Safety interlock control method and system of electron beam irradiation sterilization system, medium and program product

Abstract

The invention provides a safety interlocking control method and system of an electron beam irradiation sterilization system, a medium and a program product, and relates to the technical field of electron beam irradiation sterilization system.The method comprises the steps that a hard interlocking trigger signal and a soft interlocking state signal of a target accelerator of the electron beam irradiation sterilization system are obtained; a hard interlocking trigger signal is accessed to a hard interlocking logic loop to realize on-off control of a main power supply loop of the accelerator; the soft interlocking state signal is accessed to the safety interlocking logic controller, and when a preset safety condition is met, a safety interlocking ready signal is output; and the safety interlocking ready signal is used as an accelerator power supply enabling condition to be input into the operation control module, when the safety interlocking ready signal is effective and the main power supply loop is not disconnected, the accelerator is allowed to start and operate, and when the safety interlocking ready signal is invalid or the main power supply loop is disconnected, the accelerator is forbidden to start or stop operating. The technical problem that the safety control flexibility of an electron beam irradiation sterilization system in the related technology is poor is solved.

Description

Technical Field

[0001] This application relates to the field of control technology for electron beam irradiation sterilization systems, and in particular to a safety interlock control method, system, medium, and program product for an electron beam irradiation sterilization system. Background Technology

[0002] With the rapid development of the food and medical device industries, electron beam irradiation technology, as a highly efficient and environmentally friendly sterilization method, has been widely used in food preservation and medical device sterilization. Electron beam irradiation sterilization systems treat items with high-energy electron beams, effectively killing bacteria, viruses, and other microorganisms. Their safe and stable operation is of great significance for ensuring product quality and public health safety.

[0003] In related technologies, a relay-series safety interlock control method is typically used. Specifically, the normally closed contacts of all safety detection components, such as the irradiation chamber door limit switch, radiation monitor, emergency stop button, and inspection button, are connected in series to form a safety circuit. This safety circuit directly controls the coil of the accelerator's main contactor. When all normally closed contacts are closed, the main contactor engages, allowing the accelerator to operate. When any normally closed contact opens, the main contactor releases, and the accelerator shuts down. After the electron beam irradiation sterilization system stops, even if the normally closed contact that triggered the shutdown returns to its original position, the main contactor remains released due to the lack of a self-holding circuit. The operator must press the reset button to re-establish the circuit before the accelerator can restart. In this purely hardware relay-series control method, all safety signals are processed in the same circuit, and any signal trigger produces the same power-off response.

[0004] However, with the aforementioned safety interlock control method, all safety signals are connected in series in the same circuit via relays. This makes it impossible to take differentiated response measures based on the urgency of different safety events. This may cause non-urgent safety events to trigger a complete shutdown of the electron beam irradiation sterilization system, resulting in an interruption of irradiation processing operations. Consequently, the safety control flexibility of the electron beam irradiation sterilization system in related technologies is poor. Summary of the Invention

[0005] This application provides a safety interlock control method, system, medium, and program product for an electron beam irradiation sterilization system, which improves the safety control flexibility of the electron beam irradiation sterilization system.

[0006] In a first aspect, this application provides a safety interlock control method for an electron beam irradiation sterilization system, applied to the aforementioned safety interlock control system. The method includes: acquiring multiple safety input signals for a target accelerator included in the electron beam irradiation sterilization system, the multiple safety input signals including a hard interlock trigger signal and a soft interlock status signal; inputting the hard interlock trigger signal to a hard interlock logic circuit, so that the hard interlock logic circuit uses the hard interlock trigger signal to perform on / off control operations on the accelerator's main power supply circuit; inputting the soft interlock status signal to a safety interlock logic controller, so as to acquire a safety interlock ready signal output by the safety interlock logic controller when it determines that the soft interlock status signal meets preset safety conditions; inputting the safety interlock ready signal to an accelerator operation control module controlled by the safety interlock logic controller, and using the safety interlock ready signal as an accelerator power supply enable condition, so that when the safety interlock ready signal is valid and the accelerator's main power supply circuit is not disconnected, the target accelerator is allowed to start operation; when the safety interlock ready signal fails or the accelerator's main power supply circuit is disconnected, the target accelerator is not allowed to start operation or the target accelerator operation is terminated.

[0007] By adopting the above technical solution, a hierarchical processing mechanism for hard interlock trigger signals and soft interlock status signals achieves differentiated safety response strategies. The hard interlock trigger signal directly acts on the hard interlock logic circuit, which performs physical-level disconnection control on the accelerator's main power supply circuit through a purely hardware electrical path, with a response time controlled in milliseconds to ensure absolute safety in emergencies. The soft interlock status signal, on the other hand, is input to the safety interlock logic controller for logical judgment. Only when all soft interlock conditions meet preset safety conditions is a safety interlock ready signal output. This hierarchical architecture creates a dual enable condition between the safety interlock ready signal and the accelerator's main power supply circuit status, which together determine the target accelerator's operating permissions through a logical AND relationship. When either condition is not met, startup or termination is immediately prevented, avoiding production interruptions caused by a complete system shutdown due to non-emergency events while ensuring rapid response in truly dangerous situations, thus achieving operational continuity of the electron beam irradiation sterilization system. This solves the technical problem of poor safety control flexibility in related technologies for electron beam irradiation sterilization systems, achieving the technical effect of improving the safety control flexibility of electron beam irradiation sterilization systems.

[0008] Secondly, embodiments of this application provide a safety interlocking control system, which includes: one or more processors and a memory; the memory is coupled to one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to cause the safety interlocking control system to perform the method described in the first aspect and any possible implementation thereof.

[0009] Thirdly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a safety interlocking control system, cause the safety interlocking control system to perform the method described in the first aspect and any possible implementation thereof.

[0010] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a safety interlocking control system, cause the safety interlocking control system to perform the method described in the first aspect and any possible implementation thereof. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a safety interlock control method for an electron beam irradiation sterilization system in an embodiment of this application. Figure 2 This is a logic diagram of a hard-interlock power supply control in an embodiment of this application; Figure 3 This is a logical diagram of a safety soft interlock in the embodiments of this application; Figure 4 This is a logic diagram of abnormal operation condition detection and readiness enable in an embodiment of this application; Figure 5 This is a schematic diagram of one interconnection of accelerator control signals in an embodiment of this application; Figure 6 This is a schematic diagram of the physical device structure of a safety interlocking control system in the embodiments of this application. Detailed Implementation

[0012] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0013] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0014] This application provides a safety interlock control method for an electron beam irradiation sterilization system, see reference. Figure 1 , Figure 1 This is a flowchart illustrating a safety interlock control method for an electron beam irradiation sterilization system according to an embodiment of this application, comprising the following steps: Step S101: Obtain multiple safety input signals of the target accelerator included in the electron beam irradiation sterilization system. The multiple safety input signals include hard interlock trigger signals and soft interlock status signals. Step S102: Input the hard interlock trigger signal to the hard interlock logic circuit so that the hard interlock logic circuit can use the hard interlock trigger signal to perform on / off control operation on the accelerator main power supply circuit. Step S103: Input the soft interlock status signal to the safety interlock logic controller to obtain the safety interlock ready signal output by the safety interlock logic controller when it determines that the soft interlock status signal meets the preset safety conditions; Step S104: Input the safety interlock ready signal to the accelerator operation control module controlled by the safety interlock logic controller, and use the safety interlock ready signal as the accelerator power supply enable condition. When the safety interlock ready signal is valid and the accelerator main power supply circuit is not disconnected, the target accelerator is allowed to start operation. When the safety interlock ready signal fails or the accelerator main power supply circuit is disconnected, the target accelerator is not allowed to start operation or the target accelerator operation is terminated.

[0015] In the above embodiment, it is assumed that the electron beam irradiation sterilization system includes two target accelerators (accelerator #1 and accelerator #2), each equipped with an independent solid-state modulator. The core control unit of the safety interlock control system is a safety interlock integrated control cabinet, which has a built-in programmable logic controller (PLC) as the safety interlock logic controller. This controller communicates with the accelerator operation control module via industrial Ethernet and is connected to the hard-wired hard-interlock logic circuit. The hard-interlock logic circuit uses an AC contactor with a rated current of 32A as the accelerator's main power supply contactor, with a control voltage of AC220V. The accelerator's main power supply circuit controls the on / off of the 380V three-phase power supply through the main contacts of this contactor, while the auxiliary contacts control the 24VDC power supply branch of the solid-state modulator. The hard interlock trigger signals acquired by the safety interlock control system include: the main emergency stop switch (installed in main distribution cabinets #1 and #2), four pull-cord switches (distributed on the surrounding walls of the irradiation chamber, 1.2 meters high), two escape emergency stop switches (installed at the emergency exits of the irradiation chamber), and two distribution cabinet emergency stop switches (located on the panels of the two distribution cabinets respectively). All these switches use normally closed contacts and are connected in series to the hard interlock logic circuit.

[0016] In the above embodiments, the soft interlock status signals acquired by the safety interlock control system include: two sets of threshold switches (installed on the entrance door frame of the irradiation chamber), five inspection buttons (distributed in key locations within the irradiation chamber), an operating console key switch (located on the central control console), an entrance key switch (located at the entrance of the irradiation chamber), the operating status of the blower (acquired from inverter #1 via fieldbus), the operating status of the exhaust fan (acquired from inverter #2 via fieldbus), three sets of photoelectric sensor groups (installed in the irradiation chamber passage), two dose detectors (transmitting dose data via RS485 to Ethernet), and a beam-down rotary encoder (providing speed feedback signals). These signals are acquired through the controller input module or the Ethernet interface. After the safety interlock control system inputs the hard interlock trigger signal to the hard interlock logic circuit, when any hard interlock trigger signal is triggered (such as when the main emergency stop button is pressed), its normally closed contact opens, and the hard interlock logic circuit immediately cuts off the coil power supply of the accelerator main power supply contactor. The contactor releases within 20 milliseconds after power failure, with the main contacts disconnecting to cut off the 380V main power supply to the accelerator, and simultaneously the auxiliary contacts disconnecting to cut off the 24VDC power supply to the solid-state modulator. This process is a purely hardware electrical circuit operation, relying on no software processing, ensuring rapid response in extreme emergency situations. The safety interlock logic controller in the safety interlock control system cyclically reads all soft interlock status signals with a 10-millisecond scan cycle. For digital signals, a three-times continuous sampling filtering algorithm is used to eliminate jitter; for analog signals (such as dosage values), a moving average filter is used. The controller internally runs a structured ladder logic program, making judgments according to predefined logical conditions. This ladder logic program adopts a modular design, including an input processing module, a logic judgment module, and an output control module.

[0017] In the above embodiments, the preset safety condition logic expression set by the safety interlock control system is: Safety interlock ready = Inspection completed AND Threshold closed AND Operation authorized AND Supply fan normal AND Exhaust fan normal AND (NOT Dose abnormality) AND (NOT Speed ​​abnormality) AND (NOT Distribution cabinet emergency stop triggered). When all conditions are met, the safety interlock logic controller outputs a 24VDC high level as a valid safety interlock ready signal; if any condition is not met, it outputs a 0V low level to indicate failure. This signal is transmitted to the accelerator operation control module through a dedicated output module. The startup sequence of the safety interlock control system is as follows: Operator confirms all safety conditions are met → Presses the accelerator power supply button → The accelerator operation control module detects that the safety interlock ready signal is valid (24VDC) and the main power supply circuit is not disconnected (confirmed through feedback from the contactor auxiliary contact) → After a 500-millisecond delay, the main power supply contactor is engaged → The main power supply circuit is connected → The water chiller system is started (an industrial Ethernet start command is sent to the water chiller control system) → After a 2-second delay, the water chiller system is confirmed to be operating normally → The transmission system is started (a start command is sent to the transmission control system) → A charging high-voltage control command is sent to the solid-state modulator → The accelerator enters standby mode. When the safety interlock control system detects that the safety interlock ready signal has failed or the main power supply circuit has been disconnected, it executes an emergency stop procedure within 50 milliseconds: immediately stop the high-voltage output of the solid-state modulator → disconnect the main power supply contactor → stop the water unit system and the transmission system → the electron beam irradiation sterilization system enters a safe shutdown state.

