channel B, and the master control unit for Channel C respectively;

[0027] "&" represents logical AND, "+" represents logical OR, and "NOT" represents logical NOT.

[0028] Preferably, the logics of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 are:

[0029]

[0030] In the formula:

[0031] A, B, and C are the output signals of the master control unit for Channel A, the master control unit for Channel B, and the master control unit for Channel C respectively;

[0032] I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are the communication signals of the master control unit for Channel A, the master control unit for Channel B, and the master control unit for Channel C respectively;

[0033] OUT_A, OUT_B, and OUT_C are the output signals of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 respectively;

[0034] "&" represents logical AND, "+" represents logical OR, and "NOT" represents logical NOT.

[0035] Preferably, the first controllable unit (1), the second controllable unit (2), and the third controllable unit (3) are respectively arranged in three pluggable modules to achieve triple modular redundancy.

[0036] Preferably, when the master control units for Channel A, Channel B, and Channel C communicate normally with the master controller A, master controller B, and master controller C, the master control units for Channel A, Channel B, and Channel C output I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok and output a logic low level. When the communication fails, a logic high level is output.

[0037] The second invention of the present invention provides a DO module for a triple modular redundant safety system, including the output voting circuit described above.

[0038] Compared with the prior art, the beneficial technical effects of the present invention at least include: by respectively controlling six controllable switches, especially by fusing the output signals of the master control units of channel A, channel B, and channel C and the communication signals with the upper layer, respectively controlling the fourth controllable switch A1, the fifth controllable switch B1, and the sixth controllable switch C1; when at least one group of input signals in each group of input signals is normal, through each driving circuit to perform corresponding control on the corresponding controllable switch, so that at least one of the first controllable unit, the second controllable unit, and the third controllable unit is turned on. To ensure that when two IO channels fail, the final output channel can still operate normally with power on, thereby realizing the 3-2-1-0 degradation operation mode, improving the safety performance of the system, and largely avoiding the economic losses caused by unplanned plant shutdowns. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the prior art and the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0040] Figure 1 FIG. 12 is a schematic structural diagram of an output voting circuit of a DO module of a triple modular redundant safety system in the prior art;

[0041] Figure 2 FIG. 16 is a schematic structural diagram of an output voting circuit applied to a DO module of a triple modular redundant safety system provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0042] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0043] An embodiment of the present invention provides a DO module of a triple modular redundant safety system and its output voting circuit. During use, it can ensure that when two IO channels fail, the final output channel can still operate normally with power on, realizing a 3-2-1-0 degradation operation mode, improving the safety performance of the system, and thus largely avoiding the economic losses caused by unplanned plant shutdowns.

[0044] Please refer to Figure 2 , Figure 2 which is a schematic structural diagram of an output voting circuit applied to the DO module of a triple modular redundant safety system provided by an embodiment of the present invention.

[0045] The output voting circuit includes: a master control unit for channel A, a master control unit for channel B, a master control unit for channel C, an output driving circuit for channel A, an output driving circuit for channel B, and an output driving circuit for channel C; it also includes: a first controllable switch A, a second controllable switch B, a third controllable switch C, a fourth controllable switch A1, a fifth controllable switch B1, and a sixth controllable switch C1, where:

[0046] The output driving circuits for channels A, B, and C are all connected to the output ends of the master control unit for channel A, the master control unit for channel B, and the master control unit for channel C.

[0047] Specifically, the output end of the master control unit for channel A is connected to the input ends of the output driving circuit for channel A, the output driving circuit for channel B, and the output driving circuit for channel C; the output end of the master control unit for channel B is connected to the input ends of the output driving circuit for channel A, the output driving circuit for channel B, and the output driving circuit for channel C; the output end of the master control unit for channel C is connected to the input ends of the output driving circuit for channel A, the output driving circuit for channel B, and the output driving circuit for channel C.

[0048] The output ends of the output driving circuit for channel A, the output driving circuit for channel B, the output driving circuit for channel C, the master control unit for channel A, the master control unit for channel B, and the master control unit for channel C are respectively and correspondingly connected to the control ends of the first controllable switch A, the second controllable switch B, the third controllable switch C, the fourth controllable switch A1, the fifth controllable switch B1, and the sixth controllable switch C1.

