Triple redundancy safety instrument system and voting and degradation control method thereof

Abstract

The invention discloses a triple redundancy safety instrument system and a voting and degradation control method of the system, relates to the technical field of safety control, and mainly aims to solve the problem that an existing safety instrument system is poor in safety protection flexibility and scene adaptability. The system mainly comprises three levels of an input module, a controller and an output module, each level comprises parallel channels with the same function, the input module comprises input channels with triple redundancy, the controller comprises controller channels with triple redundancy, and the output module comprises a hardware decision circuit based on a multi-switch circuit and output channels with triple redundancy. Five levels of voting are completed in the system and specifically comprise the first level of voting of an input module, the second level of voting and the third level of voting of a controller, the fourth level of voting of an output module and final driving of a hardware decision circuit, the voting of any level is executed according to a voting mode, and the voting mode is determined based on a degradation strategy of 3-3-2-2-1-0. The method is mainly used for safety control.

Description

Technical Field

[0001] This invention relates to the field of safety control technology, and in particular to a triple redundant safety instrument system and a voting and degradation control method for the system. Background Technology

[0002] Safety instrumented systems (VIS) are the last line of defense for ensuring the safety of high-risk industrial processes such as petrochemicals, nuclear power, and oil and gas transportation. Their core mission is to accurately and reliably execute predetermined safety actions (such as emergency shutdowns) when process parameters reach hazardous thresholds, preventing personal injury, major environmental damage, and significant property loss. Therefore, safety instrumented systems themselves must possess extremely high levels of safety and availability, typically achieved through redundant architectures and complex diagnostic and voting mechanisms.

[0003] Currently, mainstream safety instrumented systems in the industry still face challenges in complex application scenarios where the consequences of failures are extremely severe and high production continuity is required (e.g., certain safety monitoring in nuclear reactors, interlocking protection of large LNG core units). Specifically, when encountering multiple, multi-level distributed failures, their fault tolerance strategies often lack sufficient "intelligence" and "flexibility." Existing degradation logic typically determines the loss of system safety functions and triggers a complete safety shutdown upon detecting a specific combination of channel failures, resulting in low flexibility and accuracy in fault isolation. Summary of the Invention

[0004] In view of this, the present invention provides a triple redundant safety instrument system and a voting and degradation control method for the system, the main purpose of which is to solve the problems of poor safety protection flexibility and scenario adaptability of existing safety instrument systems.

[0005] According to one aspect of the present invention, a triple-redundant safety instrument system is provided, comprising three levels: an input module, a controller, and an output module. Each level includes parallel channels with the same function. The input module includes triple-redundant input channels, the controller includes triple-redundant controller channels, and the output module includes a hardware decision circuit based on a multi-switch circuit and triple-redundant output channels. Any of the input channels is used to receive sensor data and perform a first-level vote on the sensor data received by the global input channel; a first control signal is generated based on the first voting result, and the first control signal and the first mass bit are transmitted to the controller; Any of the controller channels is configured to perform a second-level vote based on the first quality bit and the first control signal of the global input channel, and to perform a third-level vote on the second control signal generated based on the second vote result; and to transmit the third control signal and the second quality bit generated based on the third vote result to the output module. Any of the aforementioned output channels is used to perform a fourth-level vote based on the second quality bit and the third control signal of the global controller channel, and to transmit the fourth control signal and the third quality bit generated based on the fourth vote result to the hardware decision circuit. The hardware decision circuit is used to generate a drive signal based on the third quality bit and the fourth control signal of the global output channel. Voting at any level is conducted according to a voting pattern, which is determined based on a 3-3-2-2-1-0 downgrade strategy.