[0018] Through the above steps, a hierarchical processing mechanism for hard interlock trigger signals and soft interlock status signals achieves differentiated safety response strategies. The hard interlock trigger signal directly acts on the hard interlock logic circuit, which performs physical-level disconnection control on the accelerator's main power supply circuit through a purely hardware electrical path, with a response time controlled in milliseconds to ensure absolute safety in emergencies. The soft interlock status signal, on the other hand, is input to the safety interlock logic controller for logical judgment. Only when all soft interlock conditions meet preset safety conditions is a safety interlock ready signal output. This hierarchical architecture creates a dual enable condition between the safety interlock ready signal and the accelerator's main power supply circuit status, which together determine the target accelerator's operating permissions through a logical AND relationship. When either condition is not met, startup or termination is immediately prevented, avoiding production interruptions caused by a complete system shutdown due to non-emergency events while ensuring rapid response in truly dangerous situations, thus achieving operational continuity of the electron beam irradiation sterilization system. This solves the technical problem of poor safety control flexibility in related technologies for electron beam irradiation sterilization systems, achieving the technical effect of improving the safety control flexibility of electron beam irradiation sterilization systems.

[0019] The entity performing the above steps can be a system, such as a safety interlock control system, or a device, or a controller or processor in the device or system, or a standalone controller or processor, or other processing devices or processing units with similar processing functions, but is not limited to these.

[0020] In an optional embodiment, the soft interlock status signal is input to the safety interlock logic controller to obtain a safety interlock ready signal output by the safety interlock logic controller when it determines that the soft interlock status signal meets a preset safety condition. Specifically, this includes: inputting the soft interlock status signal to the safety interlock logic controller so that the safety interlock logic controller performs the following operations: when the safety interlock logic controller receives the soft interlock status signal and determines that the soft interlock status signal includes a patrol button signal, it performs a patrol detection operation on the patrol button signal to obtain a patrol detection result; the safety interlock logic controller determines, based on the patrol detection result, that a preset number of patrols exist. When all buttons are triggered, an inspection completion signal is generated. After generating the inspection completion signal, the safety interlock logic controller continuously monitors the photoelectric group signal. When the photoelectric group signal is detected to be triggered, the inspection completion signal is cleared and the inspection operation is re-executed. When no photoelectric group signal is detected to be triggered, the safety interlock logic controller performs safety interlock analysis on the inspection completion signal and the threshold switch signal, operation authorization signal, and equipment operating status signal included in the soft interlock status signal to obtain an intermediate judgment result. When the safety interlock logic controller determines that the inspection completion signal is valid and the intermediate judgment result meets the preset logic conditions, it outputs a safety interlock ready signal.

[0021] In the above embodiment, it is assumed that the safety interlock control system is equipped with five inspection buttons, labeled as Inspection Button #1 to Inspection Button #5, evenly distributed along the walls of the irradiation chamber. Inspection Buttons #1 and #2 are located on the east wall of the irradiation chamber, Inspection Button #3 is located on the west wall, and Inspection Buttons #4 and #5 are located in the center of the north and south walls, respectively, with an installation height of 1.4 meters. Each inspection button is a self-locking button with an LED indicator. After the button is triggered, the indicator light changes from green to red and remains locked until the system is reset. The inspection buttons are hardwired to the digital input module of the safety interlock logic controller via 24VDC shielded cables, occupying five input channels from DI0.0 to DI0.4. The signal uses normally open contacts, and a high-level signal is output when pressed. The inspection detection operation of the safety interlock control system is executed by a dedicated program module within the safety interlock logic controller. When the key switch on the operating panel is turned to the "Inspection" position, the inspection detection program is triggered. The program first clears the inspection status register and then enters a cyclic scanning mode to monitor the input status of the five inspection buttons in real time. For each inspection button, the safety interlock control system employs an anti-bounce confirmation mechanism, requiring the button signal to remain high for at least 2 seconds to be considered a valid trigger. After trigger confirmation, the corresponding status bit is set to 1. The safety interlock logic controller internally maintains a 5-bit inspection status register, with each bit corresponding to the trigger status of one inspection button. When all 5 status bits are 1 (binary 11111, decimal 31), the controller performs a bitwise AND operation; if the result is true, an inspection complete signal is generated. This signal is held by a self-locking logic, ensuring that the inspection complete signal remains valid even if the inspection button is released, until the clearing condition is met.

[0022] In the above embodiment, the safety interlock control system installs three sets of through-beam photoelectric sensors at the entrance of the irradiation chamber, namely photoelectric group #2 and photoelectric group #3, forming a multi-layered monitoring network. The photoelectric sensors adopt an infrared through-beam method, with the transmitter and receiver installed on both sides of the entrance passage, with a detection distance of 3 meters and a response time of less than 1 millisecond. When a person or object passes through the entrance, the infrared beam is blocked, and the receiver output changes from high level to low level, triggering the photoelectric signal. After generating the inspection completion signal, the safety interlock logic controller immediately starts the photoelectric signal monitoring subroutine. This subroutine checks the input status of the photoelectric groups every 10 millisecond scan cycle. Once any photoelectric group signal is detected to be triggered (falling edge), the safety interlock control system performs the following operations within the current scan cycle: immediately clears the inspection completion signal, resets the 5-bit inspection status register to 00000, resets the inspection timer to 0, and displays the prompt message "Personnel detected, please re-execute inspection" on the operation interface. This real-time monitoring and instant clearing mechanism ensures the timeliness and accuracy of the inspection results.

[0023] In the above embodiment, the safety interlock control system performs comprehensive logical analysis on the inspection completion signal and other key soft interlock signals. The logic truth table is as follows: Inspection completion signal (priority 1), threshold switch signal (priority 2), operation authorization signal (priority 3), supply fan operating status signal (priority 4), exhaust fan operating status signal (priority 4). The Boolean expression for the intermediate judgment result is: Intermediate judgment result = Inspection completion AND (threshold switch #1 AND threshold switch #2) AND operation authorization AND supply fan normal AND exhaust fan normal. When the inspection completion signal is 0, the intermediate judgment result is 0 regardless of the status of other signals, reflecting the highest priority of inspection. Only when all signals are 1 is the intermediate judgment result 1, allowing the output of the safety interlock ready signal. The safety interlock logic controller implements this logic using ladder diagram programming, using series normally open contacts to represent AND operations, ensuring the reliability and real-time performance of the logic judgment.

[0024] In an optional embodiment, when no photoelectric group signal is detected to be triggered, the safety interlock logic controller performs safety interlock analysis on the inspection completion signal and the threshold switch signal, operation authorization signal, and equipment operating status signal included in the soft interlock status signal to obtain an intermediate judgment result. Specifically, this includes: the safety interlock logic controller acquiring the current status value of the inspection completion signal, and when determining that the inspection has been completed based on the current status value of the inspection completion signal, acquiring the current status values ​​of the threshold switch signal, operation authorization signal, and equipment operating status signal; the safety interlock logic controller performing a status matching operation on the current status values ​​of the threshold switch signal, operation authorization signal, and equipment operating status signal to obtain a status matching result; and the safety interlock logic controller determining the threshold switch signal based on the status matching result. If the current status value of the target accelerator indicates that the entrance door is closed, the current status value of the operation authorization signal indicates that the control panel key switch is in the authorized start state, and the current status value of the equipment operation status signal indicates that both the supply fan and the exhaust fan are in normal operation, an intermediate judgment result of a valid state is generated. If the safety interlock logic controller determines that the inspection is not completed based on the current status value of the inspection completion signal, or determines based on the status matching result that at least one of the following situations exists: the current status value of the inspection completion signal indicates that the inspection is not completed, the current status value of the threshold switch signal indicates that the entrance door is not closed, the current status value of the operation authorization signal indicates that the control panel key switch is not in the authorized start state, and the current status value of the equipment operation status signal indicates that both the supply fan and the exhaust fan are not in normal operation, an intermediate judgment result of an invalid state is generated.

[0025] In the above embodiment, it is assumed that the safety interlocking control system is configured with two sets of threshold switches, namely entrance threshold switch group #1 and entrance threshold switch group #2, both of which are safety door lock switches with forced disconnection function. Entrance threshold switch group #1 is installed on the upper edge of the accelerator main entrance door frame, using a mechanical safety door lock with a travel of 15 mm, a forced disconnection distance of 5 mm, and a contact capacity of AC250V / 3A. The normally closed contact closes when the door is closed, outputting logic 1 (24VDC high level), and opens when the door is open, outputting logic 0 (0V low level). Entrance threshold switch group #2 is installed in the middle of the side frame of the irradiation chamber shielding door, using an electromagnetic safety door lock with a locking force of 1200N, a response time of less than 20 milliseconds, and built-in dual-circuit redundant contacts. The two contact signals are simultaneously input to the safety interlocking logic controller for comparison, improving detection reliability. The safety interlocking control system performs a series logic judgment on the two sets of threshold switch signals. Only when both sets of signals indicate that the door is in the closed state is the entrance door determined to be in a safe closed state. The operation authorization signal is jointly constituted by the control panel key switch and the entrance key switch. The control panel key switch adopts a three-position rotary design with three positions: OFF (disconnect), ON (ready), and AUTH (authorize). The key can only be inserted or removed in the OFF position. When rotated to the AUTH position, the internal contacts of the switch close, providing a 24VDC high-level signal to the DI1.0 input channel of the safety interlock logic controller, defining the authorized start state. The entrance key switch is installed on the control panel at the entrance of the irradiation chamber and adopts a two-position key switch with "prohibited" and "allowed" positions. When the safety interlock control system executes the interlock logic judgment, the control panel key switch must be in the AUTH position and the entrance key switch must be in the "allowed" position. Only when both conditions are met is the operation authorization considered valid. This dual-key authorization mechanism ensures that only personnel with operating authority can start the electron beam irradiation sterilization system, effectively preventing misoperation.

[0026] In the above embodiment, the operating status of the supply fan and exhaust fan is obtained in real time from the frequency converter via industrial Ethernet. The safety interlock control system communicates with frequency converters #1 and #2 using the Modbus TCP protocol, reading equipment status data every 100 milliseconds. The supply fan status data is stored in the holding register 40001 of frequency converter #1. Bit 0 of the 16-bit status word indicates the operating status (1=operating, 0=stopped), bit 1 indicates the fault status (1=fault, 0=normal), and bits 8-15 indicate the actual operating frequency value. The exhaust fan status data is stored in the holding register 40101 of frequency converter #2, with the same data format. The safety interlock logic controller determines normal operation based on the following conditions: the operating status bit is 1, the fault status bit is 0, the operating frequency is greater than or equal to 45Hz, and the air pressure is confirmed to be greater than or equal to 500Pa via feedback from the pressure sensor. Only when both the supply fan and exhaust fan meet the above conditions does the safety interlock control system determine that the ventilation system is in normal operation, ensuring air circulation and radiation protection requirements in the irradiation room. The state matching operation of the safety interlock control system is implemented through structured programming. The safety interlock logic controller first reads the inspection completion signal status value and stores it in M10.0. When M10.0 is 1, the state matching subroutine is started. The subroutine sequentially reads the threshold switch signal and stores it in M11.0 and M11.1, the operation authorization signal and stores it in M12.0 and M12.1, the blower status in MW20, and the exhaust fan status in MW22. The following logical operations are executed: MD0.0 = M10.0 AND (M11.0 AND M11.1) AND (M12.0 AND M12.1) AND (MW20.0 AND NOT MW20.1 AND (MW20≥45)) AND (MW22.0 AND NOT MW22.1 AND (MW22≥45)). When MD0.0 is 1, it indicates that all conditions are met, generating an intermediate judgment result for a valid state; when MD0.0 is 0, an intermediate judgment result for an invalid state is generated. The program uses a cyclic scanning method to ensure that state changes can be detected and responded to within 10 milliseconds.