[0049] Preferably, the first controllable switch A, the second controllable switch B, the third controllable switch C, the fourth controllable switch A1, the fifth controllable switch B1, and the sixth controllable switch C1 are all PMOS transistors.

[0050] Specifically, the output terminal of the A-channel master control unit is connected to the control terminal of the first controllable switch A, the output terminal of the B-channel master control unit is connected to the control terminal of the second controllable switch B, and the output terminal of the C-channel master control unit is connected to the control terminal of the third controllable switch C; the output terminal of the A-channel output driving circuit is connected to the control terminal of the fourth controllable switch A1, the output terminal of the B-channel output driving circuit is connected to the control terminal of the fifth controllable switch B1, and the output terminal of the C-channel output driving circuit is connected to the control terminal of the sixth controllable switch C1.

[0051] The logics of the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit are as follows:

[0052]

[0053] In the formula:

[0054] DRIVER_A, DRIVER_B, and DRIVER_C are the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit respectively;

[0055] A, B, and C are the output signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit respectively;

[0056] I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are the communication signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit respectively;

[0057] “&” represents logical AND, “+” represents logical OR, and “NOT” represents logical NOT.

[0058] It can be understood that the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit communicate with the upper layer through I / O_BUS_A, I / O_BUS_B, and I / O_BUS_C respectively. For example but not limited to, the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit communicate with controller master station A, controller master station B, and controller master station C through I / O_BUS_A, I / O_BUS_B, and I / O_BUS_C respectively, and receive the output instructions issued by controller master station A, controller master station B, and controller master station C.

[0059] I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok respectively represent the communication status of the master unit of Channel A, the master unit of Channel B, and the master unit of Channel C with Controller Master Station A, Controller Master Station B, and Controller Master Station C. And the signals I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are respectively generated by the master unit of Channel A, the master unit of Channel B, and the master unit of Channel C.

[0060] Specifically, when the master unit of Channel A, the master unit of Channel B, and the master unit of Channel C communicate normally with Controller Master Station A, Controller Master Station B, and Controller Master Station C, the master unit of Channel A, the master unit of Channel B, and the master unit of Channel C output I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok and output a logic low level. Conversely, when the communication fails, a logic high level is output.

[0061] The first controllable switch A and the fourth controllable switch A1 are connected in series to form the first controllable unit 1, the second controllable switch B and the fifth controllable switch B1 are connected in series to form the second controllable unit 2, and the third controllable switch C and the sixth controllable switch C1 are connected in series to form the third controllable unit 3. The first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 are connected in parallel and used as the output end of the output voting circuit.

[0062] The first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 are respectively arranged in three pluggable modules to achieve triple modular redundancy.

[0063] Specifically, the three drive circuits and three master units in this application convert the three-channel control outputs into a six-way drive circuit with six outputs, and the six controllable switches form a circuit structure of two series and three parallel, and each drive circuit and master unit controls a corresponding controllable switch.

[0064] The output signals of the drive circuit of Channel A and the master unit of Channel A are the first group of input signals, the output signals of the drive circuit of Channel B and the master unit of Channel B are the second group of input signals, and the output signals of the drive circuit of Channel C and the master unit of Channel C are the third group of input signals; when at least one of the three groups of input signals, namely the first group of input signals, the second group of input signals, and the third group of input signals, is normal, each drive circuit controls its corresponding controllable switch accordingly, so that at least one of the first controllable unit 1, the second controllable unit 2, and the controllable unit 3 is turned on, that is, at least one path in the two-series and three-parallel circuit structure formed by the six controllable switches is turned on.

[0065] The output driving circuits of Channel A, Channel B, and Channel C can output corresponding driving signals according to the output signals of the master control units of Channel A, Channel B, and Channel C, and together with the output signals of the master control units of Channel A, Channel B, and Channel C, control the corresponding controllable switches.

