Safety analog quantity acquisition circuit of 1oo2 architecture and fault diagnosis method

Abstract

The application discloses a safety analog quantity acquisition circuit of a 1oo2 architecture and a fault diagnosis method, and relates to the technical field of safety analog quantity acquisition circuits.The safety analog quantity acquisition circuit comprises a 1oo2 architecture, and when one channel fails, the other channel can still guarantee system operation, has high diagnosis coverage, can diagnose the failure of devices on a signal input link in real time, that is, can diagnose the failure of analog quantity sampling resistors, channel signal conditioning circuits, ADC acquisition circuits and the like, and thus solves the safety of the module and the availability of the module, has high diagnosis coverage, can reach the certification of the functional safety IEC61508 standard SIL3 level, and solves the technical problems of high cost of a 2oo3 architecture technology and poor availability of a 1oo1 architecture technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial automation, more particularly, to a safety analog quantity acquisition circuit of 1oo2 architecture and a fault diagnosis method. BACKGROUND

[0002] In an industrial automation control system, an analog quantity acquisition module is an important module in a distributed control system (DCS) and a safety instrumented system (SIS), and is commonly used for 4-20 mA current acquisition of sensor outputs such as field temperature, pressure, and flow. In actual use, device failure caused by various reasons such as humidity, pressure, temperature, aging, and other environmental conditions will cause the device to fail. If the device failure is not diagnosed, the acquisition value will be reported incorrectly, which will cause the DCS (Distributed Control System) or SIS (Safety Instrumented System) output to execute abnormally, causing the production device to shut down, resulting in a catastrophic safety consequence and causing serious economic losses.

[0003] PRIOR ART

[0004] Patent No. CN202411407141.5, this patent invents two independent AI acquisition modules, which diagnose the ADC circuit by comparing the acquisition values,

[0005] Patent No. CN 108226762 A, this patent also diagnoses the ADC circuit, and cannot diagnose the sampling resistor at the input end and the conditioning circuit of the input signal.

[0006] Patent No. CN 119363112 A, this invention diagnoses the clamping fault of the ADC, and needs to use a differential ADC to collect the signal, and uses a differential complementary method to determine whether the collected binary code value is complementary.

[0007] Patent No. CN 116846395 A: This invention can automatically check whether the acquisition channel has precision deviation or fault by comparing with the reference voltage.

[0008] Disadvantages of prior art

[0009] 1oo1 (1 out of 1) architecture has low safety, single-point failure will cause system failure, poor availability, no fault diagnosis, may cause the system to fail without warning, cannot tolerate faults, once there is a fault, it will lead to safety, which will cause the system to trip and shut down, causing huge losses to the user.

[0010] 2oo3 (2 out of 3) architecture has the highest cost, requires three times the hardware and software resources to implement, complex design, and also requires complex logic and algorithms to implement the voting mechanism, can tolerate single-point failure.

[0011] Therefore, how to provide a 1oo2 architecture safety analog quantity acquisition circuit and a fault diagnosis method become technical problems to be solved in the field. SUMMARY

[0012] The purpose of the present application is to provide a 1oo2 architecture safety analog quantity acquisition circuit and a fault diagnosis method.

[0013] According to a first aspect of the present application, a 1oo2 architecture safety analog quantity acquisition circuit is provided, comprising,

[0014] The first sampling resistor, the second sampling resistor, the first V1 multiplexer, the second V1 multiplexer, the first V2 multiplexer, the second V2 multiplexer, the A system channel acquisition signal conditioning circuit, the B system channel acquisition signal conditioning circuit, the A system channel readback diagnosis conditioning circuit, the B system channel readback diagnosis conditioning circuit, the A system multiplexer, the B system multiplexer, the A system AD converter, the B system AD converter, the A system isolation device, the B system isolation device, the processor, the first communication BUS and the second communication BUS;