[0027] In the above embodiments, the safety interlock control system can identify and handle various abnormal scenarios that cause intermediate judgment results to be invalid. When the inspection is not completed, the inspection completion signal M10.0 remains at 0. Even if the door limit switch groups #1 and #2 both show that the door is closed (M11.0=1, M11.1=1), the control panel key switch is in the AUTH position (M12.0=1), the entrance key switch is in the allow position (M12.1=1), and the supply fan and exhaust fan are running normally (MW20=0x8030 indicates that it is running, without fault, and the frequency is 48Hz, MW22=0x8032 indicates that it is running, without fault, and the frequency is 50Hz), the intermediate judgment result MD0.0 is still 0. Within 15 milliseconds after the logical operation is performed, the invalid state is written to the output register, and the warning message "Inspection not completed, start prohibited" is displayed on the human-machine interface. When the supply fan is running normally but the exhaust fan fails and stops, inverter #1 feeds back MW20=0x8030 (bit 0=1 indicates operation, bit 1=0 indicates no fault), while inverter #2 feeds back MW22=0x0002 (bit 0=0 indicates stop, bit 1=1 indicates fault). The safety interlock logic controller identifies the anomaly within the next scan cycle (10 milliseconds) after receiving the fault signal, and completes the status register update, fault record writing, and alarm output within the following 35 milliseconds. The total response time does not exceed 50 milliseconds, and at the same time, the audible and visual alarm is triggered to indicate "exhaust fan failure, ventilation system abnormality". When the status of the entrance threshold switch group is inconsistent, for example, the normally closed contact of entrance threshold switch group #1 closes and outputs M11.0=1, indicating that the main entrance door is closed, but the electromagnetic lock feedback signal M11.1 of entrance threshold switch group #2 is 0, indicating that the shielded door is not fully locked, the safety interlock control system determines that the threshold protection has failed. Upon detecting signal inconsistency, the controller immediately executes interlock logic to block the signal, invalidates the intermediate judgment result within 20 milliseconds, and triggers the threshold fault indicator to flash via DO2.0 output, reminding the operator to check the locking status of the shielding door.

[0028] In the above embodiments, if the operation authorization is incomplete, such as when the control panel key switch has been rotated to the AUTH position (M12.0=1), but the entrance key switch is still in the "prohibited" position (M12.1=0), it indicates that the on-site personnel have not completed the safety confirmation. After detecting the authorization signal mismatch, the safety interlock logic controller performs a logic judgment within 15 milliseconds, determines that the authorization is invalid, updates the status register in 10 milliseconds, and outputs the "Entrance key not authorized" prompt message to the operation interface, with the total response time controlled within 25 milliseconds. The scenario where the ventilation system is running but the effect is not up to standard is more complex. The frequency converters of both the supply fan and the exhaust fan report normal operation (MW20=0x802D indicates 45Hz operation, MW22=0x802F indicates 47Hz operation), but the differential pressure sensor installed in the irradiation room measures only 450Pa, which is lower than the safety threshold of 500Pa. The safety interlock control system acquires pressure signals through the analog input module AI0. After three moving average filters, the signals are compared with the set value. When the pressure value is below the threshold for five consecutive scan cycles (50 milliseconds), the ventilation effect is deemed abnormal. Within 50 milliseconds of confirming the pressure abnormality, the system updates the intermediate judgment result, records the fault log, and sends maintenance reminders, ensuring the entire abnormality handling process is completed within 100 milliseconds. Through accurate identification and rapid response to the above typical abnormal scenarios, the safety interlock control system has established a multi-layered, comprehensive safety protection mechanism. According to 12 consecutive months of operational statistics, this state matching mechanism successfully intercepted 237 startup attempts that did not meet safety conditions, including 89 incomplete inspections, 72 ventilation system abnormalities, 43 inconsistent threshold states, 21 incomplete authorizations, and 12 instances of substandard ventilation effects, maintaining a zero false start rate. Simultaneously, detailed event records are generated for each abnormal event, including the occurrence time, abnormality type, relevant signal status, and processing results.

[0029] In an optional embodiment, when the safety interlock logic controller determines that the inspection completion signal is valid and the intermediate judgment result meets the preset logic conditions, it outputs a safety interlock ready signal. Specifically, after determining that the intermediate judgment result is valid, the safety interlock logic controller acquires the current status value of the dose abnormality signal, the current status value of the speed abnormality interlock signal, and the current status value of the distribution cabinet emergency stop signal. The safety interlock logic controller performs anomaly detection operations on the current status values ​​of the dose abnormality signal, the speed abnormality interlock signal, and the distribution cabinet emergency stop signal to obtain anomaly detection results. When the safety interlock logic controller determines, based on the anomaly detection results, that the current status value of the dose anomaly signal indicates that the dose is not abnormal, the current status value of the speed anomaly interlock signal indicates that the speed is not abnormal, and the current status value of the distribution cabinet emergency stop signal indicates that the emergency stop has not been triggered, it outputs a safety interlock ready signal. When the safety interlock logic controller determines, based on the anomaly detection results, that at least one of the following situations exists: the current status value of the dose anomaly signal indicates that the dose is abnormal, the current status value of the speed anomaly interlock signal indicates that the speed is abnormal, and the current status value of the distribution cabinet emergency stop signal indicates that the emergency stop has been triggered, it does not output a safety interlock ready signal.

[0030] In the above embodiment, it is assumed that the dose detectors configured in the safety interlock control system are high-voltage ionization chamber type detectors, installed on both sides of the beam channel inside the irradiation chamber. Dose detectors #1 and #2 are respectively converted into Ethernet signals via RS485 communication and transmitted to the safety interlock logic controller. The dose measurement data is output as a 4-20mA analog current signal. After conversion by the signal conditioning module, 4mA corresponds to 0kGy / h, and 20mA corresponds to 10kGy / h, achieving a resolution of 0.01kGy / h. The safety interlock control system determines "dosage not abnormal" when the deviation between the measured dose rate and the set value is within ±15%. For example, in medical device sterilization scenarios, the set dose rate is 2.5 kGy / h, with an allowable range of 2.125-2.875 kGy / h; in food preservation scenarios, the set dose rate is 1.0 kGy / h, with an allowable range of 0.85-1.15 kGy / h; and in packaging material modification scenarios, the set dose rate is 5.0 kGy / h, with an allowable range of 4.25-5.75 kGy / h. When the measured value exceeds the allowable range, the safety interlock logic controller generates a dose abnormality signal, changing the status value from 0 to 1. Simultaneously, the actual dose rate and deviation percentage are displayed on the operation interface, facilitating timely adjustments by the operator.

[0031] In the above embodiment, the speed feedback of the conveyor system is obtained through an incremental rotary encoder mounted on the conveyor motor shaft. The encoder resolution is 2048 pulses / revolution, and it is connected to the safety interlock logic controller via a high-speed counting module. Speed ​​data is transmitted via an industrial Ethernet interface with an update cycle of 10 milliseconds to ensure real-time performance. The safety interlock control system sets the criterion for "no abnormal speed" as a deviation of the actual conveyor speed from the set value within ±5%. For example, when the conveyor speed is set to 2.0 m / min, the allowable speed range is 1.9-2.1 m / min. When the speed deviation exceeds the allowable range, the safety interlock logic controller not only generates a speed abnormality interlock signal but also activates the dose compensation logic. It automatically adjusts the electron beam output power according to the speed deviation to ensure consistent irradiation dose. The specific compensation algorithm is: compensation coefficient = set speed / actual speed; adjusted beam intensity = standard beam intensity × compensation coefficient. However, when the speed deviation exceeds ±10%, the compensation function fails, and the system directly triggers speed abnormality shutdown protection.

[0032] In the above embodiment, the emergency stop switch of the distribution cabinet adopts a mushroom-shaped button with mechanical locking. Emergency stop #1 of the distribution cabinet is installed on the main distribution cabinet #1 panel, and emergency stop #2 of the distribution cabinet is installed on the main distribution cabinet #2 panel. Each emergency stop switch contains two sets of independent contacts. The first set of normally closed contacts is connected in series to the hard interlocking logic circuit, directly controlling the coil circuit of the accelerator's main power supply contactor. When the emergency stop button is pressed, the contacts open, cutting off the contactor coil power supply within 20 milliseconds, achieving hardware-level emergency stop. The second set of normally open contacts is connected to the digital input modules DI2.0 and DI2.1 of the safety interlocking logic controller, participating in the logic judgment as a soft interlocking status signal. When the emergency stop button is not triggered, the normally open contacts open, and the DI input is 0, indicating "emergency stop not triggered"; when the emergency stop button is pressed, the normally open contacts close, and the DI input is 1, indicating "emergency stop has been triggered". This dual-signal design ensures that rapid physical power disconnection in emergency situations and status monitoring functions during normal operation are simultaneously realized.

[0033] In the above embodiment, the safety interlock control system sets clear response priorities for three types of abnormal signals: distribution cabinet emergency stop signal (priority 1, response time < 5 ms), dose abnormality signal (priority 2, response time < 10 ms), and speed abnormality interlock signal (priority 3, response time < 15 ms). When multiple abnormalities occur simultaneously, the safety interlock logic controller processes them according to priority order. For example, if within a certain scan cycle, the distribution cabinet emergency stop is triggered (DI2.0=1), dose exceeds the standard (measured 3.2 kGy / h exceeds the 2.5±15% range), and speed is too low (measured 1.7 m / min is below the 2.0-5% threshold), the controller first responds to the distribution cabinet emergency stop signal within 5 ms, immediately sets the safety interlock ready signal to invalid (output 0V), and records the emergency stop trigger timestamp; then, within the next 5 ms, it processes the dose abnormality, updates the dose abnormality flag, and generates alarm information; finally, within the 15th ms, it processes the speed abnormality and records the speed deviation data. The entire multi-abnormality processing process is completed within 20 ms, ensuring the system's rapid response.

[0034] In the above embodiments, by implementing a hierarchical anomaly monitoring mechanism, the safety interlock control system achieves differentiated handling of different abnormal events. In actual operation, the speed anomaly interlock signal is mainly used to monitor the operational stability of the transmission system. When a speed deviation is detected within ±5%, the system maintains normal operation and records the deviation data for subsequent analysis. When the deviation exceeds ±5% but does not reach ±10%, the system issues an early warning while maintaining operation, reminding operators to pay attention to the status of the transmission system. Only when the speed deviation exceeds ±10% or the compensation function cannot maintain dose consistency is a shutdown protection triggered. This hierarchical response method avoids frequent shutdowns caused by normal speed changes or slight mechanical vibrations during the start-up and shutdown of the conveyor belt. The detection of dose anomaly signals mainly serves irradiation quality control. When the dose deviation is within ±10%, the system automatically compensates by adjusting the electron beam scanning parameters or the transmission speed. When the deviation is between ±10% and ±15%, the system continues to operate but requires operators to perform equipment checks and parameter calibrations after the current batch is completed. When the deviation exceeds ±15%, the system immediately shuts down and initiates a dose over-limit alarm procedure. The emergency stop signal in the power distribution cabinet always maintains the highest priority. Once triggered, it immediately executes a hardware power cut-off without any software judgment or delay. This hierarchical detection mechanism primarily distinguishes between emergency safety events and general operational deviations, reducing unnecessary production interruptions. For example, in food irradiation processing, slight speed fluctuations in the conveyor belt caused by changes in material weight no longer directly lead to a shutdown; instead, dosage compensation ensures the processing effect. Shutdown protection is only implemented when product quality or equipment safety is genuinely affected. It should be noted that the actual effectiveness of this mechanism will vary depending on the specific application scenario, equipment status, and operating procedures. The above description is based on typical operating characteristics; in actual applications, parameter optimization and adjustments are still necessary based on specific circumstances.

