Triple modular redundant DO system and diagnosis method

Abstract

The invention discloses a triple modular redundant DO system and a diagnosis method, and belongs to the field of process control. The system comprises a triple modular DO system, a first redundancy module, a second redundancy module and a third redundancy module, the first redundancy module comprises a switch AK and a switch AK1, the second redundancy module comprises a switch BK and a switch BK1, and the third redundancy module comprises a switch CK and a switch CK1. The invention supports the diagnosis of the switch and the control signal. According to the device applying the method, each module supports independent replacement, and a conditional 3-2.1. 0 degradation mode is supported. According to the scheme, high reliability of system operation is ensured, high availability is achieved, and therefore high use value is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of process industry, more particularly, to a DO system and a diagnosis method in a triple modular redundancy system. BACKGROUND

[0002] In the field of process industry, a safety instrumented system (SIS) is used to perform instrument safety functions. The digital output (DO) module commonly used in the system mostly uses a 2oo3 safety architecture. The channel of the DO module is in a closed or disconnected state for a long time, so it is necessary to diagnose the ability of the DO module channel to output a safe state.

[0003] In the prior art, the DO module safety architecture can perform 3-2-0 degradation, and the 3-system DO is located on the same module, so the 3-system module must be replaced as a whole after the module is degraded.

[0004] The existing patent document 1 discloses (CN115877272A) a triple DO channel system, diagnosis method and device, which provides a triple DO channel system, which includes a triple DO channel. Each channel of the triple DO channel includes two switches, the output end of each switch in each channel is connected with a CPU except the CPU of the channel, and each switch corresponds to a CPU. The CPU of the channel and the CPUs of the remaining channels are respectively connected with a common CPU, a synchronous diagnosis pulse is sent out through the common CPU, the CPU of the channel controls the conduction and shutdown of the control loop of the channel after receiving the synchronous diagnosis pulse sent out by the common CPU, and the diagnosis results of the corresponding switches in the control loop are obtained by the CPUs of the remaining channels, so that the on-off state of each switch can be measured. Each switch can not only diagnose whether each channel circuit has a fault, but also diagnose whether each switch in each channel circuit has a fault.

[0005] The above existing patent document 1 has the following technical problems: in the triple DO channel, each channel uses two CPU control signals for control, and the degradation mode can only support a 3-2-0 safety architecture. Since an additional common CPU is needed to send out a diagnosis pulse, it is inferred that all CPUs are located on the same physical module. Due to the existence of the common CPU, the 3-system cannot be modularized, and the running process cannot replace one of the modules alone. The patent does not disclose a detailed degradation scheme.

[0006] The existing patent document 2 (CN108494395B) discloses a DO module of a triple redundancy system and an output voting circuit thereof, which comprises a first driving circuit, a second driving circuit and a third driving circuit, further comprises a fourth driving circuit, a first controllable switch, a second controllable switch, a third controllable switch and a fourth controllable switch, and the input ends of each driving circuit are connected with the output ends of a first microprocessor, a second microprocessor, a third microprocessor, an A channel master unit, a B channel master unit and a C channel master unit. Each driving circuit controls a controllable switch, and the four controllable switches form a two-in-two-out circuit structure. When at least one group of input signals in the first group of input signals corresponding to the A channel, the second group of input signals corresponding to the B channel and the third group of input signals corresponding to the C channel are normal, at least one path of the two-in-two-out circuit structure is conducted, so that the degradation operation mode of 3-2-1-0 can be realized, and the safety performance of the system is improved.

[0007] The scheme of the above existing patent document 2 still has the following technical problems: the existing patent document 2 discloses a DO module of a triple redundancy system, but the voting circuit thereof is a two-in-two-out circuit structure formed by four driving circuits and four control switches. Neither the physical form nor the logical function can achieve completely independent and identical triple modules. SUMMARY

[0008] In order to solve the problems in the prior art, the present application provides a triple modular redundancy DO system and a diagnosis method, which can solve the technical problems that one of the modules cannot be replaced alone and the 3-2-1-0 degradation mode is not supported in the prior art.

[0009] The application adopts the following technical scheme.

