Safety analog quantity acquisition circuit of 1oo2 architecture and fault diagnosis method

Abstract

The invention discloses a safe analog quantity acquisition circuit of a 1oo2 architecture and a fault diagnosis method, which are characterized in that based on the technical scheme of the 1oo2 architecture, when one channel fails, the other channel can still ensure the system operation and high diagnosis coverage rate, the failure of a device on a signal input link can be diagnosed in real time, and the reliability of the system is improved. According to the technical scheme, the failure problem of devices such as an analog quantity sampling resistor, a channel signal conditioning circuit and an ADC acquisition circuit can be diagnosed, so that the safety of the module and the availability of the module are solved, the diagnosis coverage rate is high, authentication of the SIL3 level of the functional safety IEC61508 standard can be achieved, and the technical problems that the 2oo3 architecture technology is high in cost and the 1oo1 architecture technology is poor in availability are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial automation, and more particularly to a 1oo2 architecture safety analog quantity acquisition circuit and a fault diagnosis method. Background Art

[0002] In industrial automation control systems, analog data acquisition modules are crucial components of distributed control systems (DCS) and safety instrumented systems (SIS). They are often used to collect 4-20mA current from field sensors, such as temperature, pressure, and flow. In actual use, devices can fail due to various factors, including humidity, pressure, temperature, and aging. Without proper diagnosis, these devices can report erroneous data. These erroneous data can cause abnormal outputs from the DCS (distributed control system) or SIS (safety instrumented system), shutting down production equipment and resulting in catastrophic safety consequences and severe economic losses.

[0003] Existing technology

[0004] Patent number: CN202411407141.5, this patent invents two independent AI acquisition modules, which diagnose the ADC circuit by comparing the acquired values.

[0005] Patent number: CN 108226762 A. This patent invention also diagnoses the ADC circuit, but cannot diagnose the sampling resistor at the input end and the input signal conditioning circuit.

[0006] Patent number: CN 119363112 A. This invention is for diagnosing ADC stuck faults. It requires using a differential ADC to collect signals and uses the differential complementary method to determine whether the collected binary code values ​​are complementary.

[0007] Patent number: CN 116846395 A: This invention can independently verify whether there is accuracy deviation or fault in the acquisition channel by comparing it with the benchmark reference voltage.

[0008] Disadvantages of existing technology

[0009] The 1oo1 (1out of 1) architecture has low security. Single-point failures can lead to system failure, poor availability, and a lack of fault diagnosis, which can cause the system to fail without warning. It cannot tolerate failures. Once a failure occurs, it will focus on safety, causing the system to trip and stop, resulting in huge losses to users.

[0010] The 2oo3 (2out of 3) architecture is the most expensive, requiring three times the hardware and software resources to implement. It is complex to design and requires complex logic and algorithms to implement the voting mechanism, and can tolerate single points of failure.

[0011] Therefore, how to provide a safe analog quantity acquisition circuit and fault diagnosis method with a 1oo2 architecture has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0012] The purpose of the present invention is to provide a 1oo2 architecture safety analog quantity acquisition circuit and a fault diagnosis method.

[0013] According to a first aspect of the present invention, a 1oo2 architecture safety analog quantity acquisition circuit is provided, comprising:

[0014] A first sampling resistor, a second sampling resistor, a first V1 multiplexer, a second V1 multiplexer, a first V2 multiplexer, a second V2 multiplexer, an A-series channel acquisition signal conditioning circuit, a B-series channel acquisition signal conditioning circuit, an A-series channel readback diagnostic conditioning circuit, a B-series channel readback diagnostic conditioning circuit, an A-series multiplexer, a B-series multiplexer, an A-series AD converter, a B-series AD converter, an A-series isolation device, a B-series isolation device, a processor, a first communication BUS, and a second communication BUS;

