Rail transit platform door electromagnetic lock safety control circuit based on two-out-of-two

Abstract

The invention relates to the technical field of rail transit platform door control, and discloses a two-out-of-two-based rail transit platform door electromagnetic lock safety control circuit. The first unit is used for safety control of a platform door and sending a driving command, the second unit is used for stoping a state signal, and the safety and state isolation detection unit is used for directly driving and controlling an electromagnetic coil; a double-channel number is connected between the first channel and the second channel. According to the rail transit platform door electromagnetic lock safety control circuit based on the two-out-of-two, a two-out-of-two control framework composed of the first microprocessor and the second microprocessor is adopted, and the two-channel digital isolator connected between the first microprocessor and the second microprocessor is arranged for information synchronization and consistency voting; therefore, software and hardware faults of a single microprocessor cannot directly cause mistaken driving or state misjudgment of the electromagnetic lock, and the problem that a single fault in an existing single-point control framework possibly causes failure of a dangerous side and threatens operation safety is solved.

Description

Technical Field

[0001] This invention relates to the field of rail transit platform door control technology, specifically to a two-out-of-two electromagnetic lock safety control circuit for rail transit platform doors. Background Technology

[0002] Platform screen door control systems are an important subsystem of signal control systems in the rail transit field, used to control the opening and closing of platform screen doors and monitor their status. The electromagnetic locks within these control systems are the core safety equipment, and their safe operation and status monitoring play a crucial role in the normal functioning of the platform screen doors.

[0003] Existing electromagnetic lock drive circuits are all single-point control, meaning a single microprocessor controls optocouplers, MOSFETs, or relays to indirectly drive the electromagnetic lock. Therefore, a single software or hardware failure in this single control loop can cause the electromagnetic lock to unlock unexpectedly or fail to lock, easily impacting the safe operation of rail transit. For example, patent CN113513216A uses a single opening / closing control signal to control an optocoupler, which in turn indirectly controls a power switch to drive the electromagnetic lock. When the power switch in this loop fails, the electromagnetic lock will be mistakenly unlocked or fail to lock. Similarly, patents CN215097541U and CN214996977U also use single-point control for both the drive control and status detection of the electromagnetic lock. In these patents, core control components such as optocouplers, MOSFETs, or relays lack self-testing circuits, making it impossible to provide early warnings of component failures. This compromises safety and complicates maintenance. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a two-out-of-two electromagnetic lock safety control circuit for rail transit platform doors, which solves the problems mentioned in the background.

[0005] This invention provides the following technical solution: a safety control circuit for a rail transit platform door electromagnetic lock based on a two-out-of-two approach, comprising: an electromagnetic lock for platform door safety control, a safety relay for directly driving and controlling the electromagnetic coil of the electromagnetic lock, a first microprocessor, a second microprocessor, and a state isolation detection unit; A dual-channel digital isolator is connected between the first microprocessor and the second microprocessor, and the dual-channel digital isolator is used for information synchronization between the first microprocessor and the second microprocessor. A first isolation drive unit is connected between the first microprocessor and the coil of the safety relay; A second isolation drive unit is provided between the second microprocessor and the electromagnetic coil of the electromagnetic lock; The state isolation detection unit includes a first detection branch for detecting the health status of the safety relay, a second detection branch for detecting the health status of the second isolation drive unit, and a third detection branch for detecting the status of the electromagnetic lock node. Multiple state isolation detection units are respectively connected between the first microprocessor, the second microprocessor and the node of the safety relay, the output terminal of the second isolation drive unit and the node of the electromagnetic lock; In this process, after the first microprocessor and the second microprocessor synchronize information and vote on consistency through the dual-channel digital isolator, they respectively control the first isolation drive unit and the second isolation drive unit to work together to drive the electromagnetic lock, and respectively collect status information and perform synchronization and consistency voting through the multiple state isolation detection units.

[0006] Preferably, the first isolation drive unit is connected between the control output terminal of the first microprocessor and the coil of the safety relay, and is used to drive the coil of the safety relay under the control of the first microprocessor, and to achieve electrical isolation between the first microprocessor and the coil of the safety relay.