[0010] A triple modular redundancy DO system comprises a first redundancy module, a second redundancy module and a third redundancy module, the first redundancy module comprises a switch AK and a switch AK1, the second redundancy module comprises a switch BK and a switch BK1, and the third redundancy module comprises a switch CK and a switch CK1.

[0011] The CPU of the first redundancy module is connected with the switch AK of the first redundancy module and the switch BK1 of the second redundancy module respectively, the CPU of the second redundancy module is connected with the switch BK of the second redundancy module, the switch CK1 of the third redundancy module respectively, and the CPU of the third redundancy module is connected with the switch CK of the third redundancy module and the switch AK1 of the first redundancy module respectively.

[0012] The CPUs of the first redundancy module, the second redundancy module and the third redundancy module control the switch AK of the first redundancy module, the switch BK of the second redundancy module and the switch CK of the second redundancy module respectively.

[0013] The switch AK1 of the first redundancy module is controlled in combination with the control signal of the third redundancy module, the DO output signal state of the third redundancy module and the DO output signal state of the second redundancy module; the switch BK1 of the second redundancy module is controlled in combination with the control signal of the first redundancy module, the DO output signal state of the first redundancy module and the DO output signal state of the third redundancy module; and the switch CK1 of the third redundancy module is controlled in combination with the control signal of the second redundancy module, the DO output signal state of the second redundancy module and the DO output signal state of the first redundancy module.

[0014] Preferably, the control signals of the first redundancy module, the second redundancy module and the third redundancy module are respectively acquired from the controller through uplink communication.

[0015] The DO output signal state refers to whether the source of the output signal is reliable, and the DO output signal state includes uplink communication interruption and communication link exception.

[0016] Preferably, the control logic of the switch AK1 of the first redundancy module, the switch BK1 of the second redundancy module and the switch CK1 of the third redundancy module is as follows:

[0017] AK1_CTRL=C_CTRL_A|(C_IO_FAIL&B_IO_FAIL)

[0018] BK1_CTRL=A_CTRL_B|(A_IO_FAIL&C_IO_FAIL)

[0019] CK1_CTRL=B_CTRL_C|(B_IO_FAIL&A_IO_FAIL)

[0020] Wherein, “|” represents logical OR, and “&” represents logical AND.

[0021] AK1_CTRL, BK1_CTRL and CK1_CTRL are respectively the control signals of the switch AK1 of the first redundancy module, the switch BK1 of the second redundancy module and the switch CK1 of the third redundancy module.

[0022] A_IO_FAIL, B_IO_FAIL and C_IO_FAIL are respectively the DO output signal states of the first redundancy module, the second redundancy module and the third redundancy module.

[0023] A_CTRL_B, B_CTRL_C and C_CTRL_A are respectively the control signals of the first redundancy module, the second redundancy module and the third redundancy module.

[0024] Preferably, each redundancy DO module outputs at least two switches K and K1 in series control, and specifically:

[0025] The output control of the first redundancy module is as follows:

[0026] When the first redundancy module switch AK outputs state 1 and the first redundancy module switch AK1 outputs state 1, the output of the first redundancy module is 1. When one of the first redundancy module switch AK and the first redundancy module switch AK1 outputs state 0, the output of the first redundancy module is 0.

[0027] Preferably, the output control of the second redundancy module is as follows:

[0028] When the second redundancy module switch BK outputs state 1 and the second redundancy module switch BK1 outputs state 1, the output of the second redundancy module is 1. When one of the second redundancy module switch BK and the second redundancy module switch BK1 outputs state 0, the output of the second redundancy module is 0.

[0029] Preferably, the output control of the third redundancy module is as follows:

[0030] When the third redundancy module switch CK outputs state 1 and the third redundancy module switch CK1 outputs state 1, the output of the third redundancy module is 1. When one of the third redundancy module switch CK and the third redundancy module switch CK1 outputs state 0, the output of the third redundancy module is 0.

[0031] Preferably, the system further comprises a base, and the first redundancy module, the second redundancy module and the third redundancy module are respectively installed on the base in a plug-in manner.

