Control Circuit and Control Method of a SIL4-Level Gater

Abstract

The present invention discloses a control circuit and a control method for a SIL4-level door controller in the field of rail transit technology, including a main control board and a communication board; the main control board includes a CPU, a safety acquisition circuit and a safety output circuit; safety input signal synchronous verification and output voting are performed within each working cycle; the safety acquisition circuit determines the validity of the input safety input signal through a dynamic wave verification mechanism; the present invention is provided with two independent control branches to achieve synchronous verification and redundant voting of safety input signals, eliminating the risk of single-point failures; by using the reference signal sent by the CPU as a dynamic reference, sampling and feedback are performed on the safety input signals, and at the same time the CPU performs consistency verification on the sampled signal and the reference signal, with strong dynamic anti-interference ability, ensuring the reliability of the input data, and effectively suppressing signal misjudgment caused by electromagnetic interference or environmental noise.

Description

Technical Field

[0001] The present invention relates to a control circuit and a control method for a SIL4-level gating device, belonging to the technical field of rail transit. Background Art

[0002] In the field of industrial safety control, especially in gating systems involving high safety integrity levels (such as Safety Integrity Level 4, SIL4), traditional gating devices mostly adopt a single control unit architecture, which has a risk of single-point failure and is difficult to meet the requirements of SIL4 for redundancy and fault tolerance. In addition, the safety input signal acquisition link is vulnerable to electromagnetic interference or environmental noise, resulting in signal misjudgment or failure. Existing verification mechanisms often lack dynamic anti-interference capabilities and are difficult to ensure the reliability of input data; the output control part often lacks redundant design and real-time status feedback mechanisms, and it is difficult to isolate faults in time when the safety input signal is abnormal, resulting in misoperation of safety devices. Summary of the Invention

[0003] The present invention provides a control circuit and a control method for a SIL4-level gating device, which solve the problems disclosed in the background art.

[0004] In a first aspect, a control circuit for a SIL4-level gating device is provided, including a main control board and a communication board;

[0005] The main control board includes a safety output circuit and two control branches with the same structure. The safety output circuit is arranged between the power supply and the safety device. The control branch includes a safety acquisition circuit and a CPU connected to the safety acquisition circuit. The CPUs of the two control branches are connected through a safety channel. The CPUs of the two control branches or the CPU of any one control branch are connected to the communication board through a safety channel. The CPUs of the two control branches are both connected to the safety output circuit;

[0006] The safety acquisition circuit is configured to receive a reference signal sent by the CPU, sample the safety input signal based on the waveform of the reference signal, and feed the sampled signal back to the CPU;

[0007] The CPU is configured to send a reference signal to the safety acquisition circuit; receive the sampled signal fed back by the safety acquisition circuit, perform consistency verification on the sampled signal and the reference signal. If the consistency verification passes, send its own sampled signal to the CPU of the other control branch. If it receives the sampled signal sent by the CPU of the other control branch, perform consistency voting on its own sampled signal and the sampled signal of the CPU of the other control branch. If the voting passes, send a conduction signal to the safety output circuit; if the safety output circuit is conducting, send the sampled signal to the safety device through the safety output circuit;

[0008] The safety output circuit is used to conduct the power supply line between the power supply and the safety device when receiving the conduction signals sent by the CPUs of the two control branches.

[0009] Further, the safety acquisition circuit includes a control isolation circuit and a reading isolation circuit connected in series;

[0010] The control isolation circuit receives the reference signal sent by the corresponding CPU, and intermittently transmits the safety input signal to the reading isolation circuit according to the waveform of the reference signal;

[0011] The reading isolation circuit samples the received safety input signal and sends the sampled signal to the corresponding CPU.

[0012] Further, the reference signal is a square wave signal. When it is at the high level, the control isolation circuit transmits the safety input signal to the reading isolation circuit. When it is at the low level, the control isolation circuit does not transmit the safety input signal.