[0007] Preferably, the first isolation drive unit is an isolation drive optocoupler, the primary side of which is connected to the first control pin of the first microprocessor through a first current-limiting resistor, and the secondary side of which is connected between the power supply and one end of the coil of the safety relay; the second isolation drive unit is a solid-state relay, the primary side of which is connected to the first control pin of the second microprocessor through a second current-limiting resistor, and the secondary side of which is connected between one end of the electromagnetic coil of the electromagnetic lock and the power ground.

[0008] Preferably, the second isolation drive unit is connected between the control output terminal of the second microprocessor and the electromagnetic coil of the electromagnetic lock, and is used to drive the electromagnetic coil of the electromagnetic lock under the control of the second microprocessor, and to realize electrical isolation between the second microprocessor and the electromagnetic coil drive circuit of the electromagnetic lock.

[0009] Preferably, the normally open terminal of the safety relay is connected in series between the safety relay drive power supply and the electromagnetic coil of the electromagnetic lock; the first normally closed terminal of the safety relay is connected in series between the first detection power supply and the first detection branch; and the second normally closed terminal of the safety relay is connected in series between the safety relay drive power supply and the state isolation detection unit.

[0010] Preferably, the first detection branch includes a first optocoupler and a second optocoupler. The primary sides of the first optocoupler and the second optocoupler are connected in series in the circuit of the first normally closed node of the safety relay. The secondary side output of the first optocoupler is connected to the first status acquisition pin of the first microprocessor, and the secondary side output of the second optocoupler is connected to the first status acquisition pin of the second microprocessor, for detecting the health status of the safety relay. A third current-limiting resistor is connected in series at one end of the secondary winding of the first optocoupler; a fifth current-limiting resistor is connected in series at one end of the primary winding of the first optocoupler; and a fourth current-limiting resistor is connected in series at one end of the secondary winding of the second optocoupler.

[0011] 7. A safety control circuit for a rail transit platform door electromagnetic lock based on a two-out-of-two configuration according to claim 6, characterized in that the second detection branch includes a third optocoupler and a fourth optocoupler, the primary sides of the third optocoupler and the fourth optocoupler are connected in series in the circuit of the second normally closed node of the safety relay, and the other end of the primary side of the fourth optocoupler is connected to one end of the electromagnetic coil of the electromagnetic lock; the secondary side output of the third optocoupler is connected to the second state acquisition pin of the first microprocessor, and the secondary side output of the fourth optocoupler is connected to the second state acquisition pin of the second microprocessor, for detecting the health status of the second isolation drive unit; The primary end of the third optocoupler is connected in series with an eighth current-limiting resistor, the secondary end of the third optocoupler is connected in series with a sixth current-limiting resistor, and the secondary end of the fourth optocoupler is connected in series with a seventh current-limiting resistor.

[0012] Preferably, the third detection branch includes a fifth optocoupler and a sixth optocoupler. The primary side of the fifth optocoupler and the sixth optocoupler is connected to the normally closed node of the electromagnetic lock. The secondary side output of the fifth optocoupler is connected to the third state acquisition pin of the first microprocessor, and the secondary side output of the sixth optocoupler is connected to the third state acquisition pin of the second microprocessor, for detecting the node state of the electromagnetic lock. The fifth optocoupler has a ninth current-limiting resistor connected in series at one end of its secondary winding, and the sixth optocoupler has a tenth current-limiting resistor connected in series at one end of its secondary winding.

[0013] Preferably, it also includes a network switch for communicating with the platform door control system, wherein the first microprocessor and the second microprocessor are respectively connected to the network switch via network interfaces.

[0014] Preferably, one end of the normally closed node of the electromagnetic lock is connected to the driving power supply through the eleventh current-limiting resistor, and the other end is connected to both the normally open node of the safety relay and the secondary side of the second isolation driving unit.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention employs a two-out-of-two control architecture consisting of a first microprocessor and a second microprocessor, and sets up a dual-channel digital isolator connected between the two for information synchronization and consistency voting. This ensures that a single microprocessor's hardware or software failure will not directly lead to the electromagnetic lock's misoperation or misjudgment of its state, thus solving the problem that a single failure in the existing single-point control architecture may cause dangerous side failure and threaten operational safety.

[0016] 2. The present invention, by setting up a first isolated drive unit and a second isolated drive unit respectively connected to the first microprocessor and the second microprocessor, forms two independent and mutually verified drive paths to coordinately control the electromagnetic lock, which further improves the security of the drive circuit and solves the problem that the electromagnetic lock control function is directly lost due to the failure of a single drive channel.