[0032] The application further provides a three-redundancy module DO diagnosis method, which applies the three-redundancy module DO system to three-redundancy module channels, and each channel switch and its control signal support diagnosis.

[0033] Comparison between normal operation state and read-back state: when normally operating, the current system operation architecture is determined, and whether the read-back state and the actual control state of the switch and the control signal are consistent is determined.

[0034] Active diagnosis pulse is sent out, and the feedback result is verified: only one module has the right to actively diagnose at the same time, the module having the right to actively diagnose controls the corresponding CPU to send a diagnosis pulse according to a diagnosis sequence, and the feedback result is verified.

[0035] The application further provides a terminal, which comprises a processor and a storage medium.

[0036] The storage medium is used for storing instructions.

[0037] The processor is used for operating according to the instructions to perform the steps of the three-redundancy module DO diagnosis method.

[0038] The application further provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize steps of the triple modular redundancy DO diagnosis method.

[0039] The application has the advantages that, compared with the prior art, the application provides a diagnosis device of a triple modular redundancy DO system, which comprises three independent redundancy modules, the output of each redundancy module is controlled in series by at least two switches, the control signals of the two switches are derived from different redundancy modules, the control signal of the switch K1 is crossed and associated through a base, and the reliability of the signal is improved. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 Figure 1 is a structural diagram of a triple modular redundancy DO system in the application;

[0041] Figure 2 Figure 2 is a control signal structure diagram of a DO channel in the application;

[0042] Figure 3 Figure 3 is a diagnosis flowchart of a DO channel under a 2003 safety architecture in the application;

[0043] Figure 4 Figure 4 is a diagnosis flowchart of a DO channel under a 1002 safety architecture in the application;

[0044] Figure 5 Figure 5 is a diagnosis flowchart of a DO channel under a 1001 safety architecture in the application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the application clearer, the technical scheme of the application will be described clearly and completely below in combination with the drawings in the embodiments of the application. The embodiments described in the application are only a part of the embodiments of the application, but not all the embodiments. Based on the spirit of the application, other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the application.

[0046] Figure 1A structure diagram of a triple modular redundancy DO system proposed by the application, the system comprising: a first redundancy module, a second redundancy module and a third redundancy module, the first redundancy module, the second redundancy module and the third redundancy module referring to DO-A, DO-B and DO-C in Figure 1

[0047] The first redundancy module comprises a switch AK and a switch AK1, the second redundancy module comprises a switch BK and a switch BK1, and the third redundancy module comprises a switch CK and a switch CK1.

[0048] The CPU of the first redundancy module is connected to the switch AK of the first redundancy module and the switch BK1 of the second redundancy module respectively, the CPU of the second redundancy module is connected to the switch BK of the second redundancy module, the switch CK1 of the third redundancy module respectively, and the CPU of the third redundancy module is connected to the switch CK of the third redundancy module and the switch AK1 of the first redundancy module respectively.

[0049] The CPU of the first redundancy module, the second redundancy module and the third redundancy module controls the switch AK of the first redundancy module, the switch BK of the second redundancy module and the switch CK of the second redundancy module respectively.

[0050] The switch AK1 of the first redundancy module is controlled in combination with the control signal of the third redundancy module, the DO output signal state and the DO output signal state of the second redundancy module; the switch BK1 of the second redundancy module is controlled in combination with the control signal of the first redundancy module, the DO output signal state and the DO output signal state of the third redundancy module; and the switch CK1 of the third redundancy module is controlled in combination with the control signal of the second redundancy module, the DO output signal state and the DO output signal state of the first redundancy module.

[0051] Further, the control signals of the first redundancy module, the second redundancy module and the third redundancy module are acquired from the controller through uplink communication respectively.

[0052] As shown in Figure 1 , Figure 1 The three redundancy modules in

[0053] The DO output signal state refers to whether the source of the output signal is reliable, and the DO output signal state comprises uplink communication interruption and communication link abnormality.

[0054] ​The output signal state supports 3-2-1-0 safety architecture when the DO output signal state is abnormal in the uplink communication when the uplink communication is issued; and supports 3-2-0 safety architecture when the DO output signal state is not abnormal in the uplink communication.