[0035] In an optional embodiment, acquiring multiple safety input signals from the target accelerator included in the electron beam irradiation sterilization system specifically includes: firstly, real-time monitoring of the main emergency stop switch, pull-cord switch, escape emergency stop switch, and distribution cabinet emergency stop switch pre-connected to the hard interlock logic circuit using a hard interlock logic circuit to acquire the contact states of the main emergency stop switch, pull-cord switch, escape emergency stop switch, and distribution cabinet emergency stop switch, and using the contact states as hard interlock trigger signals; and secondly, real-time monitoring of the threshold switches, inspection buttons, operating console key switches, and entrance key switches pre-connected to the safety interlock logic controller using a safety interlock logic controller. The system acquires the level status of the threshold switch, inspection button, control panel key switch, and entrance key switch within a preset scanning cycle, and uses the level status as a switch-type soft interlock status signal. It receives fan operation status data from the supply fan controller, exhaust fan operation status data from the exhaust fan controller, obstruction detection data from the photoelectric sensor, dose measurement data from the dose detector, and speed feedback data from the speed sensor via the Ethernet communication interface of the safety interlock logic controller, and uses these data as equipment-type soft interlock status signals.

[0036] In the above embodiments, it is assumed that the hard interlocking logic circuit of the safety interlocking control system adopts a dual-channel redundant architecture constructed with forced-guided relays. The main emergency stop switch is a mushroom-shaped button with mechanical locking function, with a contact capacity of AC-15 category, rated 10A / 230V, and has 2 normally closed and 2 normally open independent contacts. Pull-cord switches #1 to #4 are steel wire pull rope type emergency switches with a pull rope length of 20 meters. Pulling at any point can trigger the switch, and the contact response time is less than 5 milliseconds. Escape emergency stop switches #1 and #2 are installed on both sides of the emergency exit of the irradiation chamber, using a large red button box design with an IP65 protection rating. Emergency stop switches #1 and #2 in the distribution cabinet are integrated on the main distribution cabinet panel and have LED status indicators. The normally closed contacts of all emergency stop switches are connected in series to form a hard interlocking trigger circuit. Any switch action will cause the circuit to break. The hard interlocking logic circuit achieves dual-channel monitoring through a safety relay module. The two independent channels simultaneously detect the contact status. Only when the two signals are consistent will a valid judgment be output. A single-channel failure will not cause the safety function to fail. The safety interlocking control system performs first real-time monitoring of the hard interlocking circuit, with a response time controlled within 8 milliseconds, and the total delay from contact disconnection to contactor coil de-energization does not exceed 20 milliseconds.

[0037] In the above embodiment, the safety interlock logic controller is configured with a 16-channel 24VDC digital input module for acquiring switch-type soft interlock status signals. Threshold switch groups #1 and #2 are connected to channels DI0.0 and DI0.1 respectively; inspection buttons #1 to #5 are connected to channels DI0.2 to DI0.6 sequentially; the control panel key switch is connected to channel DI0.7; and the entrance key switch is connected to channel DI1.0. Each input channel is equipped with an opto-isolation circuit with an isolation voltage of 2500V, effectively preventing on-site interference. The safety interlock control system sets a preset scan period of 10 milliseconds for secondary real-time monitoring of these switches. The scan period can be adjusted between 5 milliseconds, 10 milliseconds, and 20 milliseconds according to actual needs. To eliminate the jitter interference of mechanical switches, the safety interlock logic controller uses a software filtering algorithm, requiring the signal state to remain stable for three consecutive scan periods before confirming a valid change, i.e., a 30-millisecond de-jitter time. The input module wiring uses shielded twisted-pair cable, with signal lines and power lines wired separately, and the shielding layer grounded at one end to ensure reliable signal transmission.

[0038] In the above embodiments, the safety interlock control system exchanges data with various intelligent devices through an industrial Ethernet communication module. The communication module supports the TCP / IP protocol stack and implements the Modbus TCP protocol at the application layer, capable of managing 32 TCP connections simultaneously. The blower controller is configured with IP address 192.168.1.10 and port 502. Its operating status data is stored in holding register 40001, updated every 100 milliseconds, and mapped to the data block DB100.DBW0 of the safety interlock logic controller. The exhaust fan controller is configured with IP address 192.168.1.11 and port 502. Its status data is stored in register 40101 and mapped to DB100.DBW2. The photoelectric sensor group is connected via an Ethernet conversion module with IP address 192.168.1.20. Obstruction detection data is transmitted in bit status form and mapped to DB101.DBB0. Dosage detectors #1 and #2 originally communicated via RS485, which was converted to Ethernet through a protocol conversion gateway. They were configured with IP addresses 192.168.1.30 and 192.168.1.31 respectively. Dosage measurement data was transmitted in floating-point format and mapped to DB102.DBD0 and DB102.DBD4. The velocity sensor acquired pulse signals through a high-speed counting module, which were then converted to Ethernet data by the communication processing unit. Its IP address is 192.168.1.40, and velocity feedback data is mapped to DB103.DBW0. The safety interlock control system monitors each communication connection for timeouts, setting a 300-millisecond timeout threshold. Three consecutive timeouts mark the device as offline and trigger a communication fault alarm.

[0039] In the above embodiments, the safety interlock control system internally categorizes and manages different types of signals using labels. Switch-type soft interlock status signals are uniformly labeled with the prefix "SW_", such as SW_DOOR1 representing threshold switch group #1 and SW_CHECK1 representing inspection button #1. These signals are stored in Boolean form, occupying bit addresses in the M area. Equipment-type soft interlock status signals are uniformly labeled with the prefix "DEV_", such as DEV_FAN1 representing the blower status and DEV_DOSE1 representing dose detector #1 data. These signals are stored in DB blocks according to their data type for easy structured access. This categorization management method makes the program logic clear and facilitates maintenance and expansion. Regarding anti-interference performance, the safety interlock control system has passed rigorous electromagnetic compatibility testing. Under test conditions of ±2kV electrical fast transient bursts, ±1kV surges, and ±6kV electrostatic discharge contact discharge, the signal transmission bit error rate is less than 0.005%, ensuring reliable operation in harsh electromagnetic environments. All signal cables are shielded, and the control cabinet is equipped with power filters and signal isolators, effectively suppressing various electromagnetic interferences in the industrial environment. This layered signal acquisition architecture offers excellent scalability. When adding new safety monitoring points, hard-interlock signals only require adding contacts to the existing series circuit without modifying the control program; soft-interlock signals can be implemented by adding input module channels or expanding Ethernet devices, requiring only the addition of corresponding data mapping and logic judgments to the program. Compared to traditional all-hardware relay solutions, the hardware modification workload for adding a safety signal is reduced, primarily in terms of simplified wiring and shorter debugging time. Simultaneously, the Ethernet-based device signal acquisition method simplifies remote device access, eliminating the need for long-distance signal cable laying; a single network cable can transmit multiple data types, significantly reducing project implementation costs. This flexible signal acquisition architecture provides ample interface resources for future upgrades and modifications to the electron beam irradiation sterilization system, enabling it to adapt to more stringent safety standards and more complex process requirements in the future.

[0040] In an optional embodiment, a hard-interlock trigger signal is input to the hard-interlock logic circuit, causing the hard-interlock logic circuit to perform on / off control operations on the accelerator main power supply circuit using the hard-interlock trigger signal. Specifically, this includes: inputting the hard-interlock trigger signal to the hard-interlock logic circuit, causing the hard-interlock logic circuit to perform the following on / off control operations based on the hard-interlock trigger signal: when the hard-interlock logic circuit determines, based on the hard-interlock trigger signal, that at least one of the following conditions exists—the main emergency stop switch contact state is open, the pull-cord switch contact state is open, the escape emergency stop switch contact state is open, and the distribution cabinet emergency stop switch contact state is open—it performs a disconnection control operation on the accelerator main power supply circuit. Specifically: the hard-interlock logic circuit controls the coil circuit of the accelerator main power supply contactor to disconnect, so that the accelerator main power supply contactor performs a main contact disconnection operation and an auxiliary contact disconnection operation. The main contact disconnection operation is a state transition action of the main contact of the accelerator main power supply contactor changing from a closed state to an open state, and the auxiliary contact disconnection operation is a state transition action of the auxiliary contact of the accelerator main power supply contactor changing from a closed state to an open state. The hard-interlock logic circuit cuts off the main power supply path of the target accelerator by performing the main contact disconnection operation of the accelerator main power supply contactor, and the hard-interlock logic circuit cuts off the solid-state modulator power supply branch of the target accelerator by performing the auxiliary contact disconnection operation of the accelerator main power supply contactor.

[0041] In the above embodiment, the accelerator main power supply contactor used in the safety interlock control system has a rated current of 1650A, is compatible with a 1000V AC voltage system, meets AC-3 usage category requirements, and can withstand frequent start-stop operations. The contactor coil control voltage is 220VAC, with a power consumption of approximately 150W. The coil circuit is equipped with a surge suppressor to prevent back electromotive force from damaging the control circuit during disconnection. The main contacts are made of silver alloy material, which has excellent conductivity and anti-arc erosion capability, and can withstand a breaking current of 1350A under rated conditions. The contactor is equipped with 4 sets of auxiliary contacts, including 2 sets of normally open contacts and 2 sets of normally closed contacts. One set of normally closed contacts is used to cut off the power supply branch of the solid-state modulator, and the other set is used for status feedback. The contactor has a mechanical life of 10 million cycles and an electrical life of 1 million cycles under AC-3 conditions, ensuring long-term reliability. The hard interlock logic circuit of the safety interlock control system uses a forced-guided safety relay to construct a redundant control circuit. The normally closed contacts of the main emergency stop switch, pull-cord switches #1 to #4, escape emergency stop switches #1 and #2, and distribution cabinet emergency stop switches #1 and #2 are connected in series to form a hard-interlock trigger signal acquisition circuit. This circuit is monitored through two independent safety relay channels, each containing an independent input circuit, logic processing unit, and output contact. When any emergency stop switch is triggered, its normally closed contact opens, and both safety relay channels simultaneously detect the circuit disconnection signal. Within 5 milliseconds, they perform a logic judgment, and after confirmation, the output contact actuates. The output contacts of the safety relays are connected in series to the coil circuit of the accelerator's main power supply contactor. Under normal conditions, the contacts are closed, the coil is energized, and the main contactor engages; when an emergency stop is triggered, the contacts open, the coil is de-energized, and the main contactor releases. The measured time from emergency stop switch triggering to complete de-energization of the contactor coil is 22 milliseconds, of which signal transmission and logic judgment take 7 milliseconds, relay contact actuation takes 5 milliseconds, and coil circuit disconnection takes 10 milliseconds.