[0015] One end of the second sampling resistor is connected with one end of the field instrument to form a first output end of the sampling resistor; the other end of the second sampling resistor is connected with one end of the first sampling resistor to form a second output end of the sampling resistor; the input end of the first V2 multiplexer and the input end of the second V2 multiplexer are connected with the first output end respectively; the input end of the first V1 multiplexer and the input end of the second V1 multiplexer are connected with the second output end respectively; the output end of the first V2 multiplexer is connected with the input end of the A system channel signal acquisition and conditioning circuit to obtain the first analog quantity of the A system; the output end of the first V1 multiplexer is connected with the input end of the A system channel readback diagnosis conditioning circuit to obtain the second analog quantity of the A system; the output end of the second V2 multiplexer is connected with the input end of the B system channel signal acquisition and conditioning circuit to obtain the first analog quantity of the B system; the output end of the second V1 multiplexer is connected with the input end of the B system channel readback diagnosis conditioning circuit to obtain the second analog quantity of the B system; the output ends of the A system channel signal acquisition and conditioning circuit and the A system channel readback diagnosis conditioning circuit are connected with the input end of the A system multiplexer; the output ends of the B system channel signal acquisition and conditioning circuit and the B system channel readback diagnosis conditioning circuit are connected with the input end of the B system multiplexer; the output end of the A system multiplexer is connected with the input end of the A system AD converter, and the A system AD converter converts the two analog quantities of the A system channel into two digital quantities of the A system; the output end of the A system AD converter is connected with one end of the A system isolation device; the output end of the B system multiplexer is connected with the input end of the B system AD converter, and the B system AD converter converts the two analog quantities of the B system channel into two digital quantities of the B system; the output end of the B system AD converter is connected with one end of the B system isolation device; the other ends of the A system isolation device and the B system isolation device are connected with the input end of the processor respectively; and the output end of the processor is connected with the first communication BUS and the second communication BUS respectively.

[0016] Optionally, the circuit further comprises a DAC diagnosis circuit and a DAC isolation device.

[0017] One end of the DAC diagnosis circuit is connected with the input end of the A system multiplexer and the input end of the B system multiplexer respectively; the other end of the DAC diagnosis circuit is connected with one end of the DAC isolation device; and the other end of the DAC isolation device is connected with the processor.

[0018] According to a second aspect of the present application, a fault diagnosis method of a 1oo2 architecture safety analog quantity acquisition circuit is provided, comprising the 1oo2 architecture safety analog quantity acquisition circuit according to any one of the first aspect of the present application, and the method comprises:

[0019] The processor judges the A-channel signal acquisition signal conditioning circuit or the A-channel readback diagnosis conditioning circuit fault according to the two-way digital quantity of the A system.

[0020] The processor judges the B-channel signal acquisition signal conditioning circuit or the B-channel readback diagnosis conditioning circuit fault according to the two-way digital quantity of the B system.

[0021] The processor judges the first sampling resistor or the second sampling resistor fault according to the two-way digital quantity of the A system and the two-way digital quantity of the B system.

[0022] The processor judges the A-AD converter or the B-AD converter fault according to the first-way digital quantity of the A system and the first-way digital quantity of the B system.

[0023] Optionally, the method further comprises:

[0024] The processor controls the DAC diagnosis circuit to output the predefined analog quantity to the A-AD converter and the B-AD converter respectively, and judges which AD converter of the A-AD converter and the B-AD converter has a fault.

[0025] Optionally, the processor judges the A-channel signal acquisition signal conditioning circuit or the A-channel readback diagnosis conditioning circuit fault according to the two-way digital quantity of the A system, and the method comprises:

[0026] If the absolute value of the difference between the first-way digital quantity of the A system and the second-way digital quantity of the A system is greater than the A-system threshold value, and the absolute value of the difference between the first-way digital quantity of the B system and the second-way digital quantity of the B system is less than the B-system threshold value, then the A-channel signal acquisition signal conditioning circuit or the A-channel readback diagnosis conditioning circuit has a fault.

[0027] Optionally, the processor judges the B-channel signal acquisition signal conditioning circuit or the B-channel readback diagnosis conditioning circuit fault according to the two-way digital quantity of the B system, and the method comprises:

[0028] If the absolute value of the difference between the first-way digital quantity of the B system and the second-way digital quantity of the B system is greater than the B-system threshold value, and the absolute value of the difference between the first-way digital quantity of the A system and the second-way digital quantity of the A system is less than the A-system threshold value, then the B-channel signal acquisition signal conditioning circuit or the B-channel readback diagnosis conditioning circuit has a fault.

[0029] Optionally, the processor judges the first sampling resistor or the second sampling resistor fault according to the two-way digital quantity of the A system and the two-way digital quantity of the B system, and the method comprises:

[0030] If the absolute value of the difference between the first-way digital quantity of the A system and the second-way digital quantity of the A system is greater than the A-system threshold value, and the absolute value of the difference between the first-way digital quantity of the B system and the second-way digital quantity of the B system is greater than the B-system threshold value, then the first sampling resistor or the second sampling resistor has a fault.