[0013] Further, the safety output circuit includes a first controllable switch and a second controllable switch connected in series between the power supply and the safety device. The CPUs of the two control branches respectively control the first controllable switch and the second controllable switch. If the vote passes, the CPU sends a conduction signal to the corresponding controllable switch;

[0014] A first feedback circuit is connected between the output end of the first controllable switch and the corresponding CPU. The first feedback circuit feeds back the on / off state of the first controllable switch to the corresponding CPU. A second feedback circuit is connected between the output end of the second controllable switch and the corresponding CPU. The second feedback circuit feeds back the on / off state of the second controllable switch to the corresponding CPU;

[0015] The CPUs of the two control branches exchange the on / off states. If both the first controllable switch and the second controllable switch are conductive, the safety output circuit is conductive.

[0016] Further, the structures of the first controllable switch and the second controllable switch are the same, including a control circuit, a drive circuit and a drive power supply. The control circuit is arranged between the power supply and the safety device. The drive circuit is connected to the corresponding CPU, and the drive circuit is arranged on the power supply line between the drive power supply and the control circuit;

[0017] If the vote passes, the CPU sends a conduction signal to the corresponding drive circuit. The drive circuit controls the conduction of the power supply line between the drive power supply and the control circuit, and the control circuit is powered on and then conducts.

[0018] Further, an isolation circuit is also arranged between the drive circuit and the corresponding CPU.

[0019] The safety output circuit further includes a first feedback circuit and a second feedback circuit, and the first feedback circuit and the second feedback circuit respectively feed back the on / off states of the first controllable switch and the second controllable switch to the CPU.

[0020] Second, a control method for a SIL4-level gating device is provided, which is applied to the control circuit of the SIL4-level gating device described in the first aspect. The CPUs of the two control branches include the following steps:

[0021] Send a reference signal to the safety acquisition circuit;

[0022] Receive the sampling signal fed back by the safety acquisition circuit, and perform consistency verification on the sampling signal and the reference signal; wherein, the sampling signal is a signal obtained by the safety acquisition circuit sampling the safety input signal based on the waveform signal of the reference signal;

[0023] If the consistency verification passes, send its own sampling signal to the CPU of the other control branch;

[0024] If receiving the sampling signal sent by the CPU of the other control branch, perform consistency voting on its own sampling signal and the sampling signal of the CPU of the other control branch;

[0025] If the voting passes, send a conduction signal to the safety output circuit;

[0026] If the safety output circuit is conducting, send the sampling signal to the safety device through the safety output circuit.

[0027] Further, both the consistency verification and the consistency voting compare the phases of the two signals and compare the frequencies of the two signals;

[0028] If the phases of the two signals are the same and the frequencies of the two signals are the same, the consistency verification or the consistency voting passes.

[0029] Further, if the consistency voting passes and it is connected to the communication board, send a network output signal to the communication board; wherein, the network output signal is transparently transmitted to the external system through the communication board;

[0030] If the voting passes and it is not connected to the communication board, send the network output signal to the CPU of the other control branch; wherein, the network output signal is transparently transmitted to the external system through the CPU of the other control branch and the communication board in sequence.

[0031] The present invention is provided with two independent control branches to achieve synchronous verification and redundant voting of safety input signals, eliminating the risk of single-point failures; by using the reference signal sent by the CPU as a dynamic reference, sampling and feeding back the safety input signals, and at the same time the CPU performs consistency verification on the sampled signals and the reference signal, it has strong dynamic anti-interference ability, ensuring the reliability of input data and effectively suppressing signal misjudgment caused by electromagnetic interference or environmental noise; the safety output circuit conducts when the CPUs of both control branches send conduction signals, implementing redundant design of output control and providing real-time feedback on the on / off state of the safety output circuit. When the safety output circuit conducts, the safety input signal is input into the safety device, ensuring isolation when the safety input signal is abnormal and enhancing overall safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The following shows the overall framework diagram of the SIL4-level gate controller provided by the present invention;

[0033] Figure 2 The following shows the structural diagram of the safety acquisition circuit provided by the present invention;

[0034] Figure 3 The following shows the schematic diagram of the safety output circuit process provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0035] The technical solution of the present invention will be described in detail below through the drawings and specific embodiments. It should be understood that the specific features in the embodiments of the present application and the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. Without conflict, the technical features in the embodiments of the present application and the embodiments can be combined with each other.