[0017] 3. This invention, by setting up multiple state isolation detection units including a first detection branch, a second detection branch, and a third detection branch, and connecting them to two microprocessors respectively, realizes real-time acquisition and cross-verification of the states of the safety relay, the second isolation drive unit, and the electromagnetic lock node in a two-out-of-two manner. This solves the problem of unreliable or inaccurate perception of the state of key components. Furthermore, the first detection branch, namely the first optocoupler and the second optocoupler, acquires the state of the normally closed node of the safety relay, while the second detection branch, namely the third optocoupler and the fourth optocoupler, performs switching tests and state acquisition on the solid-state relay. This enables the health status of the safety relay and the solid-state relay to be monitored and warned online, solving the problems of lack of self-testing capability, high fault latency, and inconvenient maintenance of core power devices.

[0018] 4. The present invention configures the drive control logic of the electromagnetic lock as follows: when the electromagnetic lock is unlocked, the first microprocessor first controls the safety relay to be activated, and then the second microprocessor controls the solid-state relay to be activated; when the electromagnetic lock is locked, the second microprocessor first controls the solid-state relay to be deactivated, and then the first microprocessor controls the safety relay to be deactivated. By utilizing the characteristic differences between mechanical contacts and semiconductor devices, the action sequence is optimized, arcing and current surges are reduced, and the service life of the electromagnetic lock is extended. Attached Figure Description

[0019] Figure 1 This is the circuit diagram of the present invention.

[0020] In the diagram: 1. First microprocessor; 2. Second microprocessor; 3. Dual-channel digital isolator; 4. Safety relay; 5. First isolation drive unit; 6. Second isolation drive unit; 7. First optocoupler; 8. Second optocoupler; 9. Third optocoupler; 10. Fourth optocoupler; 11. Fifth optocoupler; 12. Sixth optocoupler; 13. Electromagnetic lock; 14. Network switch; R1. First current-limiting resistor; R2. Second current-limiting resistor; R3. Third current-limiting resistor; R4. Fourth current-limiting resistor; R5. Fifth current-limiting resistor; R6. Sixth current-limiting resistor; R7. Seventh current-limiting resistor; R8. Eighth current-limiting resistor; R9. Ninth current-limiting resistor; R10. Tenth current-limiting resistor; R11. Eleventh current-limiting resistor. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see Figure 1 A safety control circuit for a rail transit platform door electromagnetic lock based on a two-out-of-two principle includes: an electromagnetic lock 13 for platform door safety control, a first microprocessor 1 for sending drive commands, a second microprocessor 2 for acquiring status signals, a safety relay 4 for directly driving and controlling the electromagnetic coil of the electromagnetic lock 13, and a status isolation detection unit. A dual-channel digital isolator 3 is connected between the first microprocessor 1 and the second microprocessor 2. The dual-channel digital isolator 3 is used for information synchronization between the first microprocessor 1 and the second microprocessor 2. A first isolation drive unit 5 is connected between the first microprocessor 1 and the coil of the safety relay 4; A second isolation drive unit 6 is provided between the second microprocessor 2 and the electromagnetic coil of the electromagnetic lock 13; The state isolation detection unit includes a first detection branch for detecting the health status of the safety relay 4, a second detection branch for detecting the health status of the second isolation drive unit 6, and a third detection branch for detecting the status of the electromagnetic lock 13 nodes. Multiple state isolation detection units are respectively connected between the nodes of the first microprocessor 1, the second microprocessor 2 and the safety relay 4, the output terminal of the second isolation drive unit 6 and the node of the electromagnetic lock 13; In this process, the first microprocessor 1 and the second microprocessor 2 synchronize information and vote on consistency through the dual-channel digital isolator 3, and then control the first isolation drive unit 5 and the second isolation drive unit 6 to work together to drive the electromagnetic lock 13. They also collect status information and perform synchronization and consistency voting through multiple state isolation detection units.

[0023] The first isolation drive unit 5 is connected between the control output terminal of the first microprocessor 1 and the coil of the safety relay 4. It is used to drive the coil of the safety relay 4 under the control of the first microprocessor 1 and realize electrical isolation between the first microprocessor 1 and the coil of the safety relay 4.