[0031] Optionally, the processor judges the A-system AD converter or the B-system AD converter to be faulty according to the first-path digital quantity of the A system and the first-path digital quantity of the B system, including:

[0032] If the absolute value of the difference between the first-path digital quantity of the A system and the second-path digital quantity of the A system is less than the threshold value of the A system, and the absolute value of the difference between the first-path digital quantity of the B system and the second-path digital quantity of the B system is less than the threshold value of the B system, but the absolute value of the difference between the first-path digital quantity of the A system and the first-path digital quantity of the B system is greater than the AB difference threshold value, the processor judges the A-system AD converter or the B-system AD converter to be faulty.

[0033] Optionally, the processor controls the DAC diagnosis circuit to output the predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and judges which of the A-system AD converter and the B-system AD converter is faulty, including:

[0034] The processor controls the DAC diagnosis circuit to output the predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and judges which of the A-system AD converter and the B-system AD converter is faulty.

[0035] Optionally, the processor controls the DAC diagnosis circuit to output the predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and judges which of the A-system AD converter and the B-system AD converter is faulty, including:

[0036] The high 8 bits of the A-system AD converter and the B-system AD converter are subjected to a walking-bit test, and after the walking-bit test, a full-scale test is performed again to diagnose the jamming fault and the crosstalk fault of the A-system AD converter and the B-system AD converter.

[0037] According to the technical content disclosed in the present application, the following beneficial effects are achieved: a module quantity acquisition module with a channel level 1oo2d architecture is provided, A / B two-system redundancy design is provided, and each of the A / B two systems has its own readback diagnosis and redundant communication; a circuit hardware architecture of an analog quantity acquisition module with high safety, high availability and high diagnostic coverage is provided, and when one system fails, the other system can continue to be used; a method for diagnosing the failure of a device on the hardware architecture is provided, and the method can meet the SIL3 level requirement.

[0038] Other features and advantages of the present application will become apparent from the following detailed description of exemplary embodiments thereof, taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0039] The accompanying drawings incorporated in and forming a part of the specification, illustrate embodiments of the present application and, together with the description, serve to explain the principles of the application.

[0040] Figure 1 A schematic diagram of a safety analog acquisition circuit of a 1oo2 architecture according to an embodiment. DETAILED DESCRIPTION

[0041] Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangements, numerical expressions, and numerical values of components and steps set forth in these embodiments are not limiting to the scope of the present application unless otherwise specifically stated.

[0042] The following description of at least one exemplary embodiment is merely exemplary in nature and is in no way intended to limit the scope of the application, its application, or uses.

[0043] Techniques, methods, and apparatus known to those of ordinary skill in the relevant art can not be discussed in detail herein. However, where appropriate, such techniques, methods, and apparatus should be considered as being part of the specification.

[0044] In all of the examples shown and discussed herein, any specific values should be interpreted as merely exemplary and not limiting. Thus, other examples of the exemplary embodiments can have different values.

[0045] It should be noted that like references and characters herein relate to like items throughout the figures, and once an item is defined in one figure, it need not be discussed further in subsequent figures.

[0046] According to a first aspect of the present application, as shown in Figure 1 there is provided a safety analog acquisition circuit of a 1oo2 architecture, comprising, a first sampling resistor (R1) in Figure 1 , a second sampling resistor (R2) in Figure 1 , a first V1 multiplexer (V1 MUX1) in Figure 1 , a second V1 multiplexer (V1 MUX2) in Figure 1 , a first V2 multiplexer (V2 MUX1) in Figure 1 , a second V2 multiplexer (V2 MUX2) in Figure 1 , an A-system channel acquisition signal conditioning circuit, a B-system channel acquisition signal conditioning circuit, an A-system channel readback diagnostic conditioning circuit, a B-system channel readback diagnostic conditioning circuit, an A-system multiplexer (AMUX) in Figure 1 , a B-system multiplexer (BMUX) in Figure 1 , an A-system AD converter (A-system ADC) in Figure 1 , a B-system AD converter (B-system ADC) in Figure 1 , an A-system isolation device (A-isolation) in Figure 1 , a B-system isolation device (B-isolation) inFigure 1 (B isolation in the middle), processor, first communication BUS ( Figure 1 Communication BUS1 and the second communication BUS ( Figure 1 (BUS2 in the communication)