[0036] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this article generally represents an "or" relationship between the front and rear associated objects.

[0037] Embodiment 1:

[0038] This embodiment provides a control circuit for a SIL4-level gate controller, including a main control board and a communication board; the main control board includes a safety output circuit and two control branches with the same structure. The safety output circuit is connected in series between the power supply and the safety device. The control branch includes a safety acquisition circuit and a CPU connected to the safety acquisition circuit. The CPUs of the two control branches are connected through a safety channel. The CPUs of the two control branches or the CPU of any one control branch are connected to the communication board through a safety channel. The CPUs of the two control branches are both connected to the safety output circuit.

[0039] SeeFigure 1 In the main control board, the CPUs of the two control branches are respectively defined as CPU1 and CPU2, and the safety acquisition circuits are respectively defined as safety acquisition circuit one and safety acquisition circuit two. The series-connected safety acquisition circuit one and CPU1 constitute the first control branch, and the series-connected safety acquisition circuit two and CPU2 constitute the first control branch. The input ends of the safety acquisition circuit one and the safety acquisition circuit two both input safety input signals. CPU1 and CPU2 perform data interaction through two independent safety communication channels. The output ends of CPU1 and CPU2 are both connected to the control end of the safety output circuit, and the input end and the output end of the safety output circuit are respectively connected to the power supply and the safety device.

[0040] The above-mentioned safety acquisition circuit is used to receive the reference signal sent by the CPU, sample the safety input signal based on the waveform of the reference signal, and feed the sampled signal back to the CPU.

[0041] It should be noted that the reference signal is periodically generated by the CPU and is triggered in the high-level stage of each working cycle. Specifically, the CPU generates a square-wave reference signal at a fixed frequency, and the duration of its high level corresponds to a sampling window. In the high-level stage of the square wave, the control isolation circuit is activated, allowing the safety input signal to be transmitted to the reading isolation circuit for sampling; when it is at a low level, the transmission stops, thus ensuring that the sampling is strictly synchronized with the reference signal and avoiding non-periodic interference. For the convenience of subsequent sampling of the safety input signal, the reference signal here can adopt a square-wave signal. When it is at a high level, the safety acquisition circuit will sample the safety input signal, and when it is at a low level, the safety acquisition circuit will not sample the safety input signal, which is more convenient for subsequent consistency verification.

[0042] It should be noted that in this embodiment, the safety input signal can be: <(

[0043] Door status signals, such as door closed-in-place signal, door locked signal;

[0044] Emergency instruction signals: such as emergency stop button trigger signal, track foreign object detection signal;

[0045] Environmental monitoring signals: such as platform edge safety light curtain trigger signal.

[0046] In some embodiments, the safety acquisition circuit includes a series-connected control isolation circuit and a reading isolation circuit; the control isolation circuit receives the reference signal sent by the corresponding CPU, and intermittently transmits the safety input signal to the reading isolation circuit according to the waveform of the reference signal, that is, when it is at a high level, the control isolation circuit transmits the safety input signal to the reading isolation circuit, and when it is at a low level, the control isolation circuit does not transmit the safety input signal; the reading isolation circuit samples the received safety input signal and sends the sampled signal to the corresponding CPU.

[0047] See Figure 2 , Figure 2 is Figure 1 the specific structural block diagrams of Safety Acquisition Circuit 1 and Safety Acquisition Circuit 2, including Control Isolation Circuit 1, Reading Isolation Circuit 1, Control Isolation Circuit 2 and Reading Isolation Circuit 2; Control Isolation Circuit 1 and Reading Isolation Circuit 1 are connected in series to form Safety Acquisition Circuit 1, and Control Isolation Circuit 2 and Reading Isolation Circuit 2 are connected in series to form Safety Acquisition Circuit 2.