[0015] One end of the second sampling resistor is connected to one end of the field instrument to form a first output end of the sampling resistor; the other end of the second sampling resistor is connected to one end of the first sampling resistor to form a second output end of the sampling resistor; the input end of the first V2 multiplexer and the input end of the second V2 multiplexer are respectively connected to the first output end; the input end of the first V1 multiplexer and the input end of the second V1 multiplexer are respectively connected to the second output end; the output end of the first V2 multiplexer is connected to the input end of the A series channel acquisition signal conditioning circuit to obtain the first analog quantity of the A series; the output end of the first V1 multiplexer is connected to the input end of the A series channel readback diagnosis conditioning circuit to obtain the second analog quantity of the A series; the output end of the second V2 multiplexer is connected to the input end of the B series channel acquisition signal conditioning circuit to obtain the first analog quantity of the B series; the output end of the second V1 multiplexer is connected to the input end of the B series channel readback diagnosis conditioning circuit to obtain The second analog quantity of the B series; the output ends of the A series channel acquisition signal conditioning circuit and the A series channel readback diagnostic conditioning circuit are connected to the input end of the A series multiplexer; the output ends of the B series channel acquisition signal conditioning circuit and the B series channel readback diagnostic conditioning circuit are connected to the input end of the B series multiplexer; the output end of the A series multiplexer is connected to the input end of the A series AD converter, and the A series AD converter converts the two analog quantities of the A series channel into two digital quantities of the A series; the output end of the A series AD converter is connected to one end of the A series isolation device; the output end of the B series multiplexer is connected to the input end of the B series AD converter, and the B series AD converter converts the two analog quantities of the B series channel into two digital quantities of the B series; the output end of the B series AD converter is connected to one end of the B series isolation device; the other ends of the A series isolation device and the B series isolation device are respectively connected to the input end of the processor; the output end of the processor is respectively connected to the first communication BUS and the second communication BUS.

[0016] Optionally, the circuit further comprises: a DAC diagnostic circuit and a DAC isolation device;

[0017] One end of the DAC diagnostic circuit is connected to the input end of the A series multiplexer and the input end of the B series multiplexer respectively; the other end of the DAC diagnostic circuit is connected to one end of the DAC isolation device; and the other end of the DAC isolation device is connected to the processor.

[0018] According to a second aspect of the present invention, a fault diagnosis method for a 1oo2 architecture safety analog quantity acquisition circuit is provided, comprising the 1oo2 architecture safety analog quantity acquisition circuit according to any one of the first aspects of the present invention, the method comprising:

[0019] The processor determines whether the A-series channel acquisition signal conditioning circuit or the A-series channel readback diagnosis conditioning circuit is faulty based on the two-channel digital quantities of the A-series channel;

[0020] The processor determines whether the B-series channel acquisition signal conditioning circuit or the B-series channel readback diagnosis conditioning circuit is faulty based on the two-channel digital quantity of the B-series channel;

[0021] The processor determines whether the first sampling resistor or the second sampling resistor is faulty based on the two digital quantities of the A series and the two digital quantities of the B series;

[0022] The processor determines whether the A series AD converter or the B series AD converter is faulty based on the first digital quantity of the A series and the first digital quantity of the B series.

[0023] Optionally, the method further includes:

[0024] The processor controls the DAC diagnostic circuit to output predefined analog quantities to the A series AD converter and the B series AD converter respectively, and determines which of the A series AD converter and the B series AD converter has a fault.

[0025] Optionally, the processor determines, based on the two-channel digital quantities of the A series, whether the A series channel acquisition signal conditioning circuit or the A series channel readback diagnosis conditioning circuit is faulty, including:

[0026] If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A is greater than the series A threshold, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B is less than the series B threshold, then the series A channel acquisition signal conditioning circuit or the series A channel readback diagnostic conditioning circuit is faulty.

[0027] Optionally, the processor determines, based on the two-channel digital quantities of the B series, whether a fault occurs in the B series channel acquisition signal conditioning circuit or the B series channel readback diagnosis conditioning circuit, including:

[0028] If the absolute value of the difference between the first digital quantity of the B series and the second digital quantity of the B series is greater than the B series threshold, and the absolute value of the difference between the first digital quantity of the A series and the second digital quantity of the A series is less than the A series threshold, then the B series channel acquisition signal conditioning circuit or the B series channel readback diagnostic conditioning circuit is faulty.

[0029] Optionally, the processor determines, based on the two digital quantities of series A and the two digital quantities of series B, that the first sampling resistor or the second sampling resistor is faulty, including:

[0030] If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A is greater than the series A threshold, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B is greater than the series B threshold, it is determined that the first sampling resistor or the second sampling resistor is faulty.

[0031] Optionally, the processor determining, based on the first digital quantity of the series A and the first digital quantity of the series B, whether the series A AD converter or the series B AD converter is faulty includes:

[0032] If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A is less than the series A threshold, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B is less than the series B threshold, but the absolute value of the difference between the first digital quantity of series A and the first digital quantity of series B is greater than the AB difference threshold, then it is judged that the series A AD converter or the series B AD converter is faulty.