[0047] One end of the second sampling resistor is connected to one end of the field instrument, forming the first output terminal of the sampling resistor. Figure 1 V2); the other end of the second sampling resistor is connected to one end of the first sampling resistor to form the second output terminal of the sampling resistor (V2); Figure 1 The input terminals of the first V2 multiplexer and the second V2 multiplexer are respectively connected to the first output terminal; the input terminals of the first V1 multiplexer and the second V1 multiplexer are respectively connected to the second output terminal; the output terminal of the first V2 multiplexer is connected to the input terminal of the A-system channel acquisition signal conditioning circuit to obtain the first analog signal of the A-system; the output terminal of the first V1 multiplexer is connected to the input terminal of the A-system channel readback diagnostic conditioning circuit to obtain the second analog signal of the A-system; the output terminal of the second V2 multiplexer is connected to the input terminal of the B-system channel acquisition signal conditioning circuit to obtain the first analog signal of the B-system; the output terminal of the second V1 multiplexer is connected to the input terminal of the B-system channel readback diagnostic conditioning circuit to obtain the second analog signal of the B-system; the A-system channel acquisition signal conditioning circuit and the A-system channel readback diagnostic conditioning circuit... The output of the circuit is connected to the input of the A-series multiplexer; the outputs of the B-series channel acquisition signal conditioning circuit and the B-series channel readback diagnostic conditioning circuit are connected to the input of the B-series multiplexer; the output of the A-series multiplexer is connected to the input of the A-series AD converter, which converts two analog signals from the A-series channel into two digital signals from the A-series channel; the output of the A-series AD converter is connected to one end of the A-series isolation device; the output of the B-series multiplexer is connected to the input of the B-series AD converter, which converts two analog signals from the B-series channel into two digital signals from the B-series channel; the output of the B-series AD converter is connected to one end of the B-series isolation device; the other ends of the A-series and B-series isolation devices are respectively connected to the input of the processor; the output of the processor is respectively connected to the first communication BUS and the second communication BUS.

[0048] In some embodiments, the circuit further includes: a DAC diagnostic circuit and a DAC isolation device. Step number (DAC isolation in the middle);

[0049] One end of the DAC diagnostic circuit is connected with the input end of the A system multiplexer and the input end of the B system multiplexer respectively; the other end of the DAC diagnostic circuit is connected with one end of the DAC isolation device; the other end of the DAC isolation device is connected with the processor.

[0050] Specifically, the first output end V2 of the sampling resistor is the collection value of data reporting, and the second output end V1 of the sampling resistor is the diagnosis voltage of the V2 voltage.

[0051] The first output end V2 voltage is sent to the V2 MUX1 input, and also to the V2 MUX2 input;

[0052] The V2 MUX1 output is sent to the A system channel signal collection signal conditioning circuit, and then to the A MUX, and the A MUX output is sent to the A system ADC collection, and the A system ADC is sent to the processor after passing through the A isolation;

[0053] The V2 MUX2 output is sent to the B system channel signal collection signal conditioning circuit, and then to the B MUX, and the B MUX output is sent to the B system ADC collection, and the B system ADC is sent to the processor after passing through the B isolation;

[0054] The second output end V1 voltage of the sampling resistor is sent to the V1 MUX1 input, and also to the V1 MUX2 input;

[0055] The V1 MUX1 output is sent to the A system channel read-back diagnosis conditioning circuit, and then to the A MUX, and the A MUX output is sent to the A system ADC collection, and the A system ADC is sent to the processor after passing through the A isolation;

[0056] The V1 MUX2 output is sent to the B system channel read-back diagnosis conditioning circuit, and then to the B MUX, and the B MUX output is sent to the B system ADC collection, and the B system ADC is sent to the processor after passing through the B isolation;

[0057] The processor diagnoses and analyzes the data of the A and B systems, and makes a decision. After the data processing is completed, it is sent to the independent communication BUS1 and communication BUS2.

[0058] The A system V2 MUX1 switch and the V1 MUX1 switch realize multi-channel signal switching, which can effectively reduce the cost of the channel circuit, and the rear circuit is a common circuit for multiple channels.

[0059] The A system channel collection signal conditioning circuit mainly includes impedance conversion matching, signal filter circuit, MUX multiplexer signal selection circuit, etc. The B system channel collection signal conditioning circuit is consistent with the A system channel collection signal conditioning circuit.

[0060] A system channel read back diagnosis conditioning circuit: mainly includes signal amplification circuit, the amplification multiple is (1+R2 / R1), signal filter circuit, MUX multiplexer signal selection circuit, etc. The B system channel read back diagnosis conditioning circuit is consistent with the A system channel read back diagnosis conditioning circuit.

[0061] The A MUX selects A system V2, A system V1 and A system ADC diagnosis signal source, and the AMUX switch can be multiple channel input.

[0062] The B system MUX selects B system V2, B system V1 and B system ADC diagnosis signal source, and the B system MUX switch can be multiple channel input.

[0063] The A and B systems are physically independent and do not constitute common cause failure.