[0055] Figure 1 In the embodiment, the output positive terminal is an output voltage positive terminal, and the output negative terminal is an output voltage negative terminal.

[0056] Further preferably, the system further comprises a base, and the three redundant modules are installed on the same base in a plug-in manner and are sequentially referred to as DO-A, DO-B and DO-C (referred to as A system, B system and C system). In addition, the three redundant modules can be installed on three bases to form a triple-redundant DO system by splicing.

[0057] Figure 2 The DO channel control signal structure diagram of the application is shown in FIG. 1, one channel of each module controls one group of switches, and three groups of switches corresponding to triple-redundant channels are connected in parallel.

[0058] Specifically, the channels of the three modules jointly form triple-redundant channels, each module usually has 8 channels, and the three modules have 8 groups of triple-redundant channels in total.

[0059] Each channel includes AK-AK1, BK-BK1 and CK-CK1 three groups of switches, and the three groups of switches are connected in parallel, and two switches in each group are connected in series.

[0060] The first switch of each module is controlled by the CPU of the system; the second switch is controlled by the control signal of the previous system, and the DO output signal state of the redundant module of the previous system and the redundant module of the next system. The previous system of the A system is the C system, and the next system is the B system; the previous system of the B system is the A system, and the next system is the C system; the previous system of the C system is the B system, and the next system is the A system; the CPU of the A system is CPU_A, the CPU of the B system is CPU_B, and the CPU of the A system is CPU_C.

[0061] (1) The control signal of the first group of switches AK is derived from the control signal of the CPU of the A system (CPU_A); the control signal of the first group of switches AK1 is derived from the control signal of the C system, the DO output signal state of the C system and the DO output signal state of the B system. The control logic of the first group of switches AK1 is as follows:

[0062] AK1_CTRL = C_CTRL_A | (C_IO_FAIL & B_IO_FAIL)

[0063] Wherein, “|” represents logical or, and “&” represents logical and.

[0064] AK1_CTRL is the control signal of the first redundant module switch AK1; C_CTRL_A is the control signal of the third redundant module; C_IO_FAIL is the DO output signal state of the third redundant module; B_IO_FAIL is the DO output signal state of the second redundant module.

[0065] (2) The control signal of the second group of switches BK is derived from the B system CPU (CPU_B) control signal; the control signal of the second group of switches BK1 is derived from the A system control signal, the A system DO output signal state and the C system DO output signal state.

[0066] The control logic of the second group of switches BK1 is as follows:

[0067] BK1_CTRL = A_CTRL_B | (A_IO_FAIL & C_IO_FAIL)

[0068] Wherein, BK1_CTRL is the control signal of the second redundant module switch BK1, A_CTRL_B is the control signal of the first redundant module, A_IO_FAIL is the DO output signal state of the first redundant module;

[0069] (3) The control signal of the third group of switches CK is derived from the C system CPU (CPU_C) control signal; the control signal of the third group of switches CK1 is derived from the B system control signal, the B system DO output signal state and the A system DO output signal state.

[0070] The control logic of the third group of switches BK1 is as follows:

[0071] CK1_CTRL = B_CTRL_C | (B_IO_FAIL & A_IO_FAIL)

[0072] Wherein, CK1_CTRL is the control signal of the third redundant module switch CK1, B_CTRL_C is the control signal of the second redundant module.

[0073] Each redundant DO module outputs at least two switches K and K1 in series control, specifically:

[0074] The output control of the first redundant module is as follows:

[0075] When the output state of the first redundant module switch AK is 1 and the output state of the first redundant module switch AK1 is 1, the output of the first redundant module is 1. When one of the first redundant module switch AK and the first redundant module switch AK1 has an output state of 0, the output of the first redundant module is 0.

[0076] The output control of the second redundant module is as follows:

[0077] When the output state of the second redundancy module switch BK is 1 and the output state of the second redundancy module switch BK1 is 1, the output of the second redundancy module is 1. When one of the output states of the second redundancy module switch BK and the second redundancy module switch BK1 is 0, the output of the second redundancy module is 0.