[0033] Optionally, the processor controls the DAC diagnostic circuit to output predefined analog quantities to the A-series AD converter and the B-series AD converter respectively, and determines which of the A-series AD converter and the B-series AD converter has a fault, including:

[0034] The processor controls the DAC diagnostic circuit to output predefined analog quantities to the upper 8 bits of the A series AD converter and the B series AD converter respectively, to determine which AD converter of the A series AD converter and the B series AD converter has a fault.

[0035] Optionally, the processor controls the DAC diagnostic circuit to output predefined analog quantities to the upper 8 bits of the A-series AD converter and the B-series AD converter respectively, and determines which of the A-series AD converter and the B-series AD converter has a fault, including:

[0036] Perform a walking-bit test on the upper eight bits of the A-series AD converter and the B-series AD converter, and then perform a full-scale test after the walking-bit test to diagnose the stuck position fault and crosstalk fault of the A-series AD converter and the B-series AD converter.

[0037] The technical content disclosed in the present invention has the following beneficial effects: providing a modular quantity acquisition module with a channel-level 1oo2d architecture, an A / B redundant design, and each A / B system has its own readback diagnosis and redundant communication; providing a circuit hardware architecture of an analog quantity acquisition module with high security, high availability, and high diagnostic coverage, so that if one system fails, the other system can continue to be used; providing a method for diagnosing component failures in the hardware architecture, and being able to meet SIL3 level requirements.

[0038] Further features and advantages of the present invention will become apparent from the following detailed description of exemplary embodiments of the present invention with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.

[0040] Figure 1 The figure is a schematic diagram of a safe analog quantity acquisition circuit with a 1oo2 architecture provided according to an embodiment. DETAILED DESCRIPTION

[0041] Various exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be noted that unless otherwise specifically stated, the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention.

[0042] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.

[0043] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0044] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0045] It should be noted that like reference numerals and letters refer to like items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0046] According to the first aspect of the present invention, Figure 1 As shown, a 1oo2 architecture safety analog quantity acquisition circuit is provided, comprising a first sampling resistor ( Figure 1 R1 in), the second sampling resistor ( Figure 1 R2 in), the first V1 multiplexer ( Figure 1 V1MUX1 in), the second V1 multiplexer ( Figure 1 V1MUX2 in), the first V2 multiplexer ( Figure 1 V2MUX1 in), the second V2 multiplexer ( Figure 1 V2MUX2 in), A series channel acquisition signal conditioning circuit, B series channel acquisition signal conditioning circuit, A series channel readback diagnosis conditioning circuit, B series channel readback diagnosis conditioning circuit, A series multiplexer ( Figure 1 AMUX in), B series multiplexer ( Figure 1 BMUX in), A series AD converter ( Figure 1 A series ADC), B series AD converter ( Figure 1 B series ADC), A series isolation devices ( Figure 1 A isolation), B series isolation devices ( Figure 1 B isolation in), processor, first communication BUS ( Figure 1 Communication BUS1) and second communication BUS ( Figure 1 Communication BUS2);

[0047] One end of the second sampling resistor is connected to one end of the field instrument to form a first output end of the sampling resistor ( Figure 1 The other end of the second sampling resistor is connected to one end of the first sampling resistor to form a second output end of the sampling resistor ( Figure 1 V1 in the channel); the input end of the first V2 multiplexer and the input end of the second V2 multiplexer are respectively connected to the first output end; the input end of the first V1 multiplexer and the input end of the second V1 multiplexer are respectively connected to the second output end; the output end of the first V2 multiplexer is connected to the input end of the A series channel acquisition signal conditioning circuit to obtain the first analog quantity of the A series; the output end of the first V1 multiplexer is connected to the input end of the A series channel readback diagnosis conditioning circuit to obtain the second analog quantity of the A series; the output end of the second V2 multiplexer is connected to the input end of the B series channel acquisition signal conditioning circuit to obtain the first analog quantity of the B series; the output end of the second V1 multiplexer is connected to the input end of the B series channel readback diagnosis conditioning circuit to obtain the second analog quantity of the B series; the A series channel acquisition signal conditioning circuit and the A series channel readback diagnosis conditioning circuit The output end of the channel is connected to the input end of the A series multiplexer; the output end of the B series channel acquisition signal conditioning circuit and the B series channel readback diagnostic conditioning circuit are connected to the input end of the B series multiplexer; the output end of the A series multiplexer is connected to the input end of the A series AD converter, and the A series AD converter converts the two analog quantities of the A series channel into two digital quantities of the A series; the output end of the A series AD converter is connected to one end of the A series isolation device; the output end of the B series multiplexer is connected to the input end of the B series AD converter, and the B series AD converter converts the two analog quantities of the B series channel into two digital quantities of the B series; the output end of the B series AD converter is connected to one end of the B series isolation device; the other ends of the A series isolation device and the B series isolation device are respectively connected to the input end of the processor; the output end of the processor is respectively connected to the first communication BUS and the second communication BUS.