[0064] The DAC isolation, A isolation and B isolation refer to that the circuit on the processor system side is electrically isolated from the circuit on the channel signal acquisition side, and the isolation devices are physically independent and do not constitute common cause failure.

[0065] The communication BUS1 and the communication BUS2 are two independent redundant buses, the collected data are reported through the two independent buses, and the data quality bit is set according to the diagnosis result.

[0066] The processor is mainly responsible for signal acquisition control, channel switching, data reading, data diagnosis processing and the like.

[0067] According to the second aspect of the present application, a fault diagnosis method of a 1oo2 architecture safety analog quantity acquisition circuit is provided, including the 1oo2 architecture safety analog quantity acquisition circuit in any one of the embodiments.

[0068] According to the collected data, the data diagnosis result is judged, and the summary is as follows:

[0069] When it is diagnosed that the A system has a fault, the value of the B system is reported;

[0070] When it is diagnosed that the B system has a fault, the value of the A system is reported;

[0071] When it is compared that the two systems are inconsistent, the DAC diagnosis is used to confirm which system has a fault, and the value of the non-fault system is reported;

[0072] When it is diagnosed that the sampling resistor has a fault, the safety value zero is reported.

[0073] The field instrument provides an analog output current (such as 4mA-20mA);

[0074] R1, R2 are sampling resistors of analog input current, which convert input current signal into voltage signal; two series of sampling resistors are needed, mainly to diagnose random failure of sampling resistor. If one resistor is used for sampling, resistor drift and resistor failure cannot be diagnosed, so the voltage V1 between R1 and the voltage V2 between R1 and R2 are collected. The V2 voltage value is analog collection and reporting value, and the V1 voltage value is the diagnosis value of the V2 voltage. The V1 and V2 voltage values are collected by A and B systems. The A system collection values are denoted as A_V1 and A_V2, and the B system collection values are denoted as B_V1 and B_V2.

[0075] The method comprises: the processor judges A system channel signal collection and conditioning circuit or A system channel readback diagnosis conditioning circuit failure according to two-way digital quantity (A_V1, A_V2) of the A system;

[0076] The processor judges B system channel signal collection and conditioning circuit or B system channel readback diagnosis conditioning circuit failure according to two-way digital quantity (B_V1, B_V2) of the B system;

[0077] The processor judges first sampling resistor or second sampling resistor failure according to two-way digital quantity of the A system and two-way digital quantity of the B system;

[0078] The processor judges A system AD converter or B system AD converter failure according to first-way digital quantity (A_V2) of the A system and first-way digital quantity (B_V2) of the B system.

[0079] In some embodiments, the method further comprises:

[0080] The processor controls the DAC diagnosis circuit to output predefined analog quantity to the A system AD converter and the B system AD converter respectively, and judges which AD converter of the A system AD converter and the B system AD converter has failure.

[0081] In some embodiments, the processor judges A system channel signal collection and conditioning circuit or A system channel readback diagnosis conditioning circuit failure according to two-way digital quantity of the A system comprises:

[0082] If the absolute value of the difference between the first-way digital quantity of the A system and the second-way digital quantity of the A system (ΔVerr1 = |A_V2-A_V1|) is greater than the threshold value (safety precision) of the A system, and the absolute value of the difference between the first-way digital quantity of the B system and the second-way digital quantity of the B system (ΔVerr2 = |B_V2-B_V1|) is less than the threshold value (safety precision) of the B system, the A system channel signal collection and conditioning circuit or the A system channel readback diagnosis conditioning circuit has failure.

[0083] In the application of SIS safety instrument system, in the authentication of meeting functional safety SIL level, the functional safety IEC61508 standard has requirements for safety precision, which can be 1% precision of full range.

[0084] In some embodiments, the processor determines the fault of the B-system channel signal acquisition and conditioning circuit or the B-system channel readback diagnosis conditioning circuit according to the B-system two-way digital quantity, including:

[0085] If the absolute value of the difference between the B-system first-way digital quantity and the B-system second-way digital quantity (ΔVerr2=|B_V2-B_V1|) is greater than the B-system threshold value (safety precision), and the absolute value of the difference between the A-system first-way digital quantity and the A-system second-way digital quantity (ΔVerr1=|A_V2-A_V1|) is less than the A-system threshold value, the B-system channel signal acquisition and conditioning circuit or the B-system channel readback diagnosis conditioning circuit is determined to be faulty.