[0048] Since the working processes of Safety Acquisition Circuit 1 and Safety Acquisition Circuit 2 are the same, here, taking the structure of Safety Acquisition Circuit 1 as an example for description, Control Isolation Circuit 1 receives the square wave signal sent by CPU1. When at a high level, it transmits the safety input signal to Reading Isolation Circuit 1, and when at a low level, it does not transmit the safety input signal to Reading Isolation Circuit 1. The isolation circuit samples the received safety input signal, thereby obtaining a square wave signal with high and low levels, that is, the sampling signal, and sends this sampling signal to CPU1.

[0049] It should be noted that the control isolation circuit and the reading isolation circuit can be implemented by the following components: Opto-isolator: achieving electrical isolation through photoelectric conversion, with no direct electrical connection between the input side and the output side, suitable for high-noise environments; Magnetic isolator: based on magnetic coupling technology, supporting high-speed signal transmission and having strong common-mode interference resistance; Relay isolation: mechanical contact isolation, suitable for high-voltage scenarios.

[0050] The above CPU is used to send a reference signal to the safety acquisition circuit; receive the sampling signal fed back by the safety acquisition circuit, perform consistency verification on the sampling signal and the reference signal. If the consistency verification passes, send its own sampling signal to the CPU of another control branch. If receiving the sampling signal sent by the CPU of another control branch, perform consistency voting on its own sampling signal and the sampling signal of the CPU of another control branch. If the voting passes, send a conduction signal to the safety output circuit; if the safety output circuit is conductive, send the sampling signal to the safety device through the safety output circuit.

[0051] It should be noted that for a SIL4-level system, a CPU that has passed safety certification needs to be selected. For example: Infineon TriCore TC297T: supporting ASIL-D certification, integrating a hardware security module, suitable for a redundant voting architecture; NXP S32K344: compliant with ISO26262 ASIL-D, supporting dual-core lockstep operation, with a built-in fault detection mechanism; STMicroelectronics SPCE061A: having SIL3 / 4 certification, suitable for rail transit safety control scenarios.

[0052] See Figure 1 andFigure 2 , in the figure, the working processes of CPU1 and CPU2 are the same. Here, taking CPU1 as an example, the description is as follows: CPU1 receives the sampling signal fed back by the first safety acquisition circuit, performs consistency verification on the sampling signal and the reference signal. If the consistency verification passes, it sends its own sampling signal to CPU2 through the safety communication channel. Similarly, CPU2 also sends a sampling signal to CPU1, and performs consistency voting on its own sampling signal and the sampling signal sent by CPU2. If the voting passes, it sends a conduction signal to the safety output circuit; if the safety output circuit is conducting, it sends the sampling signal to the safety device through the safety output circuit.

[0053] It should be noted that the consistency voting here is similar to the consistency verification, both of which are used to judge the consistency of two signals and can be judged by the characteristics of the signals, such as phase, frequency, etc. Taking phase and frequency as examples, the consistency voting and consistency verification can be to compare the phases of the two signals and compare the frequencies of the two signals; if the phases of the two signals are the same and the frequencies of the two signals are the same, the consistency verification or consistency voting passes.

[0054] It should be noted that the safety communication channel is two independent and physically isolated data transmission paths, used for data interaction and status synchronization between the dual control branches; the risk of single-point failure can be eliminated through redundant design, and at the same time, the protocol-level security mechanism can prevent data tampering.

[0055] It should be noted that the structure of the communication board includes:

[0056] Core module: CPU3;

[0057] Interface module: communication interface one, communication interface two,..., communication interface n; among them, industrial communication interfaces such as RS485, Ethernet, and CAN are supported;

[0058] The communication board is used for data transparent transmission with an external system (such as a train control center) to transmit the network output signal; to implement protocol conversion (such as CAN to Ethernet) to adapt to different communication standards; to provide redundant communication paths to ensure communication can still be carried out through the standby interface when a certain interface fails.

[0059] In the CPU connected to the communication board, if the consistency voting passes, it sends a network output signal to the communication board, and the network output signal will be transparently transmitted to the external system through the communication board. In the CPU not connected to the communication board, if the consistency voting passes, it sends a network output signal to the CPU of the other control branch, and the network output signal is sequentially transmitted to the external system through the CPU of the other control branch and the communication board.