[0078] The output control of the third redundancy module is as follows:

[0079] When the output state of the third redundancy module switch CK is 1 and the output state of the third redundancy module switch CK1 is 1, the output of the third redundancy module is 1. When one of the output states of the third redundancy module switch CK and the third redundancy module switch CK1 is 0, the output of the third redundancy module is 0.

[0080] To support the above-mentioned DO system, the application provides a triple modular redundancy DO diagnosis method, which is applied to triple modular channels, and the switches and control signals of each channel support diagnosis.

[0081] Comparison between normal operation state and readback state. First, the current system operation architecture is distinguished, and then it is judged whether the readback state and the actual control state of the switch and the control signal are consistent.

[0082] Active diagnosis pulse is sent out, and the feedback result is verified. The module with active diagnosis authority controls the corresponding CPU to send a diagnosis pulse according to a diagnosis sequence, and the feedback result is verified.

[0083] The triple modular redundancy DO system is applied to triple modular channels, and the switches and control signals of each channel support diagnosis. The diagnosis method comprises the following steps:

[0084] Comparison between normal operation state and readback state: when normally operating, the current system operation architecture is distinguished, and it is judged whether the readback state and the actual control state of the switch and the control signal are consistent.

[0085] Active diagnosis pulse is sent out, and the feedback result is verified: only one module has active diagnosis authority at the same time, and the module with active diagnosis authority controls the corresponding CPU to send a diagnosis pulse according to a diagnosis sequence, and the feedback result is verified.

[0086] Further, the triple modular redundancy DO diagnosis method provided by the application comprises corresponding diagnosis methods under 2OO3 safety architecture, 1OO2 safety architecture and 1OO1 safety architecture, and the specific steps are as follows:

[0087] Figure 3 The DO channel 2OO3 safety architecture diagnosis flowchart of the application is shown in the following figure, and the specific steps are as follows:

[0088] (101) Diagnose the switch controlled by the previous system;

[0089] Take system A as an example, the AK1 switch is controlled to act by the C system control signal. If the AK1 switch is normally opened, it indicates that the C system control signal normally controls the AK1 switch. Otherwise, it indicates that the A system is faulty. The A system is degraded and enters the safe state.

[0090] The diagnosis processes of systems B and C are the same as that of system A.

[0091] (102) Diagnose the switch controlled by the system itself;

[0092] Take system A as an example, the AK switch is controlled to act by the A system CPU. If the AK switch can normally act, it indicates that the A system controls the AK switch normally. Otherwise, it indicates that the A system is faulty. The A system is degraded and enters the safe state. The diagnosis processes of systems B and C are the same as that of system A.

[0093] (103) Diagnose the IOBUS control signal of the other two systems;

[0094] Take system A as an example, the AK1 switch is controlled to act by the IOBUS control signals of systems B and C. If the AK1 switch is normally opened, it indicates that the IOBUS control signals of systems B and C normally control the AK1 switch. Otherwise, it indicates that the A system is faulty. The A system is degraded and enters the safe state. The diagnosis processes of systems B and C are the same as that of system A.

[0095] (104) Diagnose the IOBUS control signal of the next system;

[0096] Take system A as an example, a short pulse is output by the IOBUS control signal of the next system B. The A system detects whether the IOBUS control signal of system B has a pulse output. If the IOBUS control signal of system B has a pulse output, it indicates that the IOBUS control signal of system B is normal. Otherwise, it indicates that the IOBUS control signal of system B is abnormal. When the IOBUS control signal of system B is abnormal, only an alarm is given and the channel is not degraded.

[0097] (105) Diagnose the IOBUS control signal of the previous system;

[0098] Take system A as an example, a short pulse is output by the IOBUS control signal of the previous system C. The A system detects whether the IOBUS control signal of system C has a pulse output. If the IOBUS control signal of system C has a pulse output, it indicates that the IOBUS control signal of system C is normal. Otherwise, it indicates that the IOBUS control signal of system C is abnormal. When the IOBUS control signal of system C is abnormal, only an alarm is given and the channel is not degraded.