[0024] The first isolation drive unit 5 is an isolation drive optocoupler. The primary side of the isolation drive optocoupler is connected to the first control pin GPIO1 of the first microprocessor 1 through the first current limiting resistor R1. The secondary side of the isolation drive optocoupler is connected between the power supply and one end of the coil of the safety relay 4. The second isolation drive unit 6 is a solid-state relay. The primary side of the solid-state relay is connected to the first control pin GPIO1 of the second microprocessor 2 through the second current limiting resistor R2. Its secondary side is connected between one end of the electromagnetic coil of the electromagnetic lock 13 and the power supply ground.

[0025] The second isolation drive unit 6 is connected between the control output terminal of the second microprocessor 2 and the electromagnetic coil of the electromagnetic lock 13. It is used to drive the electromagnetic coil of the electromagnetic lock 13 under the control of the second microprocessor 2 and realize electrical isolation between the second microprocessor 2 and the electromagnetic coil drive circuit of the electromagnetic lock 13.

[0026] The normally open contact of the safety relay 4 is connected in series between the driving power supply of the safety relay 4 and the electromagnetic coil of the electromagnetic lock 13; the first normally closed contact of the safety relay 4 is connected in series between the first detection power supply and the first detection branch; the second normally closed contact of the safety relay 4 is connected in series between the driving power supply of the safety relay 4 and the state isolation detection unit.

[0027] The first detection branch includes a first optocoupler 7 and a second optocoupler 8. The primary sides of the first optocoupler 7 and the second optocoupler 8 are connected in series in the circuit of the first normally closed node of the safety relay 4. The secondary side output of the first optocoupler 7 is connected to the first state acquisition pin GPIO2 of the first microprocessor 1, and the secondary side output of the second optocoupler 8 is connected to the first state acquisition pin GPIO2 of the second microprocessor 2, for detecting the health status of the safety relay 4. The secondary end of the first optocoupler 7 is connected in series with the third current-limiting resistor R3; the primary end of the first optocoupler 7 is connected in series with the fifth current-limiting resistor R5; and the secondary end of the second optocoupler 8 is connected in series with the fourth current-limiting resistor R4.

[0028] The second detection branch includes a third optocoupler 9 and a fourth optocoupler 10. The primary sides of the third optocoupler 9 and the fourth optocoupler 10 are connected in series in the circuit of the second normally closed node of the safety relay 4, and the other end of the primary side of the fourth optocoupler 10 is connected to one end of the electromagnetic coil of the electromagnetic lock 13. The secondary side output of the third optocoupler 9 is connected to the second status acquisition pin GPIO3 of the first microprocessor 1, and the secondary side output of the fourth optocoupler 10 is connected to the second status acquisition pin GPIO3 of the second microprocessor 2, for detecting the health status of the second isolation drive unit 6. The primary end of the third optocoupler 9 is connected in series with the eighth current-limiting resistor R8, the secondary end of the third optocoupler 9 is connected in series with the sixth current-limiting resistor R6, and the secondary end of the fourth optocoupler 10 is connected in series with the seventh current-limiting resistor R7.

[0029] The third detection branch includes a fifth optocoupler 11 and a sixth optocoupler 12. The primary side of the fifth optocoupler 11 and the sixth optocoupler 12 is connected to the normally closed node of the electromagnetic lock 13. The secondary side output of the fifth optocoupler 11 is connected to the third state acquisition pin GPIO4 of the first microprocessor 1, and the secondary side output of the sixth optocoupler 12 is connected to the third state acquisition pin GPIO4 of the second microprocessor 2, for detecting the node state of the electromagnetic lock 13. The fifth optocoupler 11 has a ninth current-limiting resistor R9 connected in series at one end of its secondary winding, and the sixth optocoupler 12 has a tenth current-limiting resistor R10 connected in series at one end of its secondary winding.

[0030] It also includes a network switch 14 for communicating with the platform door control system, and the first microprocessor 1 and the second microprocessor 2 are respectively connected to the network switch 14 through the network interface NET1.

[0031] One end of the normally closed contact of the electromagnetic lock 13 is connected to the drive power supply through the eleventh current-limiting resistor R11, and the other end is connected to the normally open contact of the safety relay 4 and the secondary side of the second isolation drive unit 6.