[0066] In the embodiments of the present invention, each driving circuit preferably controls the corresponding controllable switch through an OR logic, that is, each driving circuit may include corresponding discrete devices, and through the corresponding OR logic, the output of the corresponding control signal in each driving circuit is used to control the corresponding controllable switch.

[0067] More specifically, a corresponding OR logic circuit is provided in each driving circuit. Combining with formula (2), the logics of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 are as follows:

[0068]

[0069] In the formula:

[0070] A, B, and C are respectively the output signals of the master control unit of Channel A, the master control unit of Channel B, and the master control unit of Channel C;

[0071] I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are respectively the communication signals of the master control unit of Channel A, the master control unit of Channel B, and the master control unit of Channel C;

[0072] OUT_A, OUT_B, and OUT_C are respectively the output signals of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3;

[0073] “&” represents logical AND, “+” represents logical OR, and “NOT” represents logical NOT.

[0074] Specifically, as can be seen from the above, the output signals A, B, and C of the A-channel master control unit, B-channel master control unit, and C-channel master control unit are all input into each drive circuit; the output signal A of the A-channel master control unit, the output signal C of the C-channel master control unit, the communication signal I / O_BUS_B_ok of the B-channel master control unit, and the communication signal I / O_BUS_C_ok of the C-channel master control unit are used as the first group of input signals; the output signal B of the B-channel master control unit, the output signal A of the A-channel master control unit, the communication signal I / O_BUS_A_ok of the A-channel master control unit, and the communication signal I / O_BUS_C_ok of the C-channel master control unit are used as the second group of input signals; the output signal A of the A-channel master control unit, the output signal B of the B-channel master control unit, the communication signal I / O_BUS_B_ok of the B-channel master control unit, and the communication signal I / O_BUS_A_ok of the A-channel master control unit are used as the third group of input signals.

[0075] That is to say, formula (3) indicates that when at least one group of the first group of input signals, the second group of input signals, and the third group of input signals is normal, each drive circuit controls the corresponding control switch through the output drive signal, so that at least one of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 is turned on, thereby ensuring the normal output of the output voting circuit.

[0076] The output of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 are ORed to obtain the output result of the voting circuit, which is:

[0077] OUT load = OUT_A + OUT_B + OUT_C (4)

[0078] Substituting formula (3) into formula (4) indicates that on the basis of maintaining the voting function, it is ensured that when two IO channels fail, the final output channel can still operate normally with power on, thereby realizing the 3-2-1-0 degradation operation mode, improving the safety performance of the system, and largely avoiding the economic losses caused by unplanned plant shutdowns.

[0079] The embodiment of the present invention also provides a DO module of a triple modular redundant safety system, including the output voting circuit as described above.

[0080] It should be noted that the DO module of the triple modular redundant safety system in the embodiment of the present invention can realize the 3-2-1-0 degradation operation mode during use, improve the safety performance of the system, and largely avoid the economic losses caused by unplanned plant shutdowns.

[0081] In addition, for the specific introduction of the output voting circuit involved in the embodiment of the present invention, please refer to the above example, and the present application will not elaborate here.

[0082] It should also be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the said element.

[0083] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features disclosed herein.

Claims

1. An output voting circuit, characterized in that, it includes: A-channel master control unit, B-channel master control unit, C-channel master control unit, first controllable switch A, second controllable switch B, third controllable switch C, fourth controllable switch A1, fifth controllable switch B1 and sixth controllable switch C1; The first controllable switch A and the fourth controllable switch A1 are connected in series to form a first controllable unit 1, the second controllable switch B and the fifth controllable switch B1 are connected in series to form a second controllable unit (2), and the third controllable switch C and the sixth controllable switch C1 are connected in series to form a third controllable unit (3); The first controllable unit (1), the second controllable unit (2) and the third controllable unit (3) are connected in parallel and used as the output end of the output voting circuit; The A-channel master control unit, B-channel master control unit, and C-channel master control unit respectively control the first controllable switch A, second controllable switch B, and third controllable switch C; The output signals of the A-channel master control unit, B-channel master control unit, and C-channel master control unit are fused with the communication signal to the upper layer, and the fourth controllable switch A1, fifth controllable switch B1, and sixth controllable switch C1 are respectively controlled, so that at least one of the first controllable unit, the second controllable unit, and the third controllable unit is turned on.