[0048] In some embodiments, the circuit further includes: a DAC diagnostic circuit and a DAC isolation device ( Figure 1 DAC isolation in the

[0049] One end of the DAC diagnostic circuit is connected to the input end of the A series multiplexer and the input end of the B series multiplexer respectively; the other end of the DAC diagnostic circuit is connected to one end of the DAC isolation device; and the other end of the DAC isolation device is connected to the processor.

[0050] Specifically, the first output terminal V2 of the sampling resistor is a collected value for data reporting, and the second output terminal V1 of the sampling resistor is a voltage of V1 that diagnoses the voltage of V2.

[0051] The voltage of the first output terminal V2 is sent to the input of V2MUX1 and also to the input of V2MUX2;

[0052] The output of V2MUX1 is sent to the A series channel signal acquisition signal conditioning circuit, which is then sent to AMUX. The AMUX output is sent to the A series ADC for acquisition, and the A series ADC is sent to the processor after A isolation.

[0053] The output of V2MUX2 is sent to the B series channel signal acquisition signal conditioning circuit, which is then sent to BMUX. The BMUX output is sent to the B series ADC for acquisition, and the B series ADC is sent to the processor after B isolation.

[0054] The voltage at the second output terminal V1 of the sampling resistor is sent to the input of V1MUX1 and also to the input of V1MUX2.

[0055] The output of V1MUX1 is sent to the A series channel readback diagnostic conditioning circuit, which then sends it to AMUX. The AMUX output is sent to the A series ADC for acquisition, which is then sent to the processor after A isolation.

[0056] The output of V1MUX2 is sent to the B-series channel readback diagnostic conditioning circuit, which then sends it to BMUX. The BMUX output is sent to the B-series ADC for acquisition, and the B-series ADC is sent to the processor after B isolation.

[0057] The processor diagnoses and analyzes the data of the two systems A and B, and processes the data by voting. After the data processing is completed, it is sent to the independent communication BUS1 and communication BUS2.

[0058] The A series V2 MUX1 switch and V1 MUX1 switch realize multi-channel signal switching, which can effectively reduce the cost of channel circuits. The subsequent circuit is a shared circuit for multiple channels.

[0059] The A-series channel acquisition signal conditioning circuit mainly includes impedance conversion and matching, signal filtering circuit, MUX multiplexer signal selection circuit, etc. The B-series channel acquisition signal conditioning circuit is the same as the A-series channel acquisition signal conditioning circuit.

[0060] The A-series channel readback diagnostic conditioning circuit primarily includes a signal amplifier circuit with an amplification factor of (1 + R2 / R1), a signal filter circuit, and a MUX multiplexer signal selection circuit. The B-series channel readback diagnostic conditioning circuit is identical to the A-series channel readback diagnostic conditioning circuit.

[0061] A MUX is for selecting the diagnostic signal source of A series V2, A series V1, and A series ADC. The AMUX switch can be multiple channel inputs.

[0062] The B series MUX is used to select the diagnostic signal source for the B series V2, B series V1, and B series ADC. The B series MUX switch can be used for multiple channel inputs.

[0063] Devices in series A and B are physically independent and do not constitute a common cause failure.

[0064] DAC isolation, A isolation, and B isolation refer to the electrical isolation of the circuit on the processor system side from the circuit on the channel signal acquisition side, and the isolation components are physically independent and do not cause common cause failures.

[0065] Communication BUS1 and communication BUS2 are two independent redundant buses, which report the collected data through the two independent buses and set the data quality bit according to the diagnosis results.

[0066] The processor is mainly responsible for controlling the acquisition signal, switching channels, reading data, data diagnosis and processing, etc.