[0086] In some embodiments, the processor determines the fault of the first sampling resistor or the second sampling resistor according to the A-system two-way digital quantity and the B-system two-way digital quantity, including:

[0087] If the absolute value of the difference between the A-system first-way digital quantity and the A-system second-way digital quantity (ΔVerr1=|A_V2-A_V1|) is greater than the A-system threshold value (safety precision), and the absolute value of the difference between the B-system first-way digital quantity and the B-system second-way digital quantity (ΔVerr2=|B_V2-B_V1|) is greater than the B-system threshold value (safety precision), the first sampling resistor or the second sampling resistor is determined to be faulty.

[0088] In some embodiments, the processor determines the fault of the A-system AD converter or the B-system AD converter according to the A-system first-way digital quantity and the B-system first-way digital quantity, including:

[0089] If the absolute value of the difference between the A-system first-way digital quantity and the A-system second-way digital quantity (ΔVerr1=|A_V2-A_V1|) is less than the A-system threshold value (safety precision), and the absolute value of the difference between the B-system first-way digital quantity and the B-system second-way digital quantity (ΔVerr2=|B_V2-B_V1|) is less than the B-system threshold value (safety precision), but the absolute value of the difference between the A-system first-way digital quantity and the B-system first-way digital quantity (ΔVerr3=|A_V2-B_V2|) is greater than the AB difference threshold value (safety precision), the A-system AD converter or the B-system AD converter is determined to be faulty.

[0090] ΔVerr3 exceeds the safety precision, one system is good and the other system is bad, and the two systems appear inconsistent acquisition, at this time it is impossible to determine which system's data is normal, the traditional method should be directed to safety at this time, the analog quantity acquisition module reports a safety value to the controller, thereby ensuring the safety of the system, but the availability of the module is lost.

[0091] The practice of this embodiment performs DAC output voltage diagnosis for ADC in this case.

[0092] According to the requirements of the functional safety IEC61508 standard for ADC diagnosis, ADC diagnosis at least needs to diagnose card bit failure and crosstalk failure, rather than using a reference source to make a simple back sampling judgment. Card bit failure refers to a certain bit of the ADC internal conversion being fixed to "0" or "1", and this bit no longer has conversion capability. Crosstalk failure refers to the conversion of a certain bit of the ADC affecting the conversion of other bits.

[0093] In some embodiments, the processor controls the DAC diagnosis circuit to output a predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and the determination of which of the A-system AD converter and the B-system AD converter has a failure includes:

[0094] The processor controls the DAC diagnosis circuit to output a predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and the determination of which of the A-system AD converter and the B-system AD converter has a failure includes:

[0095] Specifically, according to the requirements of the functional safety IEC61508 standard for ADC diagnosis, the diagnosis of the ADC requires both diagnosis of card bit failure of the ADC and diagnosis of crosstalk failure of the ADC. For a 16-bit ADC, when the safety-related accuracy is required to be 1%, only the high 8 bits of the ADC need to be diagnosed, and the low 8 bits lose accuracy due to the inherent noise of the channel input.

[0096] In some embodiments, the processor controls the DAC diagnosis circuit to output a predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and the determination of which of the A-system AD converter and the B-system AD converter has a failure includes:

[0097] The high eight bits of the A-system AD converter and the B-system AD converter are subjected to walking-bit testing, and after walking-bit testing, a full-scale test is performed again to diagnose card bit failure and crosstalk failure of the A-system AD converter and the B-system AD converter.

[0098] Specifically, the voltage output by the DAC causes a certain bit of the high eight bits of the ADC to be "1" and the other bits to be "0" after conversion, the high eight bits are subjected to walking-bit testing, and after walking-bit testing, a full-scale test is performed again, thereby diagnosing card bit failure and crosstalk failure of the ADC. See Table 1.

[0099] Table 1

[0100] DAC output voltage Corresponding output code value (hexadecimal) after ADC conversion REF1 1 REF2 0x8000 2 REF3 0x4000 3 REF4 0x2000 4 REF5 0x1000 5 REF6 0x0800 6 REF7 0x0400 7 REF8 0x0200 8 REF9 0x0100 9 0xFF00 ​

[0101] For the above walking-bit test, an example is given

[0102] Assume that the ADC is 16-bit, the ADC reference voltage value is 4.096V; the DAC is 12-bit, the output range is 0-5V. Table 2 lists the minimum voltage, typical voltage value, maximum voltage value of each step of the DAC output that can achieve the required bit conversion of the ADC.

[0103] Table 2

[0104]

[0105]

[0106] The circuit fault diagnosis summary is shown in Table 3.

[0107] Table 3

[0108]

[0109] Note: 0 is normal, 1 is beyond the safety precision threshold.

[0110] Can the above channel diagnosis measures meet the requirements of SIL3 level of IEC61508 standard?