[0060] See Figure 1, in the figure, CPU1 in the figure is connected to CPU2 of the communication board through a secure communication channel. When the consistency vote of CPU1 passes, it will send a network output signal to the communication board and transmit it to the external system through the communication interface of the communication board. When the consistency vote of CPU2 passes, it will send a network output signal to CPU1 and then transmit it to the external system through the communication interface of the communication board.

[0061] The safety output circuit, if it receives the conduction signals sent by the CPUs of two control branches, conducts the power supply line between the power supply and the safety device.

[0062] The safety output circuit is the backend execution module of the SIL4-level gating controller. It is responsible for transmitting the control signal to the safety device by conducting the power supply line between the power supply and the safety device after the consistency vote of the dual control branches passes.

[0063] Its core functions include:

[0064] Redundant control: By the collaborative operation of two independent control branches, the risk of single-point failure is eliminated;

[0065] Dynamic isolation and feedback: An isolation circuit is used to block external interference, and real-time status feedback is used to ensure the reliability of operations;

[0066] Safety conduction mechanism: The power supply line is only conducted when the consistency vote of the dual CPUs passes, preventing misoperation.

[0067] Such as Figure 3 As shown, the safety output circuit consists of the following modules:

[0068] The first controllable switch and the second controllable switch: Each control branch corresponds to a controllable switch, which all include a control circuit, a drive circuit, and a drive power supply; among them, for the first controllable switch, they are: control circuit one, drive circuit one, and drive power supply one; for the second controllable switch, they are: control circuit two, drive circuit two, and drive power supply two; the drive circuit receives the conduction signal (such as a high-level pulse) of the corresponding CPU and controls the on / off of the drive power supply and the control circuit; the control circuit is connected in series between the power supply and the safety device, and controls the conduction state of the power supply line through the on / off of the drive circuit.

[0069] It should be noted that the drive circuit is responsible for converting the conduction signal of the CPU into the control signal of the controllable switch, and needs to have high-speed response, isolation protection, and anti-interference capabilities; in this embodiment, an IGBT drive chip (a composite fully controlled voltage-driven power semiconductor device) is selected, such as Texas Instruments UCC21520, which uses a dual-channel isolated gate driver, supports an isolation voltage of 5.7 kVrms, and has a peak drive current of 4 A; it complies with the IEC 61508 SIL3 standard and integrates a fault feedback function, and is suitable for redundant control systems.

[0070] It should be noted that the control circuit directly controls the on / off of the power supply line and needs to have high load capacity and reliability. A solid-state relay Crydom D2425 can be used.

[0071] It should be noted that the drive power supply provides a stable working voltage for the controllable switch and needs to have high isolation and anti-interference capabilities. An isolated DC / DC power module can be used.

[0072] Isolation circuit: It includes isolation circuit one and isolation circuit two. The isolation circuit one and isolation circuit two are respectively connected to CPU1 and CPU2, and achieve electrical isolation between each corresponding CPU and the drive circuit, preventing high voltage or noise from interfering with the operation of the CPU.

[0073] It should be noted that the isolation circuit can use an opto-isolator, such as TLP521, with an isolation voltage of 5000Vrms; or a magnetic isolator, such as ADI ADuM3151, which supports 15Mbps signal transmission.

[0074] Feedback circuit: It includes feedback circuit one and feedback circuit two. The feedback circuit one and feedback circuit two are respectively connected to CPU1 and CPU2. The output end of each controllable switch is connected to the feedback circuit of the corresponding CPU. The specific model can use a voltage comparator LM393.

[0075] The feedback circuit monitors the on / off state of the controllable switch in real time and feeds the status signal back to the CPU. If it is detected that the switch does not act according to the instruction (such as it should conduct but is actually open), the CPU immediately triggers the fault handling process.