[0067] According to a second aspect of the present invention, a fault diagnosis method for a safety analog quantity acquisition circuit with a 1oo2 architecture is provided, comprising the safety analog quantity acquisition circuit with a 1oo2 architecture according to any one of the first embodiments.

[0068] Based on the collected data, the data diagnosis results are judged and summarized as follows:

[0069] When a fault is diagnosed in system A, the value of system B is used for reporting;

[0070] When a fault is diagnosed in the B system, the value of the A system is used for reporting;

[0071] When the data collected by the two systems are inconsistent, DAC diagnosis is used to confirm which system is at fault, and the value of the non-faulty system is reported;

[0072] When a sampling resistor fault is diagnosed, a safety value of zero is reported.

[0073] Field instrument, providing analog output current (such as 4mA ~ 20mA);

[0074] R1 and R2 are sampling resistors for the analog input current, converting the input current signal into a voltage signal. Two sampling resistors are connected in series to diagnose random faults. If a single resistor is used for sampling, resistor drift and faults cannot be diagnosed. Therefore, the voltage V1 across R1 and the voltage V2 across R1 and R2 are collected and reported as analog values. The V1 voltage value serves as the diagnostic value for the V2 voltage. Both V1 and V2 voltage values ​​are collected by systems A and B. The values ​​collected by system A are recorded as A_V1 and A_V2; the values ​​collected by system B are recorded as B_V1 and B_V2.

[0075] The method includes: a processor judging a fault in a channel acquisition signal conditioning circuit of the A series or a channel readback diagnosis conditioning circuit of the A series according to two digital quantities (A_V1, A_V2) of the A series;

[0076] The processor determines whether the B-series channel acquisition signal conditioning circuit or the B-series channel readback diagnosis conditioning circuit is faulty based on the two digital quantities (B_V1, B_V2) of the B-series channel.

[0077] The processor determines whether the first sampling resistor or the second sampling resistor is faulty based on the two digital quantities of the A series and the two digital quantities of the B series;

[0078] The processor determines whether the A series AD converter or the B series AD converter is faulty based on the A series first digital quantity (A_V2) and the B series first digital quantity (B_V2).

[0079] In some embodiments, the method further comprises:

[0080] The processor controls the DAC diagnostic circuit to output predefined analog quantities to the A series AD converter and the B series AD converter respectively, and determines which of the A series AD converter and the B series AD converter has a fault.

[0081] In some embodiments, the processor determines, based on the two digital quantities of the A series, whether the A series channel acquisition signal conditioning circuit or the A series channel readback diagnosis conditioning circuit is faulty, including:

[0082] If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A (ΔVerr1 = |A_V2-A_V1|) is greater than the threshold value (safety accuracy) of series A, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B (ΔVerr2 = |B_V2-B_V1|) is less than the threshold value (safety accuracy) of series B, then the channel acquisition signal conditioning circuit of series A or the channel readback diagnostic conditioning circuit of series A is faulty.

[0083] In the application of SIS safety instrument systems, in the certification of functional safety SIL level, the functional safety IEC61508 standard has requirements for safety accuracy, which can be 1% of the full scale.

[0084] In some embodiments, the processor determines, based on the two digital quantities of the B series, whether a fault occurs in the B series channel acquisition signal conditioning circuit or the B series channel readback diagnosis conditioning circuit, including:

[0085] If the absolute value of the difference between the first digital quantity of the B series and the second digital quantity of the B series (ΔVerr2 = |B_V2-B_V1|) is greater than the B series threshold (safety accuracy), and the absolute value of the difference between the first digital quantity of the A series and the second digital quantity of the A series (ΔVerr1 = |A_V2-A_V1|) is less than the A series threshold, then the B series channel acquisition signal conditioning circuit or the B series channel readback diagnostic conditioning circuit is faulty.

[0086] In some embodiments, the processor determines, based on the two digital quantities of series A and the two digital quantities of series B, that the first sampling resistor or the second sampling resistor is faulty, including:

[0087] If the absolute value of the difference between the first digital quantity of system A and the second digital quantity of system A (ΔVerr1 = |A_V2-A_V1|) is greater than the threshold value (safety accuracy) of system A, and the absolute value of the difference between the first digital quantity of system B and the second digital quantity of system B (ΔVerr2 = |B_V2-B_V1|) is greater than the threshold value (safety accuracy) of system B, then it is determined that the first sampling resistor or the second sampling resistor is faulty.