[0099] (106) Diagnose the switch controlled by the previous system and the switch controlled by the system itself;

[0100] Take A system as an example, the AK1 switch of other channels of A system is controlled by the control signal of the previous C system to act together, and whether the AK1 switch of other channels is normally opened is detected. When the AK1 switch is normally opened, it is indicated that the AK1 switch of other channels is normally opened by the control signal of B system. Otherwise, it is indicated that there is a sticking fault between the current channel and other channels of A system. The current channel of A system is degraded, and enters a safe state. The diagnosis processes of B system and C system are the same as that of A system.

[0101] (107) all switches of the system act together to perform diagnosis;

[0102] Take A system as an example, the AK1 switch of other channels of A system is controlled by the control signal of the previous C system to act together, and whether the AK1 switch of other channels is normally opened is detected. When the AK1 switch is normally opened, it is indicated that the AK1 switch of other channels is normally opened by the control signal of B system. Otherwise, it is indicated that there is a sticking fault between the current channel and other channels of A system. The current channel of A system is degraded, and enters a safe state. The diagnosis processes of B system and C system are the same as that of A system.

[0103] According to the diagnosis of each DO module channel in (1)-(7) above, the order of the diagnosis items does not affect the detection result.

[0104] Figure 4 The figure is a diagnosis flowchart of DO channel 1002 under the safety architecture of the application, and the diagnosis function is similar to that of 2003. The specific steps are as follows:

[0105] (201) the switch of the previous system controls the switch of the current system to perform diagnosis;

[0106] (202) the switch of the current system is controlled to perform diagnosis;

[0107] (203) the IOBUS control signal of the previous system is diagnosed;

[0108] (204) the switch of the previous system controls the switch of the current system to act together to perform diagnosis;

[0109] (205) all switches of the current system act together to perform diagnosis;

[0110] (206) the switch of the same channel of two systems acts together to perform diagnosis;

[0111] (207) the degradation is judged according to the diagnosis result.

[0112] Figure 5 The figure is a diagnosis flowchart of DO channel 1001 under the safety architecture of the application, and the specific steps are as follows:

[0113] (301) the switch of the current system is controlled to perform diagnosis;

[0114] (302) all switches of the current system act together to perform diagnosis;

[0115] (303)According to the diagnosis result, a degradation judgment is made.

[0116] Running under different security architectures, the above diagnosis can accurately identify the switch and control signal faults, and maintain the system in a safe state.

[0117] The beneficial effects of the present application are that, compared with the prior art, the three DO modules in the present application are completely identical in both physical and functional logic, and can be used interchangeably or replaced and maintained individually. When any one module fails, the failed module can be replaced without affecting the normal operation of the other two modules, preventing the further expansion of the fault and causing unplanned work stoppage, and improving the availability of the system.

[0118] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions stored therein to implement various aspects of the present disclosure.

[0119] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch cards or punched tape, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0120] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0121] Computer readable program instructions for carrying out operations of the present disclosure can be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0122] Finally, it should be noted that the above-mentioned embodiments are merely used to illustrate the technical solutions of the present application, rather than limiting the present application. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that the specific embodiments of the present application can be modified or replaced equivalently, without departing from the spirit and scope of the present application. Any modification or equivalent replacement without departing from the spirit and scope of the present application should be covered in the protection scope of the claims of the present application.

Claims

1. A triple modular redundant DO system, characterized by, Comprise: The first redundancy module, the second redundancy module and the third redundancy module, the first redundancy module includes switch AK and switch AK1, the second redundancy module includes switch BK and switch BK1, the third redundancy module includes switch CK and switch CK1; The CPU of the first redundancy module is connected with the switch AK of the first redundancy module and the switch BK1 of the second redundancy module respectively, the CPU of the second redundancy module is connected with the switch BK of the second redundancy module, the switch CK1 of the third redundancy module respectively, the CPU of the third redundancy module is connected with the switch CK of the third redundancy module and the switch AK1 of the first redundancy module respectively; The CPU of the first redundancy module, the second redundancy module and the third redundancy module controls the switch AK of the first redundancy module, the switch BK of the second redundancy module and the switch CK of the second redundancy module respectively; The switch AK1 of the first redundancy module is controlled in combination with the control signal, the DO output signal state of the third redundancy module and the DO output signal state of the second redundancy module;The switch BK1 of the second redundancy module is controlled in combination with the control signal, the DO output signal state of the first redundancy module and the DO output signal state of the third redundancy module;The switch CK1 of the third redundancy module is controlled in combination with the control signal, the DO output signal state of the second redundancy module and the DO output signal state of the first redundancy module.