2. An output voting circuit according to claim 1, characterized in that: The output voting circuit includes: A-channel output driving circuit, B-channel output driving circuit and C-channel output driving circuit, which are used to fuse the output signals of the A-channel master control unit, B-channel master control unit, and C-channel master control unit with the communication signal to the upper layer; The output end of the A-channel master control unit is connected to the input ends of the A-channel output driving circuit, B-channel output driving circuit and C-channel output driving circuit; The output end of the B-channel master control unit is connected to the input ends of the A-channel output driving circuit, B-channel output driving circuit and C-channel output driving circuit; The output end of the C-channel master control unit is connected to the input ends of the A-channel output driving circuit, B-channel output driving circuit and C-channel output driving circuit.

3. An output voting circuit according to claim 1, characterized in that: The output signal of the A-channel output driving circuit and the A-channel master control unit is the first group of input signals, the output signal of the B-channel output driving circuit and the B-channel master control unit is the second group of input signals, and the output signal of the C-channel output driving circuit and the C-channel master control unit is the third group of input signals; The three groups of input signals are ORed to form the output result of the voting circuit; When at least one group of the three groups of input signals, namely the first group of input signals, the second group of input signals and the third group of input signals, is normal, each corresponding controllable switch is controlled accordingly through each driving circuit, so that at least one of the first controllable unit 1, the second controllable unit 2 and the controllable unit 3 is turned on.

4. An output voting circuit according to claim 2, characterized in that: The output terminal of the A-channel master control unit is connected to the control terminal of the first controllable switch A. The output terminal of the B-channel master control unit is connected to the control terminal of the second controllable switch B. The output terminal of the C-channel master control unit is connected to the control terminal of the third controllable switch C. The output terminal of the A-channel output driving circuit is connected to the control terminal of the fourth controllable switch A1. The output terminal of the B-channel output driving circuit is connected to the control terminal of the fifth controllable switch B1. The output terminal of the C-channel output driving circuit is connected to the control terminal of the sixth controllable switch C1.

5. An output voting circuit according to claim 4, characterized in that: The first controllable switch A, the second controllable switch B, the third controllable switch C, the fourth controllable switch A1, the fifth controllable switch B1, and the sixth controllable switch C1 are all PMOS transistors.

6. An output voting circuit according to claim 5, characterized in that: The logics of the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit are: In the formula: DRIVER_A, DRIVER_B, and DRIVER_C are the A-channel output driving circuit, the B-channel output driving circuit, and the C-channel output driving circuit respectively; A, B, and C are the output signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit respectively; I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are the communication signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit respectively; "&” represents logical AND, "+” represents logical OR, and "NOT” represents logical NOT.

7. An output voting circuit according to any one of claims 4 to 6, characterized in that: The logics of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 are: In the formula: A, B, and C are the output signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit respectively; I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok are the communication signals of the A-channel master control unit, the B-channel master control unit, and the C-channel master control unit respectively; OUT_A, OUT_B, and OUT_C are the output signals of the first controllable unit 1, the second controllable unit 2, and the third controllable unit 3 respectively; "&” represents logical AND, "+” represents logical OR, and "NOT” represents logical NOT.

8. An output voting circuit according to any one of claims 4 to 6, characterized in that: The first controllable unit (1), the second controllable unit (2), and the third controllable unit (3) are respectively arranged in three pluggable modules for realizing triple modular redundancy.

9. An output voting circuit according to claim 5 or 6, characterized in that: When the A-channel master unit, B-channel master unit, and C-channel master unit communicate normally with controller master station A, controller master station B, and controller master station C, the A-channel master unit, B-channel master unit, and C-channel master unit output I / O_BUS_A_ok, I / O_BUS_B_ok, and I / O_BUS_C_ok and output a logic low level. When the communication fails, a logic high level is output.

10. A DO module of a triple modular redundant safety system, characterized in that, it includes an output voting circuit according to any one of claims 1-9.

Images