[0088] In some embodiments, the processor determines, based on the first digital quantity of the series A and the first digital quantity of the series B, that the series A AD converter or the series B AD converter is faulty, including:

[0089] If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A (ΔVerr1 = |A_V2-A_V1|) is less than the threshold value (safety accuracy) of series A, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B (ΔVerr2 = |B_V2-B_V1|) is less than the threshold value (safety accuracy) of series B, but the absolute value of the difference between the first digital quantity of series A and the first digital quantity of series B (ΔVerr3 = |A_V2-B_V2|) is greater than the AB difference threshold value (safety accuracy), then it is judged that the A series AD converter or the B series AD converter is faulty.

[0090] ΔVerr3 exceeds the safety accuracy. One system is good and the other is bad. The two systems have inconsistent data collection. At this time, it is impossible to determine which system's data is normal. The traditional approach should be safety-oriented at this time. The analog acquisition module reports a safety value to the controller to ensure the safety of the system, but the module's availability is lost.

[0091] In this case, the method of this embodiment performs diagnosis of the ADC based on the DAC output voltage.

[0092] According to the IEC61508 functional safety standard for ADC diagnostics, ADC diagnostics must at least detect stuck-bit and crosstalk faults, rather than simply using a reference source for a simple back-test. A stuck-bit fault occurs when a bit in the ADC's internal conversion becomes stuck at "0" or "1," rendering it incapable of conversion. A crosstalk fault occurs when the conversion of a single bit within the ADC affects the conversion of other bits.

[0093] In some embodiments, the processor controls the DAC diagnostic circuit to output predefined analog quantities to the A-series AD converter and the B-series AD converter respectively, and determines which of the A-series AD converter and the B-series AD converter has a fault, including:

[0094] The processor controls the DAC diagnostic circuit to output predefined analog quantities to the upper 8 bits of the A series AD converter and the B series AD converter respectively, to determine which AD converter of the A series AD converter and the B series AD converter has a fault.

[0095] Specifically, the IEC61508 functional safety standard requires ADC diagnostics to include both stuck-position faults and crosstalk faults. For a 16-bit ADC, with a safety-related accuracy requirement of 1%, only the upper 8 bits of the ADC need to be diagnosed; the lower 8 bits lose accuracy due to inherent noise in the channel input.

[0096] In some embodiments, the processor controls the DAC diagnostic circuit to output predefined analog quantities to the upper 8 bits of the A-series AD converter and the B-series AD converter, respectively, and determines which of the A-series AD converter and the B-series AD converter has a fault, including:

[0097] Perform a walking-bit test on the upper eight bits of the A-series AD converter and the B-series AD converter, and then perform a full-scale test after the walking-bit test to diagnose the stuck position fault and crosstalk fault of the A-series AD converter and the B-series AD converter.

[0098] Specifically, the DAC output voltage sets one of the eight upper bits after ADC conversion to "1" and the other bits to "0." A walking-bit test is then performed on the eight upper bits, followed by a full-scale test. This allows diagnosis of ADC stuck-bit and crosstalk faults, as shown in Table 1.

[0099] Table 1

[0100] Steps DAC output voltage Corresponding ADC output code value after conversion (hexadecimal) 1 REF1 0x8000 2 REF2 0x4000 3 REF3 0x2000 4 REF4 0x1000 5 REF5 0x0800 6 REF6 0x0400 7 REF7 0x0200 8 REF8 0x0100 9 REF9 0xFF00

[0101] For the above walking-bit test, an example is given

[0102] Assume a 16-bit ADC with a reference voltage of 4.096V and a 12-bit DAC with an output range of 0-5V. Table 2 lists the minimum, typical, and maximum DAC output voltages required to achieve the desired bit conversion at each step.

[0103] Table 2

[0104]

[0105]

[0106] The circuit fault diagnosis summary is shown in Table 3.

[0107] Table 3

[0108]

[0109] Note: 0 means normal, 1 means exceeding the safety accuracy threshold.

[0110] Whether the above channel diagnostic measures can meet the requirements of IEC61508 standard and SIL3 level.

[0111] According to the diagnostic measures recommended in Table A.7 of IEC61508-2, the "Test Pattern" diagnostic coverage is high. The channel side of this module uses channel readback comparison diagnosis, inter-channel comparison diagnosis, ADC stuck fault and crosstalk fault diagnosis to achieve high diagnostic coverage, with a channel diagnostic coverage of 99%.