[0042] In the above embodiment, when the hard-interlock logic circuit controls the de-energization of the accelerator's main power supply contactor coil, the electromagnetic system inside the contactor loses its attraction, and the moving contact assembly begins to separate under the action of the reset spring. An electric arc is generated during the main contact's opening process. The arc-extinguishing chamber built into the contactor extinguishes the arc within 5 milliseconds through magnetic blow-out and grid cutting, ensuring complete contact opening. The total time for the main contact to transition from the closed state to the open state is 18 milliseconds. After opening, the contact gap reaches 12 milliseconds, and the withstand voltage exceeds 6kV. Simultaneously with the main contact's opening, the mechanical linkage mechanism drives the auxiliary contact to move synchronously, and the normally closed auxiliary contact completes its opening action within 15 milliseconds. This auxiliary contact is connected in series in the 380VAC power supply circuits of solid-state modulator #1 and solid-state modulator #2, and immediately cuts off the modulator's operating power after the contact opens. This coordinated action of the main and auxiliary contacts ensures the synchronous disconnection of the accelerator's main power supply and control power supply, avoiding malfunctions of the equipment under abnormal conditions. The main power supply path for the target accelerator uses a 3×185mm² + 2×95mm² copper core cable. Three 185mm² cores are used for three-phase power transmission, and two 95mm² cores are used for the neutral and protective grounding, respectively. The cable's rated current-carrying capacity is 420A, far exceeding the normal operating current, ensuring ample safety margin. The solid-state modulator power supply branch uses a 380VAC three-phase power supply via a 4×50mm² cable, with a rated current of 150A. When the hard-interlock logic circuit executes the disconnection control, the voltage of the main power supply circuit decays from 1000V, dropping to 500V within 200 milliseconds, and then to a safe voltage level below 50V within 500 milliseconds. After the solid-state modulator power supply branch is disconnected, the internal energy storage capacitor releases the residual voltage to a safe level within 300 milliseconds through a discharge resistor. The safety interlock control system is also equipped with a voltage monitoring module to monitor the voltage status of each critical node in real time, ensuring the safety and controllability of the power outage process.

[0043] In the above embodiments, the hard interlock circuit of the safety interlock control system can adopt a dual-channel design to improve reliability. Two independent safety relay channels monitor the emergency stop switch status in parallel. Each channel contains an independent detection circuit and output contacts, which are connected in series to the contactor coil circuit. The main purpose of this redundancy design is to prevent single-point failures from causing safety function malfunctions. When a contact in one relay channel fails to disconnect due to welding, the contact in the other channel can still perform the disconnecting action, ensuring that the contactor coil is de-energized. Simultaneously, the safety interlock control system periodically compares the status of the two channels. When inconsistencies are detected between the channel statuses, a maintenance reminder is issued, prompting an inspection of potential faults. In practical applications, the reliability of the hard interlock circuit mainly depends on the quality of the selected components and the maintenance condition. The emergency stop switch uses industrial-grade products, with a mechanical lifespan generally reaching 100,000 operations, but this may be reduced in actual use due to environmental factors such as dust and humidity. The contacts of the safety relays will wear under frequent operation; it is recommended to perform a functional test annually and replace critical relays every two years. The electrical life of the contactor's main contacts is closely related to the load type and operating frequency, reaching approximately hundreds of thousands of cycles under rated conditions. However, in actual use, regular checks for contact erosion are necessary. The response time of the hard-lock circuit is affected by several factors, including the mechanical actuation time of the emergency stop switch, the engagement and release time of the relay, and the actuation time of the contactor. Under normal conditions, the total time from pressing the emergency stop button to the main power being cut off should be controlled within the range of 30-50 milliseconds.

[0044] In an optional embodiment, the safety interlock ready signal is used as the accelerator power supply enable condition, and the safety interlock ready signal is input to the accelerator operation control module controlled by the safety interlock logic controller. Specifically, this includes: inputting the safety interlock ready signal to the accelerator operation control module so that the accelerator operation control module performs the following power supply enable control operation based on the safety interlock ready signal: when the accelerator operation control module determines that the safety interlock ready signal is valid and receives the accelerator power supply start command, it generates an accelerator power supply enable signal; after generating the accelerator power supply enable signal, the accelerator operation control module performs a linkage start operation on the electron beam irradiation sterilization system, wherein: the accelerator operation control module controls the accelerator main power supply circuit to switch from a disconnected state... The accelerator operation control module, upon determining that the accelerator main power supply circuit is in the ON state, sends a water turbine start command to the water turbine system included in the electron beam irradiation sterilization system to start the water turbine system, sends a transmission start command to the transmission system included in the electron beam irradiation sterilization system to start the transmission system, and sends a charging high-voltage control command to the solid-state modulator included in the electron beam irradiation sterilization system to enable the solid-state modulator to perform charging high-voltage operation. Upon determining that the safety interlock ready signal has failed, the accelerator operation control module stops generating the accelerator power supply enable signal to block the connection of the accelerator main power supply circuit and stop sending the water turbine start command, transmission start command, and charging high-voltage control command.

[0045] In the above embodiments, the safety interlock control system uses the safety interlock ready signal as a necessary condition for enabling accelerator power supply. The safety interlock ready signal is represented by a 24VDC high level, and the accelerator operation control module monitors this signal in real time through the digital input channel DI3.0. The signal is only considered stable and valid if it remains valid for more than 100 milliseconds to avoid misjudgments caused by momentary interference. The accelerator power supply start command originates from a soft button on the operating interface or a control command from the upper-level monitoring system. When triggered by the "Start" button on the human-machine interface touchscreen, a rising edge pulse signal is generated and transmitted to the DI3.1 input channel of the accelerator operation control module. When the safety interlock ready signal is valid and the rising edge of the start command is detected, the accelerator operation control module generates an accelerator power supply enable signal after internal logic judgment. This signal is output through the Q0.0 output channel, which is configured with a 2A drive capability transistor output, capable of directly driving intermediate relays or indicator lights. After the enable signal is generated, it is set and held in the internal register M20.0 until the safety conditions are not met or a stop command is received.

[0046] In the above embodiments, the safety interlock control system executes the linkage start operation following strict timing control. At t=0, the accelerator power supply enable signal takes effect, and the accelerator operation control module drives the accelerator main power supply contactor coil through Q0.1 output. After a 500-millisecond delay, the contactor fully engages and the main power supply circuit is confirmed to be connected via feedback from the auxiliary contacts. At t=1 second, the accelerator operation control module sends a start command to the water chiller control system via industrial Ethernet, using the Modbus TCP protocol. Function code 06 is written to a single register, the target address is register 40010 of the water chiller PLC, and the written value 0x0001 indicates the start command. After receiving the command, the water chiller control system starts the circulating water pump and cooling fan. At t=2 seconds, after confirming that the water chiller is operating normally, a start command is sent to the transmission system, written to register 40020 of the transmission controller via Ethernet, with a start value of 0x0001. After performing a self-test, the transmission system starts the transmission motor. At t=3 seconds, a high-voltage charging control command is sent to solid-state modulators #1 and #2 respectively and written into the 40030 register of the modulator PLC. The setting values ​​include the target voltage of 50kV and the rise time of 60 seconds. The modulator slowly rises from 0V according to the ramp function to avoid voltage sudden changes from impacting the equipment.

[0047] In the above embodiments, the safety interlock control system performs strict precondition checks before sending start commands to each subsystem. Before the water chiller system starts, the accelerator operation control module obtains the cooling water pressure value by reading register 40001 of the water chiller PLC. Start-up is only allowed when the pressure is greater than 0.2MPa, ensuring that the cooling system is ready for operation. Before the conveyor system starts, it needs to complete several self-checks, including reading register 40002 of the conveyor controller to confirm that the conveyor belt tension is within the normal range (80-120N), reading register 40003 to confirm that there is no deviation signal (bit0=0 indicates normal), and reading register 40004 to confirm that the frequency converter is fault-free (status word=0x0000). Before charging the solid-state modulator, it is necessary to confirm that the high-voltage insulation is normal by reading register 40005 of the modulator PLC, which requires an insulation resistance value greater than 100MΩ; at the same time, the internal temperature of the modulator is checked, and register 40006 is read to confirm that the temperature is below 40℃. Only when all preconditions are met will the corresponding start command be issued; otherwise, the linkage start process will be suspended and the specific reason for the abnormality will be displayed on the operation interface.

[0048] In the above embodiment, the safety interlock control system continuously monitors the status of the safety interlock ready signal. Once it detects a change from a high level to a low level, it immediately initiates the blocking procedure. Within the first scan cycle (within 10 milliseconds) after detecting a failure of the ready signal, the accelerator operation control module resets the accelerator power supply enable signal M20.0 and simultaneously sets the output of Q0.0 to 0. Within the following 20 milliseconds, the accelerator main power supply contactor is disconnected via the output of Q0.1. A hardware interlock circuit ensures that the contactor coil circuit is locked, preventing reconnection even with subsequent start commands. Simultaneously, emergency shutdown commands are sent to each subsystem. The shutdown sequence is the reverse of the startup sequence. First, a stop charging command is sent to the solid-state modulator (writing register 40030 to value 0x0000). The modulator immediately stops high-voltage output and reduces the voltage to a safe value within 2 seconds through its internal discharge circuit. After a 1-second delay, a stop command is sent to the transmission system (writing register 40020 to value 0x0000), and the transmission motor decelerates and stops. Finally, a stop command is sent to the water chiller system (writing register 40010 to value 0x0000), but circulating water is kept running for 5 minutes to cool the equipment. The entire shutdown process completes command transmission within 50 milliseconds, and each subsystem completes shutdown within a safe time according to its own characteristics.

[0049] In the above embodiments, the main advantage of the linkage start-up mechanism of the safety interlock control system lies in reducing manual operation steps and avoiding errors in the start-up sequence. In the traditional manual operation mode, operators need to start the water turbine system, conveyor system, and solid-state modulator sequentially according to the operating procedures. Each step requires confirmation, and the entire process is prone to errors in the start-up sequence or omissions due to human negligence. With linkage control, the accelerator operation control module automatically completes the start-up of each subsystem according to a preset timing sequence. Operators only need to press the start button and monitor the start-up process. In actual operation, linkage start-up may occasionally be interrupted for various reasons. Common situations include slow water pressure build-up in the water turbine system leading to start-up timeouts, the need to adjust the tension of the conveyor belt during its first start-up after a long period of shutdown, and the need for preheating and dehumidification of the solid-state modulator due to decreased insulation resistance in humid weather. In these cases, the safety interlock control system will stop the start-up process and display the specific reason on the operation interface. Operators need to manually handle the problem and restart the system. Monitoring the safety interlock ready signal provides a basic safety guarantee for the system. When a ready signal failure is detected, the accelerator operation control module will immediately stop sending new control commands, and the already started equipment will stop according to the preset program. The main purpose of this mechanism is to prevent continued operation when safety conditions are not met. However, the actual response speed is affected by factors such as the scanning cycle and network communication latency. It usually takes several seconds from the detection of an anomaly to the complete shutdown of all devices. For emergency situations requiring immediate response, direct power-off protection via hard-interlocked circuits is still relied upon.

[0050] It should be noted that the embodiments described above are only some embodiments of this application, and not all embodiments. The present application will be described in detail below with reference to specific embodiments.

[0051] Figure 2 This is a logic diagram of a hard-interlock power supply control in an embodiment of this application, see reference. Figure 2 This system is used to implement safety interlock control of the equipment power supply system. Through real-time detection and logical response of emergency stop signals, it ensures the safety of personnel and equipment during equipment operation. Its specific structure and logical relationship are explained in detail below: The hard interlock logic circuit includes an emergency stop signal detection unit, a power supply control hard interlock module, a safety interlock integrated cabinet PLC, and a power supply execution component, wherein: The emergency stop signal detection unit is configured to collect various emergency stop trigger signals. It includes multiple independently configured emergency stop signal input components, specifically: main emergency stop, distribution cabinet emergency stop #1, distribution cabinet emergency stop #2, pull cord switch #1, pull cord switch #2, pull cord switch #3, pull cord switch #4, escape emergency stop #1, and escape emergency stop #2. Each of the emergency stop signal input components is connected to the safety interlock integrated cabinet PLC signal. When any of the emergency stop signal input components is triggered, it will send the corresponding emergency stop signal to the safety interlock integrated cabinet PLC.

[0052] The safety interlocking integrated cabinet PLC, as the control core of the hard interlocking logic circuit, is configured to receive the emergency stop signal output by the emergency stop signal detection unit, and execute interlocking logic judgment and control command output based on the emergency stop signal. Specifically, when the safety interlocking integrated cabinet PLC detects an emergency stop signal sent by any of the aforementioned emergency stop signal input components, it will not output an interlocking ready signal to the subsequent control link; when the safety interlocking integrated cabinet PLC does not detect any emergency stop signal, it will generate and output an interlocking ready signal to indicate that the hard interlocking logic circuit meets the power supply permission conditions.