[0006] Furthermore, each level includes a voting unit, each level includes a working layer and a redundancy layer, and each redundancy channel of the level includes a sub-channel configured in the working layer and the redundancy layer; The voting unit is used to maintain the system in a triplet state and not degrade it when the quality bit representation of the global sub-channels in the working layer and the redundant layer is normal, or when the quality bit representation of at least one sub-channel in the working layer is abnormal and the quality bit representation of the global sub-channels in the redundant layer is normal, and the voting mode is determined to be 2oo3D voting. If the quality bit representation of at least one sub-channel in the working layer is abnormal, and the quality bit representation of the sub-channel in the redundant layer corresponding to the abnormal sub-channel in the working layer is also abnormal, the system will be downgraded from a triplet state to a dualt state, and the voting mode will be determined as 1oo2D voting. If the number of sub-channels with normal quality bit representation in the working layer is less than or equal to 1, and there is one sub-channel with normal quality bit representation in the redundant layer, the system is downgraded from a dual state to a single state, and the voting mode is determined to be 1oo1D voting.

[0007] Furthermore, each input channel includes an analog-to-digital conversion unit, an input voting unit, and an input processor unit; During the first-level voting process in any input channel, the analog-to-digital conversion unit is used to convert sensor data into digital signals and interact the digital signals with other input channels to obtain a global digital signal and the quality bits of each digital signal. The input voting unit is used to determine the voting mode based on the quality bits of each digital signal, and to perform a first-level voting on the global digital signal according to the voting mode to obtain an initial voting result. The input processor unit is configured to generate an input control signal based on the initial voting result, and use the input control signal as the first voting result of the input channel.

[0008] Furthermore, any controller channel includes a controller voting unit and a controller processor unit; During the second-level voting process in any controller channel, the controller voting unit is used to interact with the controller voting units of other controller channels regarding the first voting result and the first quality bit, determine the voting mode based on the global first quality bit obtained from the interaction, and perform a second-level vote on the first voting result of the global controller channel according to the voting mode to obtain the second voting result of the controller channel; and transmit the second voting result to the controller processor unit. During the execution of the third-level voting in any controller channel, the controller processor unit is used to synchronize the second voting result with the controller processor units of other controller channels, and to perform the third-level voting on the second voting result of the global controller channel according to the voting mode, so as to obtain the third voting result of the controller channel.

[0009] Furthermore, any output channel includes an output voting unit and an output processor unit; During the fourth-level voting process in any output channel, the output voting unit is used to receive the second quality bit and the third voting result input to the output channel, and to interact with other output channels to obtain the second quality bit and the third voting result of each output channel; determine the voting mode based on the second quality bit, and vote on the third voting result based on the voting mode to obtain the fourth voting result of the output channel; The output processor unit is used to receive the fourth voting result of the output channel, process the fourth voting result, and generate control instructions.

[0010] Furthermore, the hardware decision circuit includes a first switching circuit, a second switching circuit, a third switching circuit, and a fourth switching circuit; The first switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the first output channel indicate that the channel is normal; and when the first output channel indicates an abnormality, if the third quality bit and the fourth voting result of the second or third output channel indicate that it is normal, then it outputs a valid drive signal. The second switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the second output channel indicate that the channel is normal; and when the second output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first output channel or the third output channel indicate that it is normal, then it outputs a valid drive signal. The third switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the third output channel indicate that the channel is normal; and when the third output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first output channel or the second output channel indicate that it is normal, then it outputs a valid drive signal. The fourth switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the first output channel or the third output channel indicate that it is normal; and when both the first output channel and the third output channel indicate abnormality, if the third quality bit and the fourth voting result of the second output channel indicate that it is normal, then a valid drive signal is output.

[0011] Furthermore, the system also includes an input module diagnostic unit, a controller diagnostic unit, and an output module diagnostic unit; The input module diagnostic unit is configured in the input module and is used to perform a first diagnostic measure on at least one component in each input channel and generate a first quality bit based on the first diagnostic result. The first diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity testing, continuous power supply quality monitoring, digital input channel performance cycle diagnosis, digital data consistency voting, analog data consistency voting, external signal loop health status monitoring, and analog input channel accuracy cycle diagnosis. The controller diagnostic unit is configured on the controller and is used to perform a second diagnostic measure on at least one component in each controller channel and generate a second quality bit based on the second diagnostic result. The second diagnostic measure includes at least one of processor health status monitoring, memory integrity diagnosis, continuous power quality monitoring, online process data consistency diagnosis, and synchronous monitoring diagnosis. The output module diagnostic unit is configured in the output module and is used to perform a third diagnostic measure on at least one component in each output channel and generate a third quality bit based on the third diagnostic result. The third diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity diagnosis, continuous power supply quality monitoring, output signal integrity verification, external load loop monitoring, digital output drive capability periodic self-test, and analog output consistency and accuracy verification. The diagnostic measures and / or execution frequency of the input module diagnostic unit, controller diagnostic unit, and output module diagnostic unit are dynamically adjusted based on the current downgrade level.