[0032] In one specific embodiment: See attached document Figure 1 This safety control circuit includes: a first microprocessor 1, a second microprocessor 2, a dual-channel digital isolator 3, a safety relay 4, a first isolation drive unit 5 (such as an isolation drive optocoupler), a second isolation drive unit 6 (such as a solid-state relay), a status isolation detection unit, an electromagnetic lock 13, and a network switch 14. The power and signal connection relationships between the components are as follows: Power Supply System: To enhance isolation and safety, the system employs multiple independent power supplies. The first microprocessor 1 and its related detection circuits are powered by the first low-voltage DC power supply. Microprocessor 1 is powered by a DC 3.3V power supply. The second microprocessor 2 and its related drive and detection circuits are powered by a second low-voltage DC power supply; microprocessor 2 is powered by a DC 3.3V_2 power supply. The coil of safety relay 4 is powered by a drive power supply; one end of the coil of safety relay 4 is connected to a DC24V power supply, and the other end is connected to one end of the secondary winding of the isolation drive optocoupler; one end of the normally closed contact 2 of safety relay 4 is connected to a DC110V power supply, and the other end is connected to the current limiting resistor R8. One end of the normally open terminal 1 of the safety relay 4 is connected to the DC 110V power supply and the current limiting resistor R11, and the other end is connected to the electromagnetic coil terminal of the electromagnetic lock 13.

[0033] Processor and Communication: The first microprocessor 1 and the second microprocessor 2 are connected to the dual-channel digital isolator 3 to realize the synchronization and electrical isolation of control commands and status data. The first microprocessor 1 and the second microprocessor 2 are also connected to the industrial network switch 14 through the network interface NET1, so as to communicate securely with the upper-level platform door control system, receive control commands and upload status information.

[0034] The first driving branch is controlled by the first microprocessor 1. The first control pin GPIO1 of the first microprocessor 1 is connected to the cathode of the primary side of the isolation drive optocoupler via the first current-limiting resistor R1, and its anode is connected to a DC 3.3V_1 power supply. The collector of the phototransistor on the secondary side of the isolation drive optocoupler is connected to one end of the coil of the safety relay 4, and the other end of the coil is connected to a DC 24V power supply; the emitter on the secondary side of the isolation drive optocoupler is connected to DC 3.3V_1_GND. When GPIO1 outputs a low level, the isolation drive optocoupler is turned on, and the coil of the safety relay 4 is energized and engaged.

[0035] The second drive branch is controlled by the second microprocessor 2. The first control pin GPIO1 of the second microprocessor 2 is connected to the cathode of the primary side of the solid-state relay 6 through the second current-limiting resistor R2, and its anode is connected to the DC3.3V_2 power supply. One end of the secondary side of the solid-state relay 6 is connected to the common terminal of the electromagnetic coil of the electromagnetic lock 13, and the other end is connected to DC110V_GND.

[0036] State detection loop: The first detection branch detects the health status of safety relay 4: one end of the first normally closed node of safety relay 4 is connected to a DC24V power supply, and the other end is connected in series with the primary side light-emitting diodes of the first detection optocoupler 7 and the second detection optocoupler 8 through the fifth current-limiting resistor R5. The other end of this series branch is connected to DC24V_GND. The output of the secondary side of the first detection optocoupler 7 is pulled up to a DC 3.3V power supply through the third current-limiting resistor R3. The output of the secondary side of the first detection optocoupler 7 is connected to the first state acquisition pin GPIO2 of the first microprocessor 1. The output of the secondary side of the second detection optocoupler 8 is pulled up to a DC 3.3V power supply through the fourth current-limiting resistor R4. The output of the secondary side of the second detection optocoupler 8 is connected to the first state acquisition pin GPIO2 of the second microprocessor 2. When the safety relay 4 is not energized, its normally closed node is closed, the DC 24V circuit is turned on, and the primary side of the first detection optocoupler 7 and the second detection optocoupler 8 emits light, causing their secondary side output to be low. When the safety relay 4 is energized, the normally closed node is open, the circuit is broken, and the secondary side output is high. The two microprocessors can determine whether the safety relay 4 is controlled to operate by acquiring the level status of GPIO2 and voting synchronously.