[0053] The power supply control hard interlock module is connected to the safety interlock integrated cabinet PLC and the power supply execution component. The power supply execution component includes the main power distribution #1 and the main power distribution #2. The power supply control hard interlock module is configured to control the on / off of the main power supply based on the interlock status signal (interlock ready signal or no interlock ready signal) output by the safety interlock integrated cabinet PLC. The specific control logic is as follows: (1) When the safety interlock integrated cabinet PLC does not output the interlock ready signal (i.e., an emergency stop signal is detected), the power supply control hard interlock module will trigger the main power supply cut-off action. By controlling the disconnection of the main power distribution #1 and the main power distribution #2, the power supply to the equipment system will be stopped, thus realizing the safe disconnection of the power supply in the emergency stop state; (2) When the safety interlock integrated cabinet PLC outputs the interlock ready signal (i.e., no emergency stop signal is detected), the power supply control hard interlock module allows the main power distribution #1 and the main power distribution #2 to remain closed, ensuring the normal power supply of the equipment system.

[0054] Figure 3 This is a logical diagram of a safety soft interlock in an embodiment of this application, see below. Figure 3 (Detailed illustration provided here) This system is used to achieve multi-dimensional safety condition control during equipment system operation. By integrating various signals such as key control, threshold status, equipment operation, inspection operations, and photoelectric detection, the PLC in the safety interlocking cabinet performs logical judgments to generate an interlock ready signal, ensuring the compliance and safety of system operation. Its specific structure and logical relationship are explained in detail below: The safety soft interlock logic circuit uses the safety interlock integrated cabinet PLC as the control core, including a signal acquisition unit, a signal processing module, an interlock ready signal generation module, and associated execution components (exhaust fan power supply, blower power supply, photoelectric group #2, photoelectric group #3, etc.). The connection relationships and logical functions of each module and component are as follows: 1. Signal acquisition unit: The signal acquisition unit is configured to acquire various safety condition signals required for system operation, including key control signals, threshold status signals, photoelectric detection signals, inspection operation signals, and fan operating status signals, specifically including: 1) Key control signal acquisition components: control panel key and entrance key switch, both configured to output key status signals, and the closed state of the key switch is one of the basic prerequisites for interlocking readiness; 2) Threshold status signal acquisition components: entrance threshold, switch group #1, switch group #2, each component is configured to detect the closing status of the corresponding door and output a door closed signal or a door not closed signal; 3) Photoelectric detection signal acquisition components: photoelectric group #2, photoelectric group #3 and several independent photoelectric switches. Each photoelectric component is equipped with normally open contacts. The photoelectric detection signal is output through the on / off state of the contacts. At the same time, it is associated with the power supply circuit to realize the linkage between signal acquisition and power supply status. 4) Inspection operation signal acquisition component: Inspection button #1, inspection button #2, inspection button #3, inspection button #4, inspection button #5 and related switch signal output components, used to receive manual inspection operation instructions and output corresponding button signals and switch signals; 5) Fan operation status signal acquisition component: The status detection module corresponding to the high voltage of the exhaust fan and the high voltage of the supply fan is configured to collect the operation status signals of the supply fan and the exhaust fan, including normal operation signals and abnormal operation signals.

[0055] 2. Logic processing functions of the safety interlock integrated cabinet PLC: The safety interlock integrated cabinet PLC is configured to receive various signals output from the signal acquisition unit, perform multi-dimensional logic operations and status judgments, and the specific logic processing is as follows: 1) Central control key signal generation logic: The door closing signal output from the entrance threshold and switch group #1, switch group #2, the normal operation signal output from the power supply fan and exhaust fan, the inspection completion signal corresponding to the inspection operation, and the start signal output from the control panel key are processed in series. The central control key signal can only be generated when all the above signals are valid (i.e., the door is closed, the fan is running normally, the inspection is completed, and the control panel key is started). This signal is the core prerequisite for interlocking readiness. 2) Inspection logic processing: The button signals output by inspection buttons #1-#5 and related switch signals are input to the PLC of the safety interlock cabinet, triggering the system to start the inspection process; after the inspection proceeds normally and is completed, the PLC outputs a layer inspection completion signal and an overall inspection completion signal, which are one of the components of the central control key signal; if the preset inspection requirements are not met during the inspection process, no inspection completion signal will be output. 3) Abnormal signal processing: When the power supply of the blower or the power supply of the exhaust fan detects an abnormal signal, the PLC immediately triggers the interlock signal, interrupts the generation process of the central control key signal, and thus prevents the formation of the interlock ready state. 4) Photoelectric trigger feedback logic: After the inspection is completed and the signal is valid, if any photoelectric switch (including photoelectric group #2, photoelectric group #3 and independent photoelectric switch) is triggered, the PLC will perform the "inspection clearing" operation, and at the same time reset the inspection process, requiring the inspection to be restarted and all inspection steps to be completed, forming a closed-loop control of inspection-trigger-clearing-re-inspection.

[0056] 3. Interlock ready signal generation conditions and constraint logic: The generation of the interlock ready signal requires all preset safety conditions to be met simultaneously. If any condition is not met, the PLC of the safety interlock integrated cabinet will not be able to generate the interlock ready signal. The specific constraints are as follows: 1) Key switch constraint: When the control panel key or entrance key switch is not closed, the key status signal is invalid, the central control key signal cannot be generated, and the interlocking ready signal output is blocked; 2) Threshold status constraints: The entrance threshold, switch group #1 or switch group #2 is not closed, there is no valid "door closed signal" output, the series logic is interrupted, the "central control key" signal generation fails, and the interlock ready signal cannot be given; 3) Fan operation constraints: If the supply fan or exhaust fan does not output a normal operation signal (including abnormal signal, not started, etc.), the series logic cannot be conducted, and the interlock ready signal output is prohibited; 4) Inspection process constraints: If the inspection operation is not completed, the inspection process is abnormal, or the inspection is reset by the photoelectric switch after the inspection is completed, and there is no valid "inspection completed signal", the interlock ready signal cannot be generated. 5) Photoelectric and switch signal constraints: When the normally open contact of the photoelectric component is not conducting or the relevant switch signal is not effectively input, the corresponding acquired signal is invalid, which affects the generation of the central control key signal and thus prevents the interlocking from being ready.

[0057] 4. Execute component linkage logic: The high-voltage electrical components of the exhaust fan, the high-voltage electrical components of the supply fan, and the photoelectric group #2 and photoelectric group #3, etc., form a closed-loop signal interaction with the PLC of the safety interlock integrated cabinet. The operating status signal (normal / abnormal) of the actuator is fed back to the PLC as the basis for judging the interlock readiness; the interlock readiness signal generated by the PLC provides the precondition for the normal operation of the actuator. When the interlock readiness signal is not obtained, the start-up or continuous operation of the actuator is restricted; the trigger signals of the photoelectric group and the independent photoelectric switch are fed back to the PLC to trigger the inspection process reset, ensuring the real-time effectiveness of the inspection status during system operation.

[0058] Figure 4 This is a logic diagram illustrating an abnormal operation detection and readiness enable in an embodiment of this application. (See attached diagram.) Figure 4 With the safety interlock integrated cabinet PLC as the core control unit, it integrates hard interlock logic loops, multi-dimensional operating condition detection signals, status series interlocks, and audible and visual indicators to construct a closed-loop control system covering anomaly detection, interlock blocking, condition verification, and readiness enable. This enables real-time monitoring of equipment operating conditions and precise control of safety readiness status. Its specific structure, signal flow, and logical relationships are detailed below: 1. System Core Control Unit and Overall Architecture: The core control unit of this logic loop is the safety interlock integrated cabinet PLC, which undertakes the core functions of signal reception, logic operation, interlock command output, and readiness enable judgment. The system as a whole adopts a signal acquisition-logic processing-execution feedback architecture, covering the signal acquisition layer (operating condition detection, status sensing components), logic processing layer (PLC and hard interlock logic loop), and execution output layer (audible and visual alarms, equipment control components). Each level achieves bidirectional interaction through hard interlock links or signal transmission channels to ensure real-time response to control commands and accurate feedback of status signals.

[0059] 2. Signal Acquisition and Preprocessing: The system is configured to collect safety status signals, operating condition detection signals, and control enable signals required for equipment operation, providing input for PLC logic judgments. Specifically, it includes the following categories and corresponding components: 1) Safety status signal acquisition component: Threshold switches (including entrance threshold and associated switches): used to detect the closed state of the door and output a door closed signal; no valid signal is output when the door is not closed. Control panel key switch: Outputs a control panel key start signal. The signal is valid when the switch is closed, which is one of the enabling prerequisites. Electromagnetic door lock: The locking status signal is fed back through a hard interlocking link. When it is not locked, the hard interlocking is triggered to block it. Emergency stop of the distribution cabinet: It is a core triggering component of the hard interlock. When triggered, it outputs an emergency stop signal, which is directly connected to the hard interlock logic circuit.

[0060] 2) Equipment operating status signal acquisition component: The high-voltage circuits for the blower and exhaust fan respectively collect the operating status signals of the blower and exhaust fan, output normal operation signals or abnormal signals, and are linked with the PLC through a hard interlock link. The transmission system, accelerator system, and water turbine unit are interlocked in series by a status-based interlocking method. The output system power-on status signal is used, and the series interlocking is interrupted if any system status is abnormal. Inspection Readiness Signal: Output by the preceding inspection process, indicating that the inspection work has been completed in compliance with regulations, which is a necessary condition for readiness to be enabled.

[0061] 3) Abnormal operating condition detection signal acquisition component: Dose detector: Real-time detection of ambient dose parameters, outputs a normal dose status signal, and immediately outputs an alarm signal when an abnormal dose is detected; Speed ​​anomaly detection module: monitors the operating speed of key moving parts of the equipment, and outputs a speed anomaly signal when the speed exceeds a preset threshold; Beam-dependent rectifier feedback module: collects beam-related rectifier signals, provides feedback on beam operating status, and triggers interlocking response when the signal is abnormal; Ethernet gateway: Receives and transmits decoded signals, and feeds back to the PLC via a hard-locked link when the decoded signal is abnormal.

[0062] 3. Central locking signal generation: The central control key signal is the core pre-processing logic signal for system readiness enable. Its generation adopts a multi-signal serial verification mechanism. Specifically, the door closing signal (door limit switch output), the normal operation signal of the supply fan / exhaust fan (fan high-voltage circuit output), the control panel key start signal (control panel key switch output), and the inspection completion signal (inspection process output) are serialized. Only when all of the above signals are in a valid state (i.e., door closed, fan running normally, key started, inspection completed), can the PLC of the safety interlock cabinet generate the central control key signal. If any serialized signal is invalid, the generation of the central control key signal is interrupted, directly blocking the subsequent readiness enable process.

[0063] 4. Hard-interlock logic linkage: Multiple hard interlock logic loops are set up to cover scenarios such as emergency stop control, equipment status interlocking, and abnormal operating condition blocking. All hard interlock signals are directly connected to the safety interlock integrated cabinet PLC to achieve rapid response of interlocking upon abnormality. The specific hard interlock links and logic are as follows: 1) Emergency stop hard interlock: When the emergency stop of the distribution cabinet is triggered, the hard interlock logic circuit immediately outputs the interlock signal. After receiving the signal, the PLC directly cuts off the system power-on permission and prohibits the output of the ready signal. 2) Hard interlock between door and door lock: When the door limit switch does not output a door closing signal or the electromagnetic door lock is not locked, the hard interlock link is turned on, the PLC is blocked and ready to enable, and the equipment is prohibited from starting. 3) Hard interlock for fan operation: When the power circuit of the blower or exhaust fan outputs an abnormal signal (abnormal operation), the hard interlock logic is triggered, interrupting the generation of the central control key signal, thus realizing the hard linkage between fan abnormality and system readiness. 4) Hard interlock for abnormal operating conditions: When the dose detector outputs a dose abnormality alarm signal, the speed abnormality detection module outputs a speed abnormality signal, the beam down-rotator feedback signal is abnormal, or the decoding signal transmitted by the Ethernet gateway is abnormal, an interlock signal is sent to the PLC through the corresponding hard interlock link. The PLC immediately executes the interlock blocking and prevents the system from entering the ready state. 5) System series hard interlock: The transmission system, accelerator system and water turbine unit adopt a status series interlock design. When any system is abnormally powered on (the start-up conditions are not met), the series interlock circuit is interrupted, and the PLC is prohibited from enabling ready after receiving the status signal.