[0076] When the CPU1 and CPU2 are synchronized, a consistency voting process for the safety input signal is required. CPU1 and CPU2 respectively send conduction signals to the corresponding controllable switches; the two CPUs confirm the conduction state of their own controllable switches through the feedback circuit; if both CPUs confirm that the switch is conducting, the overall safety output circuit conducts; if any switch is not conducting, the power supply is immediately cut off and an alarm is triggered.

[0077] In the redundant control and dynamic voting mechanism, the CPU periodically generates a synchronous square wave reference signal, and the conduction instruction of the drive circuit only takes effect during the high level stage of the reference signal, ensuring the timing consistency of the dual-branch operation.

[0078] If the feedback circuit detects an abnormal switch (such as a short circuit or an open circuit), the CPU notifies the other control branch through the safety communication channel and forcibly disconnects its own controllable switch. Then, the safety output circuit stops outputting the safety input signal and imports the signal to the safety side.

[0079] Embodiment 2:

[0080] Based on the first embodiment, this embodiment provides a control method for a SIL4-level gating device. The CPU of any control branch includes the following steps:

[0081] Send a reference signal to the safety acquisition circuit;

[0082] Receive the sampling signal fed back by the safety acquisition circuit, and perform consistency verification on the sampling signal and the reference signal; wherein, the sampling signal is a signal obtained by the safety acquisition circuit sampling the safety input signal based on the waveform signal of the reference signal;

[0083] If the consistency verification passes, send its own sampling signal to the CPU of another control branch;

[0084] If receiving the sampling signal sent by the CPU of another control branch, perform consistency voting on its own sampling signal and the sampling signal of the CPU of another control branch;

[0085] If the voting passes, send a conduction signal to the safety output circuit.

[0086] Both the consistency verification and the consistency voting are to compare the phases of the two signals and compare the frequencies of the two signals; if the phases of the two signals are the same and the frequencies of the two signals are the same, the consistency verification or the consistency voting passes.

[0087] If the voting passes and it is connected to the communication board, send a network output signal to the communication board; wherein, the network output signal is transparently transmitted to the external system through the communication board;

[0088] If the voting passes and it is not connected to the communication board, send a network output signal to the CPU of another control branch; wherein, the network output signal is sequentially transparently transmitted to the external system through the CPU of another control branch and the communication board.

[0089] When the consistency voting fails, CPU1 or CPU2 outputs a safety-side signal to the safety device through the safety output circuit, and the safety device performs a safety action.

[0090] The sampling signals output to the safety device after the consistency verification and the consistency voting pass include: output network output data and control output data; the network output data is transparently transmitted to the external system through the communication board; the control output data is output to the safety device through the safety output circuit; the network output data being transparently transmitted to the external system through the communication board includes: the CPUs of the two control branches respectively output half-frame network output data to CPU3 in the communication board; or, the CPU of one control branch outputs full-frame network output data to CPU3, and the remaining CPU of the control branch outputs a check code to CPU3.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are executed on the computer or other programmable apparatus to produce a computer-implemented process, thereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one process or multiple processes and / or one block or multiple blocks in the flow Figure 1 one process or multiple processes and / or blocks Figure 1 steps for implementing the functions specified in one block or multiple blocks

[0092] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the technical principle of the present invention, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the protection scope of the present invention.