[0112] According to IEC61508-2 Table 3, when the channel circuit is Type B and the hardware fault margin (HFT) equals 1, the safe failure fraction required to achieve SIL3 is between 90% and 99%. This module has two channels, A and B, and can tolerate a failure in one channel. Therefore, the HFT is 1, and the module's channel diagnostic coverage is 99%, meeting the required safe failure fraction. Therefore, this module's channel-side diagnostics can meet SIL3 requirements.

[0113] In summary, the technical content disclosed in the present invention has the following beneficial effects: a modular quantity acquisition module with a channel-level 1oo2d architecture is provided, with an A / B redundant design, and each A / B system has its own readback diagnosis and redundant communication; a circuit hardware architecture of an analog quantity acquisition module with high security, high availability, and high diagnostic coverage is provided, and if one system fails, the other system can continue to be used; a low-cost solution is provided, in which an independent MUX switch is used in the front stage to switch and output multiple channel signals, and the back-stage circuit is shared by multiple channels, reducing circuit costs; a method for diagnosing device failures in the hardware architecture is provided, and can meet SIL3 level requirements.

[0114] Although some specific embodiments of the present invention have been described in detail by way of examples, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present invention. It should be understood by those skilled in the art that modifications may be made to the above embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A 1oo2 architecture safety analog quantity acquisition circuit, characterized in that: include: A first sampling resistor, a second sampling resistor, a first V1 multiplexer, a second V1 multiplexer, a first V2 multiplexer, a second V2 multiplexer, an A-series channel acquisition signal conditioning circuit, a B-series channel acquisition signal conditioning circuit, an A-series channel readback diagnostic conditioning circuit, a B-series channel readback diagnostic conditioning circuit, an A-series multiplexer, a B-series multiplexer, an A-series AD converter, a B-series AD converter, an A-series isolation device, a B-series isolation device, a processor, a first communication BUS, and a second communication BUS; One end of the second sampling resistor is connected to one end of the field instrument to form a first output end of the sampling resistor; The other end of the second sampling resistor is connected to one end of the first sampling resistor to form a second output end of the sampling resistor; The input end of the first V2 multiplexer and the input end of the second V2 multiplexer are respectively connected to the first output end; The input terminal of the first V1 multiplexer and the input terminal of the second V1 multiplexer are respectively connected to the second output terminal; The output end of the first V2 multiplexer is connected to the input end of the A series channel acquisition signal conditioning circuit to obtain the first channel analog signal of the A series; The output end of the first V1 multiplexer is connected to the input end of the A series channel readback diagnosis conditioning circuit to obtain the second channel analog value of the A series; The output end of the second V2 multiplexer is connected to the input end of the B series channel acquisition signal conditioning circuit to obtain the first channel analog quantity of the B series; The output end of the second V1 multiplexer is connected to the input end of the B series channel readback diagnosis conditioning circuit to obtain the second analog quantity of the B series; the output end of the A series channel acquisition signal conditioning circuit and the A series channel readback diagnosis conditioning circuit are connected to the input end of the A series multiplexer; the output end of the B series channel acquisition signal conditioning circuit and the B series channel readback diagnosis conditioning circuit are connected to the input end of the B series multiplexer; the output end of the A series multiplexer is connected to the input end of the A series AD converter, and the A series AD converter converts the two analog quantities of the A series channel into analog quantities. The output end of the A series AD converter is connected to one end of the A series isolation device; the output end of the B series multiplexer is connected to the input end of the B series AD converter, and the B series AD converter converts the two analog quantities of the B series channel into two digital quantities of the B series; the output end of the B series AD converter is connected to one end of the B series isolation device; the other ends of the A series isolation device and the B series isolation device are respectively connected to the input end of the processor; the output end of the processor is respectively connected to the first communication BUS and the second communication BUS.

2. The 1oo2 architecture safety analog quantity acquisition circuit according to claim 1, characterized in that: The circuit further comprises: a DAC diagnostic circuit and a DAC isolation device; One end of the DAC diagnostic circuit is connected to the input end of the A series multiplexer and the input end of the B series multiplexer respectively; the other end of the DAC diagnostic circuit is connected to one end of the DAC isolation device; and the other end of the DAC isolation device is connected to the processor.