[0037] The second detection branch detects the health status of solid-state relay 6: This detection is performed when the electromagnetic lock is in the locked state and the safety relay 4 is dropped. One end of the second normally closed node of the safety relay 4 is connected to a DC 110V power supply, and the other end is connected in series with the primary side LEDs of the third detection optocoupler 9 and the fourth detection optocoupler 10 through the eighth current limiting resistor R8. The other end of this series branch is connected to the common terminal of the electromagnetic coil of the electromagnetic lock 13, that is, the secondary side output terminal of solid-state relay 6. The output of the secondary side of the third detection optocoupler 9 is pulled up to a DC 3.3V power supply through the sixth current limiting resistor R6. The output of the secondary side of the third detection optocoupler 9 is connected to the second status acquisition pin GPIO3 of the first microprocessor 1. The output of the secondary side of the fourth detection optocoupler 10 is pulled up to the DC 3.3V_2 power supply through the seventh current-limiting resistor R7. The output of the secondary side of the fourth detection optocoupler 10 is connected to the second state acquisition pin GPIO3 of the second microprocessor 2. When the solid-state relay 6 is off, its output is disconnected from DC 110V_GND. If the DC 110V power supply is normal, the detection circuit is on, the primary side of the third detection optocoupler 9 and the fourth detection optocoupler 10 illuminates, and the secondary output is low. When the solid-state relay 6 is controlled to be on, its output is approximately short-circuited to DC 110V_GND, the voltage across the detection circuit is close to zero, the primary side of the third detection optocoupler 9 and the fourth detection optocoupler 10 is off, and the secondary output is high. The second microprocessor 2 can determine whether its switching function is normal by controlling the on / off state of the solid-state relay 6 and observing the level change of GPIO3.

[0038] The third detection branch detects the state of the electromagnetic lock 13 node: one end of the normally closed node of the electromagnetic lock 13 is connected to a DC 110V power supply through the eleventh current-limiting resistor R11, and the other end is connected in series with the primary side LEDs of the fifth detection optocoupler 11 and the sixth detection optocoupler 12. The other end of this series branch is connected to DC 110V_GND. The output of the secondary side of the fifth detection optocoupler 11 is pulled up to a DC 3.3V_1 power supply through the ninth current-limiting resistor R9. The output of the secondary side of the fifth detection optocoupler 11 is connected to the third state of the first microprocessor 1. The output of the secondary side of the sixth detection optocoupler 12 is pulled up to a DC 3.3V_2 power supply through the tenth current-limiting resistor R10. The output of the secondary side of the sixth detection optocoupler 12 is connected to the third state acquisition pin GPIO4 of the second microprocessor 2. When the electromagnetic lock 13 is in the locked state, its normally closed node is closed, the detection circuit is open, the primary side of the fifth detection optocoupler 11 and the sixth detection optocoupler 12 emits light, and the secondary output is low. When the electromagnetic lock is unlocked, its normally closed node is open, the detection circuit is broken, and the secondary output is high. The two microprocessors can obtain the real-time locked / unlocked state of the electromagnetic lock by acquiring the level of GPIO4 and performing synchronous voting.

[0039] Control and detection logic flow Electromagnetic lock unlocking process: The first microprocessor 1 and the second microprocessor 2 receive the "unlock" command from the door control system through the network switch 14.

[0040] The first microprocessor 1 and the second microprocessor 2 exchange and compare the received commands through a dual-channel digital isolator 3. If the commands match, the vote passes.

[0041] Step 1: The first microprocessor 1 controls its GPIO1 to output a low level, driving the isolation optocoupler to conduct, thus energizing and engaging the coil of the safety relay 4. Its normally open contact closes, leading the DC 110V drive power supply to one end of the electromagnetic lock 13 coil through R11.

[0042] Step 2: The second microprocessor 2 controls its GPIO1 to output a low level, driving the solid-state relay 6 to conduct. At this time, one end of the electromagnetic coil of the electromagnetic lock 13 is connected to DC110V via R11, and the other end is connected to DC110V_GND via the solid-state relay 6 to form a complete circuit. Current flows through the electromagnetic coil, and the electromagnetic lock unlocks. This sequence avoids the solid-state relay 6 closing under high voltage difference, reducing the impact.