2. The triple modular redundancy DO system according to claim 1, wherein the control signals of the first redundancy module, the second redundancy module and the third redundancy module are obtained from the upper communication controller respectively; The DO output signal state indicates whether the output signal source is reliable, and the DO output signal state includes upper communication interruption and communication link exception.

3. The triple modular redundancy DO system according to claim 1, wherein the control logic of the switch AK1 of the first redundancy module, the switch BK1 of the second redundancy module and the switch CK1 of the third redundancy module is as follows: AK1_CTRL=C_CTRL_A|(C_IO_FAIL&B_IO_FAIL) BK1_CTRL=A_CTRL_B|(A_IO_FAIL&C_IO_FAIL) CK1_CTRL=B_CTRL_C|(B_IO_FAIL&A_IO_FAIL) Wherein, " | " represents logical or, and " & " represents logical and; AK1_CTRL, BK1_CTRL and CK1_CTRL are the control signals of the switch AK1 of the first redundancy module, the switch BK1 of the second redundancy module and the switch CK1 of the third redundancy module respectively; A_IO_FAIL, B_IO_FAIL and C_IO_FAIL are the DO output signal states of the first redundancy module, the second redundancy module and the third redundancy module respectively; A_CTRL_B, B_CTRL_C and C_CTRL_A are the control signals of the first redundancy module, the second redundancy module and the third redundancy module respectively.

4. The triple modular redundancy DO system according to claim 1, wherein ​ ​ Each redundant DO module output has at least two switches K and K1 in series control, specifically: The output control of the first redundant module is as follows: When the output state of the first redundant module switch AK is 1 and the output state of the first redundant module switch AK1 is 1, the output of the first redundant module is 1. When one of the output state of the first redundant module switch AK and the output state of the first redundant module switch AK1 is 0, the output of the first redundant module is 0.

5. The triple modular redundant DO system according to claim 1, characterized in that: The output control of the second redundant module is as follows: When the output state of the second redundant module switch BK is 1 and the output state of the second redundant module switch BK1 is 1, the output of the second redundant module is 1. When one of the output state of the second redundant module switch BK and the output state of the second redundant module switch BK1 is 0, the output of the second redundant module is 0.

6. The triple modular redundant DO system according to claim 1, characterized in that: The output control of the third redundant module is as follows: When the output state of the third redundant module switch CK is 1 and the output state of the third redundant module switch CK1 is 1, the output of the third redundant module is 1. When one of the output state of the third redundant module switch CK and the output state of the third redundant module switch CK1 is 0, the output of the third redundant module is 0.

7. The triple modular redundant DO system according to claim 1, characterized in that: The system further comprises a base, and the first redundant module, the second redundant module and the third redundant module are respectively installed on the base by plug-in mode.

8. A triple modular redundant DO diagnosis method based on the triple modular redundant DO system according to claims 1-7, characterized in that: The triple modular redundant DO system is applied to triple modular channels, and the switches and control signals of each channel support diagnosis, and the diagnosis method comprises the following steps: Comparison of normal operation state and read-back state: in normal operation, the current system operation architecture is determined, and whether the read-back state and the actual control state of the switches and control signals are consistent is determined; Active diagnosis pulse is sent out, and the feedback result is verified: only one module has the right to actively diagnose at the same time, and the module with the right to actively diagnose controls the corresponding CPU to send a diagnosis pulse according to a diagnosis sequence, and the feedback result is verified.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to perform the steps of the triple modular redundant DO diagnosis method according to claim 8.

10. A computer readable storage medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the steps of the triple modular redundant DO diagnosis method according to claim 8.

Images