[0111] According to the "Test Pattern" diagnosis coverage recommended by IEC61508-2 Table A.7, the channel side of the module uses channel read-back comparison diagnosis, inter-channel comparison diagnosis, ADC card fault and crosstalk fault diagnosis, and the diagnosis coverage can reach high, and the channel diagnosis coverage is 99%.

[0112] According to IEC61508-2 Table 3, the channel circuit is TYPE B type, and when the hardware failure margin HFT is equal to 1, the safety failure fraction required to reach SIL3 level is 90%-99%. The module channel side has A / B two systems, which can tolerate one system failure, so the HFT is 1, the channel diagnosis coverage of the module is 99%, which can meet the required safety failure fraction, so the channel side diagnosis of the module can meet the requirements of SIL3 level.

[0113] In summary, according to the technical content disclosed in the present application, the following beneficial effects are provided: a module quantity acquisition module of a channel level 1oo2d architecture is provided, A / B two-system redundancy design is provided, and each of the A / B two systems has its own read-back diagnosis and redundant communication; a circuit hardware architecture of the analog quantity acquisition module with high safety, high availability and high diagnostic coverage is provided, one system can continue to be used when a failure occurs in the other system; a low-cost solution is provided, an independent MUX switch is used in the front stage to switch and output multiple channel signals, and the rear stage circuit is shared by multiple channels, thereby reducing the circuit cost; a method for diagnosing the failure of a device on the hardware architecture is provided, and the SIL3 level requirement can be achieved.

[0114] Although some specific embodiments of the present application have been described in detail by examples, those skilled in the art should understand that the above examples are only for illustration, but not for limiting the scope of the present application. Those skilled in the art should understand that the above embodiments can be modified without departing from the scope and spirit of the present application. The scope of the present application is defined by the appended claims.

Claims

1. A fault diagnosis method for a safety analog acquisition circuit of a 1oo2 architecture, characterized in that, The safety analog quantity acquisition circuit of the 1oo2 architecture comprises a first sampling resistor, a second sampling resistor, a first V1 multiplexer, a second V1 multiplexer, a first V2 multiplexer, a second V2 multiplexer, an A-system channel acquisition signal conditioning circuit, a B-system channel acquisition signal conditioning circuit, an A-system channel readback diagnosis conditioning circuit, a B-system channel readback diagnosis conditioning circuit, an A-system multiplexer, a B-system multiplexer, an A-system AD converter, a B-system AD converter, an A-system isolation device, a B-system isolation device, a processor, a first communication BUS, and a second communication BUS; One end of the second sampling resistor is connected to one end of a field instrument to form a first output end of a sampling resistor, and the other end of the second sampling resistor is connected to one end of the first sampling resistor to form a second output end of the sampling resistor; the input end of the first V2 multiplexer and the input end of the second V2 multiplexer are respectively connected to the first output end; the input end of the first V1 multiplexer and the input end of the second V1 multiplexer are respectively connected to the second output end; the output end of the first V2 multiplexer is connected to the input end of the A-system channel acquisition signal conditioning circuit to obtain an A-system first analog quantity; the output end of the first V1 multiplexer is connected to the input end of the A-system channel readback diagnosis conditioning circuit to obtain an A-system second analog quantity; the output end of the second V2 multiplexer is connected to the input end of the B-system channel acquisition signal conditioning circuit to obtain a B-system first analog quantity; the output end of the second V1 multiplexer is connected to the input end of the B-system channel readback diagnosis conditioning circuit to obtain a B-system second analog quantity; the output ends of the A-system channel acquisition signal conditioning circuit and the A-system channel readback diagnosis conditioning circuit are connected to the input end of the A-system multiplexer; the output ends of the B-system channel acquisition signal conditioning circuit and the B-system channel readback diagnosis conditioning circuit are connected to the input end of the B-system multiplexer; the output end of the A-system multiplexer is connected to the input end of the A-system AD converter, and the A-system AD converter converts two A-system analog quantities into two A-system digital quantities; the output end of the A-system AD converter is connected to one end of the A-system isolation device; the output end of the B-system multiplexer is connected to the input end of the B-system AD converter, and the B-system AD converter converts two B-system analog quantities into two B-system digital quantities; the output end of the B-system AD converter is connected to one end of the B-system isolation device; the other ends of the A-system isolation device and the B-system isolation device are respectively connected to the input end of the processor; the output end of the processor is respectively connected to the first communication BUS and the second communication BUS; The circuit further comprises a DAC diagnosis circuit and a DAC isolation device; One end of the DAC diagnosis circuit is respectively connected to the input end of the A-system multiplexer and the input end of the B-system multiplexer; the other end of the DAC diagnosis circuit is connected to one end of the DAC isolation device; the other end of the DAC isolation device is connected to the processor; The method comprises: The processor judges the A-system channel signal acquisition and conditioning circuit or the A-system channel readback diagnosis and conditioning circuit fault according to the two A-system digital quantities. The processor judges the B-system channel signal acquisition and conditioning circuit or the B-system channel readback diagnosis and conditioning circuit fault according to the two B-system digital quantities. The processor judges the first sampling resistor or the second sampling resistor fault according to the two A-system digital quantities and the two B-system digital quantities. The processor judges the A-system AD converter or the B-system AD converter fault according to the first A-system digital quantity and the first B-system digital quantity.