3. A fault diagnosis method for a 1oo2 architecture safety analog quantity acquisition circuit, characterized in that: The secure analog quantity acquisition circuit comprising the 1oo2 architecture according to any one of claims 1 to 2, wherein the method comprises: The processor determines whether the A-series channel acquisition signal conditioning circuit or the A-series channel readback diagnosis conditioning circuit is faulty based on the two-channel digital quantities of the A-series channel; The processor determines whether the B-series channel acquisition signal conditioning circuit or the B-series channel readback diagnosis conditioning circuit is faulty based on the two-channel digital quantity of the B-series channel; The processor determines whether the first sampling resistor or the second sampling resistor is faulty based on the two digital quantities of the A series and the two digital quantities of the B series; The processor determines whether the A series AD converter or the B series AD converter is faulty based on the first digital quantity of the A series and the first digital quantity of the B series.

4. The fault diagnosis method for the 1oo2 architecture safety analog quantity acquisition circuit according to claim 3, characterized in that: The method further comprises: The processor controls the DAC diagnostic circuit to output predefined analog quantities to the A series AD converter and the B series AD converter respectively, and determines which of the A series AD converter and the B series AD converter has a fault.

5. The fault diagnosis method for the 1oo2 architecture safety analog quantity acquisition circuit according to claim 3, characterized in that: The processor determines, based on the two-channel digital quantities of the A series, whether the A series channel acquisition signal conditioning circuit or the A series channel readback diagnosis conditioning circuit is faulty, including: If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A is greater than the series A threshold, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B is less than the series B threshold, then the series A channel acquisition signal conditioning circuit or the series A channel readback diagnostic conditioning circuit is faulty.

6. The fault diagnosis method for the 1oo2 architecture safety analog quantity acquisition circuit according to claim 3, characterized in that: The processor determines, based on the two digital quantities of the B series, whether a fault occurs in the B series channel acquisition signal conditioning circuit or the B series channel readback diagnosis conditioning circuit. If the absolute value of the difference between the first digital quantity of the B series and the second digital quantity of the B series is greater than the B series threshold, and the absolute value of the difference between the first digital quantity of the A series and the second digital quantity of the A series is less than the A series threshold, then the B series channel acquisition signal conditioning circuit or the B series channel readback diagnostic conditioning circuit is faulty.

7. The fault diagnosis method for the 1oo2 architecture safety analog quantity acquisition circuit according to claim 3, characterized in that: The processor determines, based on the two digital quantities of the A series and the two digital quantities of the B series, that the first sampling resistor or the second sampling resistor is faulty, including: If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A is greater than the series A threshold, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B is greater than the series B threshold, it is determined that the first sampling resistor or the second sampling resistor is faulty.

8. The fault diagnosis method for the 1oo2 architecture safety analog quantity acquisition circuit according to claim 3, characterized in that: The processor determines, based on the first digital quantity of the series A and the first digital quantity of the series B, that the AD converter of the series A or the AD converter of the series B is faulty, including: If the absolute value of the difference between the first digital quantity of series A and the second digital quantity of series A is less than the series A threshold, and the absolute value of the difference between the first digital quantity of series B and the second digital quantity of series B is less than the series B threshold, but the absolute value of the difference between the first digital quantity of series A and the first digital quantity of series B is greater than the AB difference threshold, then it is judged that the series A AD converter or the series B AD converter is faulty.

9. The fault diagnosis method for a 1oo2 architecture safety analog quantity acquisition circuit according to claim 4, characterized in that: The processor controls the DAC diagnostic circuit to output predefined analog quantities to the A series AD converter and the B series AD converter respectively, and determines which of the A series AD converter and the B series AD converter has a fault, including: The processor controls the DAC diagnostic circuit to output predefined analog quantities to the upper 8 bits of the A series AD converter and the B series AD converter respectively, to determine which AD converter of the A series AD converter and the B series AD converter has a fault.

10. The fault diagnosis method for a 1oo2 architecture safety analog quantity acquisition circuit according to claim 4, characterized in that: The processor controls the DAC diagnostic circuit to output predefined analog quantities to the upper 8 bits of the A series AD converter and the B series AD converter respectively, and determines which of the A series AD converter and the B series AD converter has a fault, including: Perform a walking-bit test on the upper eight bits of the A-series AD converter and the B-series AD converter, and then perform a full-scale test after the walking-bit test to diagnose the stuck position fault and crosstalk fault of the A-series AD converter and the B-series AD converter.

Images