[0064] 5. Ready Enable Logic: The readiness enable trigger requires meeting the dual requirements of "no abnormalities in the hard interlock + all core conditions met". The PLC of the safety interlock integrated cabinet outputs a safety interlock ready signal based on the comprehensive judgment of the input signals. The specific enable conditions and logic are as follows: 1) Basic enabling conditions: No interlocking signals in the hard interlocking logic circuit (emergency stop of the distribution cabinet is not triggered, electromagnetic door lock is locked, door is closed, fan is running normally, and operating parameters are normal). 2) Core signal conditions: valid generation of central locking key signal and valid input of inspection ready signal; 3) Enable signal output: When all the above conditions are met, the PLC of the safety interlock integrated cabinet outputs a safety interlock ready signal to the actuator, allowing the system to perform subsequent operations such as power-on, charging, and beam preparation; if any condition is not met, the PLC will not output a ready signal, and the system will maintain the interlock blocking state.

[0065] 6. Execution and Alarms: Configured to receive interlock signals or ready signals output from the PLC of the safety interlock integrated cabinet, and execute corresponding audible and visual indications and equipment control actions. The specific components and linkage logic are as follows: 1) Sound and light indicator components: Ready Alarm #1 and Ready Alarm #2: They are activated after receiving a safety interlock ready signal and emit a ready prompt sound to inform the system that it has met the operating conditions. Beam Exit Alarm #1 and Beam Exit Alarm #2: When the system is preparing to emit a beam, they are activated by the PLC and emit a beam exit warning sound to ensure the safety of surrounding personnel. Maze tri-color light #1, maze tri-color light #2, entrance tri-color light, and control panel tri-color light: Different colored lights (red / yellow / green) correspond to the system status (abnormal alarm / interlock blocking / ready enable), providing real-time feedback on the system's operating status and interlock status. Specifically, green is displayed when the system is ready, and red or yellow is displayed when there is an abnormality or interlock status. 2) Equipment control components: Solid-state modulator #1 and solid-state modulator #2: can only receive start commands and implement modulation functions when the "safety interlock ready signal" is valid; High-voltage charging control signal: The PLC outputs a ready signal to control the start and stop of the high-voltage charging system. The high-voltage system cannot be powered on when the ready signal is not received. Conveyor system, accelerator system, water turbine unit: Receives the system power-on status control signal output by PLC, and is only allowed to power on and run after being ready and enabled. The power-on circuit is cut off by PLC when the operating conditions are abnormal.

[0066] 7. Abnormal alarm and interlock response logic When any abnormal operating condition or hard interlock is detected, the safety interlock integrated cabinet PLC simultaneously performs a dual operation of "interlock blocking + alarm prompting", the specific logic of which is as follows: 1) Interlocking interruption: Immediately cut off the safety interlock ready signal output (if it has already been output, then terminate), prohibit high-voltage charging, beam output, equipment start-up and other operations, and at the same time cut off the power supply circuit of critical equipment through hard interlocking link; 2) Alarm prompt: Control the corresponding three-color light to switch to the alarm color (red), trigger the beam alarm or ready alarm to switch to alarm mode (such as the buzzer continuously sounding), and when the dose detector detects an abnormal dose, it outputs an alarm signal separately and links the sound and light components to strengthen the warning. 3) Recovery logic: After the abnormal working condition is resolved, the PLC can output the safety interlock ready signal again only after the conditions for generating the central control key signal, the inspection ready signal being valid, and the hard interlock being normal are met again, and the system is restored to an operational state.

[0067] Figure 5 This is a schematic diagram of an interconnection of accelerator control signals in an embodiment of this application. (See attached diagram.) Figure 5 The schematic diagram of the accelerator control signal interconnection topology uses safety interlock integrated control cabinet #1 and safety interlock integrated control cabinet #2 as dual core control nodes to construct a full-link signal interconnection architecture of input signal acquisition, core logic operation, output command execution, and status visualization feedback. This enables coordinated control of the accelerator system, water turbine unit, transmission line system, main power distribution system, and related execution / indication components. The specific topology, signal flow, and logical linkage relationships are explained in detail below: 1. Core control unit and architecture positioning: With safety interlock integrated control cabinet #1 and safety interlock integrated control cabinet #2 as the core control units, the two adopt a collaborative control mode, jointly undertaking the functions of receiving control input signals, performing logical operations, generating and issuing control output commands, and summarizing and feeding back status signals from various systems. The core control cabinets achieve full-dimensional signal interconnection with input components, execution components, and indicator components through hard-wired connections or signal buses, forming a topology of "centralized control and distributed execution" to ensure the real-time and reliable transmission of control signals, providing core control support for the stable operation of the accelerator system.

[0068] 2. Control signal input unit and signal characteristics: The control signal input unit consists of various functional input components. Each component establishes a one-way or two-way signal connection with the safety interlock integrated control cabinets #1 and #2 via dedicated signal lines. It is used to collect manual operation commands, equipment status feedback signals, and operating condition detection signals, providing input basis for the logical judgment of the core control cabinet. The specific classifications and components are as follows: 1) Manual operation command input component: Power supply control buttons: Accelerator power supply button #1, Accelerator power supply button #2, Water turbine power supply button #1, Water turbine power supply button #2, Main distribution cabinet power on button, Main distribution cabinet power off button, used to receive system power supply / power off control commands initiated by operators and output corresponding power supply control input signals; Emergency stop control buttons: Accelerator emergency stop button #1, accelerator emergency stop button #2, water turbine unit emergency stop button #1, water turbine unit emergency stop button #2, are configured as input components for forced shutdown commands in emergency situations, and output the highest priority emergency stop control input signal when triggered; 2) Equipment stroke and operating condition detection input components: Beam-down travel switch group: Beam-down travel switch group #1, beam-down travel switch group #2, beam-down travel switch group #3, beam-down travel switch group #4 are used to detect the travel position status of the accelerator beam-down mechanism in real time and output travel in place / over-limit detection input signals; Photoelectric control input component: configured as a photoelectric control input signal output terminal, used to detect target objects under specific working conditions (such as material position, personnel approach status), and output photoelectric detection input signal; 3) System status feedback input component: Main power distribution cabinet status input: Both main power distribution cabinet #1 and main power distribution cabinet #2 output their own power-on / power-off status feedback signals to the core control cabinet, which serve as a logical reference for the power supply control of other systems; Safety interlock ready signal input: The core control cabinet receives the safety interlock ready signal output from the pre-lock logic loop. This signal is the pre-enable condition for the execution of all control commands.

[0069] 3. Control signal output unit and execution logic: The control signal output unit encompasses both execution components and status indication components. All receive control output signals from safety interlock integrated control cabinets #1 and #2 via signal lines, executing corresponding actions or providing feedback on system status. The specific classifications, components, and linkage logic are as follows: 1) Core execution components: Modulator components: Modulator #1 and Modulator #2 receive the beam output control signal from the core control cabinet and activate the beam modulation function only when the beam output control signal is valid, providing core support for accelerator beam output. Drive motor assembly: Motor forward rotation #1, Motor forward rotation #2, Motor reverse rotation #1, Motor reverse rotation #2, Motor stop rotation #1, Motor stop rotation #2, receives forward / reverse / stop control output signals from the core control cabinet, and is used to drive the movement of key components such as the accelerator beam lower mechanism and transmission line system, and realize position adjustment and start / stop control; Transmission line system: Transmission line system #1 and transmission line system #2 receive the operation control output signals from the core control cabinet, and execute material transfer or shutdown actions according to the instructions. Their operation status is linked to the accelerator beam output status. 2) Status indicator component: Audible and visual alarm components: tri-color warning lights (red / yellow / green), beam output alarm group, and ready alarm group. Among them, the tri-color warning lights use different colored lights to reflect the system status (red - abnormal alarm / emergency stop, yellow - standby / ready, green - normal operation); the beam output alarm group is activated when the beam output control signal is output, emitting an audible and visual warning; the ready alarm group is activated when the safety interlock ready signal is valid, indicating that the system has met the operating conditions. Status indicator lights: Beam indicator light on the control panel, used to display the accelerator beam output status in real time (on - beam in, off - no beam); Dose status indicator light (cabinet door), used to provide feedback on the dose status detected by the dose detector (normal - green light, abnormal - red light), realizing a visual reminder of the status at the cabinet door.

[0070] 4. Core signal interconnection and logical linkage mechanism: Safety interlock integrated control cabinets #1 and #2 perform multi-dimensional logical operations based on comprehensive judgment of input signals to achieve coordinated control of various systems and components. The core logical linkage mechanism is as follows: 1) Pre-enabling logic: The core control cabinet must first receive a valid safety interlock ready signal before it can unlock the authority to issue all control output commands; if the signal is not received or the signal is invalid, the start control commands of all execution components are blocked, and only the emergency stop control function is retained to ensure safe isolation when the system is not ready.

[0071] 2) Power supply control logic: When the operator presses the accelerator power supply button #1 / #2 or the water turbine power supply button #1 / #2, the core control cabinet first verifies three conditions: "safety interlock ready signal is valid", "no emergency stop signal input", and "the main power distribution cabinet is in normal power-on status". After all three conditions are met, the power supply control output signal is output to control the corresponding system to power on. When the power-on / power-off button of the main power distribution cabinet is pressed, the core control cabinet directly outputs the power distribution control signal to control the on / off of the main power distribution cabinet #1 / #2, and at the same time synchronizes the main power distribution status feedback signal to the power supply control logic of other systems to form a closed-loop verification of the power supply status.

[0072] 3) Emergency Stop Interlock Logic: When any accelerator emergency stop button #1 / #2 or water turbine unit emergency stop button #1 / #2 is triggered, the output emergency stop control input signal has the highest priority, and the core control cabinet immediately performs the following actions: ① Outputs a stop control signal to all motors, forcing the motors to stop; ② Cuts off the power supply control output signals of the accelerator and water turbine unit; ③ Controls the three-color warning lights to switch to the red alarm state, triggering the beam output alarm group to start; ④ Prohibits the output of beam output control signals, realizing the safety interruption of the entire system in an emergency.

[0073] 4) Stroke and motion control logic: The stroke detection input signals output by the lower limit switch group #1-#4 are fed back to the core control cabinet in real time. When the lower limit mechanism is detected to have reached the preset stroke limit, the control cabinet immediately outputs a motor stop signal and simultaneously prohibits the output of the corresponding direction motor forward / reverse rotation signal, thereby realizing hard limit protection of the stroke. The operator can achieve precise position adjustment of the lower limit mechanism by using the motor forward / reverse rotation control logic in combination with the feedback of the limit switches.

[0074] 5) Beam Output Control Logic: The output of the beam output control signal must meet multiple interlocking conditions: ① Safety interlock ready signal is valid; ② Accelerator and water turbine power supply is normal; ③ Beam lower limit switch group feedback travel is in place; ④ Photoelectric control input signal detection is normal; ⑤ No emergency stop signal input; When all conditions are met, the core control cabinet outputs the beam output control signal to modulator #1 / #2 to drive the modulator to work, and at the same time controls the beam current indicator light on the control panel to light up and the beam output alarm group to start, forming a dual indication of the beam output status.