2. The fault diagnosis method of the safety analog quantity acquisition circuit of the 1oo2 architecture according to claim 1, characterized in that, The method further comprises: The processor controls the DAC diagnosis circuit to output the predefined analog quantity to the A-system AD converter and the B-system AD converter respectively, and judges which AD converter of the A-system AD converter and the B-system AD converter has a fault.

3. The method of claim 1, wherein the method further comprises: The processor judges the A-system channel signal acquisition and conditioning circuit or the A-system channel readback diagnosis and conditioning circuit fault according to the two A-system digital quantities, and comprises: If the absolute value of the difference between the first A-system digital quantity and the second A-system digital quantity is greater than the A-system threshold value, and the absolute value of the difference between the first B-system digital quantity and the second B-system digital quantity is less than the B-system threshold value, the A-system channel signal acquisition and conditioning circuit or the A-system channel readback diagnosis and conditioning circuit has a fault.

4. The fault diagnosis method of the safety analog quantity acquisition circuit of the 1oo2 architecture according to claim 1, characterized in that, The processor judges the B-system channel signal acquisition and conditioning circuit or the B-system channel readback diagnosis and conditioning circuit fault according to the two B-system digital quantities, and comprises: If the absolute value of the difference between the first B-system digital quantity and the second B-system digital quantity is greater than the B-system threshold value, and the absolute value of the difference between the first A-system digital quantity and the second A-system digital quantity is less than the A-system threshold value, the B-system channel signal acquisition and conditioning circuit or the B-system channel readback diagnosis and conditioning circuit has a fault.

5. The method for fault diagnosis of a safety analog acquisition circuit of a 1oo2 architecture according to claim 1, characterized in that, The processor judges the first sampling resistor or the second sampling resistor fault according to the two A-system digital quantities and the two B-system digital quantities, and comprises: If the absolute value of the difference between the first A-system digital quantity and the second A-system digital quantity is greater than the A-system threshold value, and the absolute value of the difference between the first B-system digital quantity and the second B-system digital quantity is greater than the B-system threshold value, the first sampling resistor or the second sampling resistor has a fault.

6. The fault diagnosis method of the 1oo2 architecture safety analog quantity acquisition circuit according to claim 1, characterized in that, The processor judges the A-system AD converter or the B-system AD converter fault according to the first A-system digital quantity and the first B-system digital quantity, and comprises: If the absolute value of the difference between the first A-system digital quantity and the second A-system digital quantity is less than the A-system threshold value, and the absolute value of the difference between the first B-system digital quantity and the second B-system digital quantity is less than the B-system threshold value, but the absolute value of the difference between the first A-system digital quantity and the first B-system digital quantity is greater than the AB difference threshold value, the A-system AD converter or the B-system AD converter has a fault.

7. The fault diagnosis method of the safety analog quantity acquisition circuit of the 1oo2 architecture according to claim 2, characterized in that, The processor controls the DAC diagnosis circuit to output the predefined analog quantity to the A-system AD converter and the B-system AD converter respectively, and judges which AD converter of the A-system AD converter and the B-system AD converter has a fault. The processor controls the DAC diagnosis circuit to output the predefined analog quantity to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and judges which AD converter of the A-system AD converter and the B-system AD converter has a fault.

8. The fault diagnosis method of the safety analog quantity acquisition circuit of the 1oo2 architecture according to claim 2, characterized in that, The processor controls the DAC diagnostic circuit to output predefined analog quantities to the high 8 bits of the A-system AD converter and the B-system AD converter respectively, and judges which of the A-system AD converter and the B-system AD converter has a fault, comprising: The high 8 bits of the A-system AD converter and the B-system AD converter are subjected to walking-bit testing, and then full-scale testing is performed again to diagnose the stuck-at fault and the crosstalk fault of the A-system AD converter and the B-system AD converter.

Images