[0043] During and after the unlocking process, the two microprocessors continuously monitor the status of the electromagnetic lock node through the third detection branch, namely the fifth detection optocoupler 11 and the sixth detection optocoupler 12, to confirm successful unlocking.

[0044] Electromagnetic lock locking procedure: The microprocessor received the "lock" command and it was approved by a vote.

[0045] Step 1: The second microprocessor 2 controls its GPIO1 to output a high level, turns off the solid-state relay 6, and cuts off the main current path of the electromagnetic lock coil.

[0046] Step 2: The first microprocessor 1 controls its GPIO1 to output a high level, disabling the isolation drive optocoupler. The coil of safety relay 4 is de-energized and released, its normally open contact opens, and the drive power is completely removed. This sequence avoids the mechanical contacts of the safety relay breaking under load, extending contact life.

[0047] After locking, the state of the normally closed node of the electromagnetic lock is confirmed to be restored through the third detection branch.

[0048] Self-check process: Safety relay 4 self-test: During system power-on initialization or periodic maintenance, by controlling safety relay 4 to perform a pull-in / release action, two microprocessors collect the changes in the state of its normally closed node through the first detection branch optocoupler 7, 8, and compare them with the control command to determine whether its drive coil and contact action are normal.

[0049] Solid-state relay 6 self-test: This test must be performed under safe conditions, i.e., the electromagnetic lock has been confirmed to be locked and the safety relay 4 has been deactivated. The second microprocessor 2 controls the solid-state relay 6 to perform a brief on-off operation. During this period, the first microprocessor 1 and the second microprocessor 2 collect the circuit status in real time through the second detection branch, namely the third detection optocoupler 9 and the fourth detection optocoupler 10. If the solid-state relay 6 is functioning normally, the voltage across the detection branch should be close to zero when it is on, and the detection branch should be on when it is off. The first microprocessor 1 and the second microprocessor 2 compare the collected status changes with the control commands to complete the diagnosis of the switching function of the solid-state relay 6.

[0050] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, characterized in that, include: The system includes an electromagnetic lock (13) for platform door safety control, a safety relay (4) for directly driving and controlling the electromagnetic coil of the electromagnetic lock (13), a first microprocessor (1), a second microprocessor (2), and a state isolation detection unit. A dual-channel digital isolator (3) is connected between the first microprocessor (1) and the second microprocessor (2), and the dual-channel digital isolator (3) is used for information synchronization between the first microprocessor (1) and the second microprocessor (2); A first isolation drive unit (5) is connected between the first microprocessor (1) and the coil of the safety relay (4). A second isolation drive unit (6) is provided between the second microprocessor (2) and the electromagnetic coil of the electromagnetic lock (13). The state isolation detection unit includes a first detection branch for detecting the health status of the safety relay (4), a second detection branch for detecting the health status of the second isolation drive unit (6), and a third detection branch for detecting the node status of the electromagnetic lock (13). Multiple state isolation detection units are respectively connected between the nodes of the first microprocessor (1), the second microprocessor (2) and the safety relay (4), the output terminal of the second isolation drive unit (6) and the node of the electromagnetic lock (13); The first microprocessor (1) and the second microprocessor (2) synchronize information and vote on consistency through the dual-channel digital isolator (3), and then control the first isolation drive unit (5) and the second isolation drive unit (6) to work together to drive the electromagnetic lock (13), and collect state information and perform synchronization and consistency voting through the multiple state isolation detection units respectively.

2. The safety control circuit for electromagnetic locks of rail transit platform doors based on a two-out-of-two principle as described in claim 1, characterized in that, The first isolation drive unit (5) is connected between the control output terminal of the first microprocessor (1) and the coil of the safety relay (4), and is used to drive the coil of the safety relay (4) under the control of the first microprocessor (1) and realize electrical isolation between the first microprocessor (1) and the coil of the safety relay (4).

3. The safety control circuit for electromagnetic locks of rail transit platform doors based on a two-out-of-two principle as described in claim 2, characterized in that, The first isolation drive unit (5) is an isolation drive optocoupler. The primary side of the isolation drive optocoupler is connected to the first control pin of the first microprocessor (1) through the first current limiting resistor (R1). The secondary side of the isolation drive optocoupler is connected between the power supply and one end of the coil of the safety relay (4). The second isolation drive unit (6) is a solid-state relay. The primary side of the solid-state relay is connected to the first control pin of the second microprocessor (2) through the second current limiting resistor (R2). Its secondary side is connected between one end of the electromagnetic coil of the electromagnetic lock (13) and the power supply ground.