Claims

1. A control circuit for a SIL4 door controller, characterized in that: Including main control board and communication board; The main control board includes a safety output circuit and two control branches with the same structure. The safety output circuit is arranged between the power supply and the safety device. The control branch includes a safety acquisition circuit and a CPU connected to the safety acquisition circuit. The CPUs of the two control branches are connected through a safety channel. The CPUs of the two control branches or any one of the control branches are connected to the communication board through the safety channel. The CPUs of the two control branches are both connected to the safety output circuit. The safety acquisition circuit is used to receive the reference signal sent by the CPU, sample the safety input signal based on the waveform of the reference signal, and feed the sampled signal back to the CPU; The CPU is configured to send a reference signal to the safety acquisition circuit; receive a sampling signal fed back by the safety acquisition circuit, perform a consistency check on the sampling signal and the reference signal; if the consistency check passes, send its own sampling signal to the CPU of another control branch; if the sampling signal sent by the CPU of another control branch is received, perform a consistency vote on its own sampling signal and the sampling signal of the CPU of the other control branch; if the vote passes, send a conduction signal to the safety output circuit; if the safety output circuit is turned on, send the sampling signal to the safety device via the safety output circuit; The safety output circuit is used to conduct the power supply line between the power supply and the safety device when receiving the conduction signal sent by the two control branch CPUs; The safety output circuit includes a first controllable switch and a second controllable switch connected in series between the power supply and the safety device. The two control branches CPU respectively control the first controllable switch and the second controllable switch. If the vote is passed, the CPU sends a conduction signal to the corresponding controllable switch; A first feedback circuit is connected between the output end of the first controllable switch and the corresponding CPU, and the first feedback circuit feeds back the on-off state of the first controllable switch to the corresponding CPU. A second feedback circuit is connected between the output end of the second controllable switch and the corresponding CPU, and the second feedback circuit feeds back the on-off state of the second controllable switch to the corresponding CPU. The two control branches CPUs alternately switch on and off. If both the first controllable switch and the second controllable switch are turned on, the safety output circuit is turned on.

2. The control circuit of the SIL4 door controller according to claim 1, characterized in that: The safety acquisition circuit includes a control isolation circuit and a reading isolation circuit connected in series; The control isolation circuit receives the reference signal sent by the corresponding CPU and intermittently transmits the safety input signal to the reading isolation circuit according to the waveform of the reference signal; The read isolation circuit samples the received safety input signal and sends the sampled signal to the corresponding CPU.

3. The control circuit of the SIL4 door controller according to claim 2, characterized in that: The reference signal is a square wave signal. When the reference signal is at a high level, the control isolation circuit transmits the safety input signal to the reading isolation circuit. When the reference signal is at a low level, the control isolation circuit does not transmit the safety input signal.

4. The control circuit of the SIL4 door controller according to claim 1, characterized in that: The first controllable switch and the second controllable switch have the same structure, including a control circuit, a drive circuit and a drive power supply, the control circuit is arranged between the power supply and the safety device, the drive circuit is connected to the corresponding CPU, and the drive circuit is arranged on the power supply line between the drive power supply and the control circuit; If the vote is passed, the CPU sends a conduction signal to the corresponding drive circuit, the drive circuit controls the power supply line between the drive power supply and the control circuit to be conductive, and the control circuit is powered on and turned on.

5. The control circuit of the SIL4 door controller according to claim 4, characterized in that: An isolation circuit is also provided between the driving circuit and the corresponding CPU.

6. A control method for a SIL4 door controller, characterized in that: A control circuit for a SIL4 door controller according to any one of claims 1 to 5, wherein the control method comprises: Sending a reference signal to a safety acquisition circuit; Receive the sampling signal fed back by the safety acquisition circuit and perform consistency check on the sampling signal and the reference signal; wherein the sampling signal is a signal obtained by the safety acquisition circuit by sampling the safety input signal with the waveform signal of the reference signal as the reference; If the consistency check passes, it sends its own sampling signal to the CPU of the other control branch; If a sampling signal is received from the CPU of another control branch, a consistency vote is performed on the sampling signal of the own control branch CPU and the sampling signal of the other control branch CPU; If the vote is passed, a conduction signal is sent to the safety output circuit; If the safety output circuit is turned on, a sampling signal is sent to the safety device through the safety output circuit.

7. The control method of the SIL4 door controller according to claim 6, characterized in that: The consistency check and consistency voting both compare the phases of the two signals and the frequencies of the two signals; If the phases of the two signals are consistent and the frequencies of the two signals are consistent, the consistency check or consistency vote passes.

8. The control method of the SIL4 door controller according to claim 6, characterized in that: If the consensus vote passes and the system is connected to the communication board, it sends a network output signal to the communication board. The network output signal is transparently transmitted to the external system through the communication board. If the consensus vote is passed and the controller itself is not connected to the communication board, it sends a network output signal to the CPU of another control branch; the network output signal is then transparently transmitted to the external system through the CPU of another control branch and the communication board.

Images