[0075] 6) Cross-system linkage logic: The operation control of transmission line system #1 / #2 is linked with the beam output control of accelerator. The core control cabinet only sends the operation control signal to the transmission line system when the accelerator outputs the beam output control signal, so as to ensure the coordinated operation of the transmission line and the accelerator. The power-on state of the main power distribution cabinet #1 / #2 is the basis for power supply to all systems. When its power-off signal is triggered, the core control cabinet synchronously cuts off the power supply control output of all systems, so as to realize the power outage of the entire system.

[0076] The safety interlocking control system in the embodiments of this invention is described below from the perspective of hardware processing. (See attached document.) Figure 6 , Figure 6 This is a schematic diagram of the physical device structure of a safety interlocking control system in the embodiments of this application.

[0077] It should be noted that, Figure 6 The structure of the safety interlocking control system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0078] like Figure 6As shown, the safety interlock control system includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage portion 608 into random access memory (RAM) 603, such as performing the methods described in the above embodiments. The RAM 603 also stores... It contains various programs and data required for system operation. The CPU 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0079] The following components are connected to I / O interface 605: input section 606 including audio input devices, push-button switches, etc.; output section 607 including a liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 608 including a hard disk, etc.; and communication section 609 including a network interface card such as a LAN (Local Area Network) card, modem, etc. Communication section 609 performs communication processing via a network such as the Internet. Drive 610 is also connected to I / O interface 605 as needed. Removable media 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 610 as needed so that computer programs read from them can be installed into storage section 608 as needed.

[0080] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the various functions defined in the present invention.

[0081] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0082] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0083] Specifically, the safety interlock control system of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements the safety interlock control method of the electron beam irradiation sterilization system provided in the above embodiment.

[0084] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the safety interlock control system described in the above embodiments; or it may exist independently and not assembled into the safety interlock control system. The storage medium carries one or more computer programs that, when executed by a processor of the safety interlock control system, cause the safety interlock control system to implement the safety interlock control method of the electron beam irradiation sterilization system provided in the above embodiments.

[0085] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0086] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A safety interlock control method for an electron beam irradiation sterilization system, characterized in that, include: Acquire multiple safety input signals of the target accelerator included in the electron beam irradiation sterilization system, wherein the multiple safety input signals include hard interlock trigger signals and soft interlock status signals; The hard interlock trigger signal is input to the hard interlock logic circuit so that the hard interlock logic circuit uses the hard interlock trigger signal to perform on / off control operation on the accelerator main power supply circuit. The soft interlock status signal is input to the safety interlock logic controller to obtain the safety interlock ready signal output by the safety interlock logic controller when it determines that the soft interlock status signal meets the preset safety conditions; The safety interlock ready signal is used as the accelerator power supply enable condition, and the safety interlock ready signal is input to the accelerator operation control module controlled by the safety interlock logic controller. When the safety interlock ready signal is valid and the accelerator main power supply circuit is not disconnected, the safety interlock logic controller controls the accelerator operation control module to start the target accelerator operation. When the safety interlock ready signal fails or the accelerator main power supply circuit is disconnected, the accelerator operation control module is not controlled to start the target accelerator operation, or the safety interlock logic controller controls the accelerator operation control module to terminate the target accelerator operation.

2. The method according to claim 1, characterized in that, The step of inputting the soft interlock status signal to the safety interlock logic controller to obtain the safety interlock ready signal output by the safety interlock logic controller when it determines that the soft interlock status signal meets the preset safety conditions specifically includes: The soft interlock status signal is input to the safety interlock logic controller, so that the safety interlock logic controller performs the following operation: The safety interlock logic controller receives the soft interlock status signal, and when it determines that the soft interlock status signal includes the inspection button signal, it performs an inspection detection operation on the inspection button signal to obtain the inspection detection result. When the safety interlock logic controller determines, based on the inspection results, that a preset number of inspection buttons have been triggered, it generates an inspection completion signal. After generating the inspection completion signal, the safety interlock logic controller continuously monitors the photoelectric group signal. When the photoelectric group signal is detected to be triggered, the inspection completion signal is cleared and the inspection operation is re-executed. When the safety interlock logic controller does not detect that the photoelectric group signal is triggered, it performs safety interlock analysis on the inspection completion signal and the threshold switch signal, operation authorization signal and equipment operation status signal included in the soft interlock status signal to obtain an intermediate judgment result. When the safety interlock logic controller determines that the inspection completion signal is valid and the intermediate judgment result meets the preset logic conditions, it outputs the safety interlock ready signal.

3. The method according to claim 2, characterized in that, When the safety interlock logic controller does not detect that the photoelectric group signal has been triggered, it performs safety interlock analysis on the inspection completion signal and the threshold switch signal, operation authorization signal, and equipment operating status signal included in the soft interlock status signal to obtain an intermediate judgment result, specifically including: The safety interlock logic controller acquires the current status value of the inspection completion signal, and when it determines that the inspection has been completed based on the current status value of the inspection completion signal, it acquires the current status value of the threshold switch signal, the current status value of the operation authorization signal, and the current status value of the equipment operation status signal. The safety interlock logic controller performs a state matching operation on the current state value of the threshold switch signal, the current state value of the operation authorization signal, and the current state value of the equipment operation status signal to obtain a state matching result. The safety interlock logic controller generates an intermediate judgment result of a valid state when it determines, based on the state matching result, that the current state value of the threshold switch signal indicates that the entrance door of the target accelerator is in a closed state, the current state value of the operation authorization signal indicates that the control panel key switch is in an authorized start state, and the current state value of the equipment operation status signal indicates that both the blower and the exhaust fan are in normal operation. The safety interlock logic controller determines that the inspection is not completed based on the current status value of the inspection completion signal, or determines, based on the status matching result, that at least one of the following situations exists: the current status value of the inspection completion signal indicates that the inspection is not completed; the current status value of the threshold switch signal indicates that the entrance door is not in the closed state; the current status value of the operation authorization signal indicates that the control panel key switch is not in the authorized start state; and the current status value of the equipment operation status signal indicates that both the supply fan and the exhaust fan are not in the normal operation state. In such cases, an intermediate judgment result of invalid status is generated.

4. The method according to claim 2, characterized in that, When the safety interlock logic controller determines that the inspection completion signal is valid and the intermediate judgment result meets the preset logic conditions, it outputs the safety interlock ready signal, specifically including: After determining that the intermediate judgment result is valid, the safety interlock logic controller acquires the current status value of the dose abnormality signal, the current status value of the speed abnormality interlock signal, and the current status value of the power distribution cabinet emergency stop signal. The safety interlock logic controller performs anomaly detection operations on the current state value of the dose anomaly signal, the current state value of the speed anomaly interlock signal, and the current state value of the power distribution cabinet emergency stop signal, and obtains the anomaly detection results; When the safety interlock logic controller determines, based on the anomaly detection results, that the current state value of the dose anomaly signal indicates that the dose is not abnormal, the current state value of the speed anomaly interlock signal indicates that the speed is not abnormal, and the current state value of the power distribution cabinet emergency stop signal indicates that the emergency stop has not been triggered, the safety interlock ready signal is output. When the safety interlock logic controller determines, based on the anomaly detection result, that at least one of the following situations exists: the current state value of the dose anomaly signal indicates a dose anomaly, the current state value of the speed anomaly interlock signal indicates a speed anomaly, and the current state value of the distribution cabinet emergency stop signal indicates that an emergency stop has been triggered, the safety interlock ready signal will not be output.

5. The method according to claim 1, characterized in that, The multiple safety input signals of the target accelerator included in the electron beam irradiation sterilization system specifically include: The hard interlock logic circuit is used to perform first real-time monitoring on the main emergency stop switch, pull-cord switch, escape emergency stop switch and distribution cabinet emergency stop switch that are pre-connected to the hard interlock logic circuit, so as to obtain the contact status of the main emergency stop switch, the pull-cord switch, the escape emergency stop switch and the distribution cabinet emergency stop switch, and use the contact status as the hard interlock trigger signal; The safety interlock logic controller is used to perform a second real-time monitoring of the threshold switch, inspection button, control panel key switch and entrance key switch that are pre-connected to the input module of the safety interlock logic controller, so as to obtain the level status of the threshold switch, inspection button, control panel key switch and entrance key switch in a preset scanning cycle, and use the level status as a switch-type soft interlock status signal; The safety interlock logic controller receives fan operation status data sent by the supply fan controller, exhaust fan operation status data sent by the exhaust fan controller, obstruction detection data sent by the photoelectric sensor, dose measurement data sent by the dose detector, and speed feedback data sent by the speed sensor through the Ethernet communication interface of the safety interlock logic controller, and uses the fan operation status data, exhaust fan operation status data, obstruction detection data, dose measurement data, and speed feedback data as equipment soft interlock status signals.

6. The method according to claim 5, characterized in that, The step of inputting the hard-interlock trigger signal to the hard-interlock logic circuit, so that the hard-interlock logic circuit uses the hard-interlock trigger signal to perform on / off control operation on the accelerator main power supply circuit, specifically includes: The hard interlock trigger signal is input to the hard interlock logic circuit, so that the hard interlock logic circuit performs the following on / off control operation according to the hard interlock trigger signal: When the hard-interlock logic circuit determines, based on the hard-interlock trigger signal, that at least one of the following conditions exists—the main emergency stop switch contact state is open, the pull-cord switch contact state is open, the escape emergency stop switch contact state is open, and the distribution cabinet emergency stop switch contact state is open—it performs a disconnection control operation on the accelerator main power supply circuit, wherein: The hard-locking logic circuit controls the coil circuit of the accelerator main power supply contactor to disconnect, so that the accelerator main power supply contactor performs a main contact disconnection operation and an auxiliary contact disconnection operation. The main contact disconnection operation is a state transition action of the main contact of the accelerator main power supply contactor changing from a closed state to an open state. The auxiliary contact disconnection operation is a state transition action of the auxiliary contact of the accelerator main power supply contactor changing from a closed state to an open state. The hard-interlock logic circuit disconnects the main power supply path of the target accelerator by performing a main contact disconnection operation through the accelerator main power supply contactor, and disconnects the solid-state modulator power supply branch of the target accelerator by performing an auxiliary contact disconnection operation through the accelerator main power supply contactor.

7. The method according to claim 1, characterized in that, The step of using the safety interlock ready signal as an accelerator power supply enable condition and inputting the safety interlock ready signal to the accelerator operation control module controlled by the safety interlock logic controller specifically includes: The safety interlock ready signal is input to the accelerator operation control module, so that the accelerator operation control module performs the following power enable control operation based on the safety interlock ready signal: When the accelerator operation control module determines that the safety interlock ready signal is valid and receives the accelerator power supply start command, it generates an accelerator power supply enable signal. After generating the accelerator power enable signal, the accelerator operation control module performs a linkage start-up operation on the electron beam irradiation sterilization system, wherein: The accelerator operation control module controls the accelerator's main power supply circuit to switch from an open state to an on state; When the accelerator operation control module determines that the accelerator main power supply circuit is in the connected state, it sends a water turbine start command to the water turbine system included in the electron beam irradiation sterilization system to start the water turbine system, sends a transmission start command to the transmission system included in the electron beam irradiation sterilization system to start the transmission system, and sends a charging high voltage control command to the solid-state modulator included in the electron beam irradiation sterilization system to enable the solid-state modulator to perform charging high voltage operation. When the accelerator operation control module determines that the safety interlock ready signal has failed, it stops generating the accelerator power supply enable signal to block the connection of the accelerator main power supply circuit and stop sending the water turbine start command, the transmission start command, and the charging high voltage control command.

8. A safety interlocking control system, characterized in that, The safety interlocking control system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the safety interlocking control system to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instruction is executed on the safety interlock control system, it causes the safety interlock control system to perform the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on the safety interlock control system, it causes the safety interlock control system to perform the method as described in any one of claims 1-7.

Images