4. The safety control circuit for electromagnetic locks of rail transit platform doors based on a two-out-of-two principle as described in claim 3, characterized in that, The second isolation drive unit (6) is connected between the control output terminal of the second microprocessor (2) and the electromagnetic coil of the electromagnetic lock (13), and is used to drive the electromagnetic coil of the electromagnetic lock (13) under the control of the second microprocessor (2) and realize electrical isolation between the second microprocessor (2) and the electromagnetic coil drive circuit of the electromagnetic lock (13).

5. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, as described in claim 4, is characterized in that... The normally open node of the safety relay (4) is connected in series between the driving power supply of the safety relay (4) and the electromagnetic coil of the electromagnetic lock (13); the first normally closed node of the safety relay (4) is connected in series between the first detection power supply and the first detection branch; the second normally closed node of the safety relay (4) is connected in series between the driving power supply of the safety relay (4) and the state isolation detection unit.

6. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, as described in claim 5, is characterized in that... The first detection branch includes a first optocoupler (7) and a second optocoupler (8). The primary side of the first optocoupler (7) and the second optocoupler (8) are connected in series in the circuit of the first normally closed node of the safety relay (4). The secondary side output of the first optocoupler (7) is connected to the first status acquisition pin of the first microprocessor (1), and the secondary side output of the second optocoupler (8) is connected to the first status acquisition pin of the second microprocessor (2) for detecting the health status of the safety relay (4). The first optocoupler (7) has a third current-limiting resistor (R3) connected in series at one end of its secondary winding; the first optocoupler (7) has a fifth current-limiting resistor (R5) connected in series at one end of its primary winding; and the second optocoupler (8) has a fourth current-limiting resistor (R4) connected in series at one end of its secondary winding.

7. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, as described in claim 6, is characterized in that... The second detection branch includes a third optocoupler (9) and a fourth optocoupler (10). The primary side of the third optocoupler (9) and the fourth optocoupler (10) are connected in series in the circuit of the second normally closed node of the safety relay (4), and the other end of the primary side of the fourth optocoupler (10) is connected to one end of the electromagnetic coil of the electromagnetic lock (13). The secondary side output of the third optocoupler (9) is connected to the second status acquisition pin of the first microprocessor (1), and the secondary side output of the fourth optocoupler (10) is connected to the second status acquisition pin of the second microprocessor (2) for detecting the health status of the second isolation drive unit (6). The primary end of the third optocoupler (9) is connected in series with an eighth current-limiting resistor (R8), the secondary end of the third optocoupler (9) is connected in series with a sixth current-limiting resistor (R6), and the secondary end of the fourth optocoupler (10) is connected in series with a seventh current-limiting resistor (R7).

8. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, as described in claim 7, is characterized in that... The third detection branch includes a fifth optocoupler (11) and a sixth optocoupler (12). The primary side of the fifth optocoupler (11) and the sixth optocoupler (12) is connected to the normally closed node of the electromagnetic lock (13). The secondary side output of the fifth optocoupler (11) is connected to the third state acquisition pin (GPIO4) of the first microprocessor (1), and the secondary side output of the sixth optocoupler (12) is connected to the third state acquisition pin (GPIO4) of the second microprocessor (2), for detecting the node state of the electromagnetic lock (13). The fifth optocoupler (11) has a ninth current-limiting resistor (R9) connected in series at one end of its secondary winding, and the sixth optocoupler (12) has a tenth current-limiting resistor (R10) connected in series at one end of its secondary winding.

9. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, as described in claim 8, is characterized in that... It also includes a network switch (14) for communicating with the platform door control system, wherein the first microprocessor (1) and the second microprocessor (2) are respectively connected to the network switch (14) via network interfaces.

10. A safety control circuit for electromagnetic locks on rail transit platform doors based on a two-out-of-two principle, as described in claim 9, is characterized in that... One end of the normally closed node of the electromagnetic lock (13) is connected to the driving power supply through the eleventh current limiting resistor (R11), and the other end is connected to the normally open node of the safety relay (4) and the secondary side of the second isolation driving unit (6).

Images