[0012] According to another aspect of the present invention, a voting and degradation control method for a triple-redundant safety instrumented system is provided, comprising: the method being applied to the aforementioned triple-redundant safety instrumented system, the system comprising three levels: an input module, a controller, and an output module, each level comprising parallel channels with identical functions, the input module comprising triple-redundant input channels, the controller comprising triple-redundant controller channels, and the output module comprising a hardware decision circuit based on a multi-switch circuit and triple-redundant output channels; The method includes: Sensor data is received through any of the input channels, and a first-level vote is performed on the sensor data received by the global input channel; a first control signal is generated based on the first vote result, and the first control signal and the first mass bit are transmitted to the controller; The controller channel performs a second-level vote based on the first quality bit and the first control signal of the global input channel, and performs a third-level vote on the second control signal generated based on the second vote result; the third control signal and the second quality bit generated based on the third vote result are transmitted to the output module. The fourth-level voting is performed through any of the output channels based on the second quality bit and the third control signal of the global controller channel, and the fourth control signal and the third quality bit generated based on the fourth voting result are transmitted to the hardware decision circuit. The hardware decision circuit generates a drive signal based on the third quality bit and the fourth control signal of the global output channel; wherein, the voting at any level is executed according to the voting mode, which is determined based on the 3-3-2-2-1-0 degradation strategy.

[0013] By employing the above-described technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages: This invention provides a triple-redundant safety instrumented system and a voting and degradation control method for the system. In this embodiment, sensor data is received through any of the input channels, and a first-level voting is performed on the sensor data received by the global input channel. A first control signal is generated based on the first voting result, and the first control signal and a first quality bit are transmitted to the controller. A second-level voting is performed through any of the controller channels based on the first quality bit and the first control signal of the global input channel, and a third-level voting is performed on the second control signal generated based on the second voting result. The third control signal and the second quality bit generated based on the third voting result are transmitted to the output module. A fourth-level voting is performed through any of the output channels based on the second quality bit and the third control signal of the global controller channel, and the fourth control signal and the third quality bit generated based on the fourth voting result are transmitted to the hardware decision circuit. The hardware decision circuit generates a drive signal based on the third quality bit and the fourth control signal of the global output channel. This significantly reduces the number of unnecessary safety shutdowns caused by rigid degradation logic in complex fault scenarios, especially when multiple levels and distributed faults are superimposed. Meanwhile, by introducing an innovative five-level voting mechanism and a dynamically adjusted voting mode, the system significantly enhances the accuracy of fault isolation and the breadth of diagnostic coverage.

[0014] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the specification. Furthermore, in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0015] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This diagram illustrates a block diagram of a triple-redundant safety instrument system according to an embodiment of the present invention. Figure 2 This diagram illustrates a voting execution schematic of a triple-redundant safety instrumented system according to an embodiment of the present invention. Figure 3 This diagram illustrates a 3-3-2-2-1-0 degradation method according to an embodiment of the present invention. Figure 4 This diagram illustrates an internal data processing flow of an input module according to an embodiment of the present invention. Figure 5 This diagram illustrates an internal data processing flow of a controller according to an embodiment of the present invention. Figure 6 This diagram illustrates an internal data processing flow of an output module according to an embodiment of the present invention. Figure 7 This diagram illustrates a hardware decision circuit according to an embodiment of the present invention. Figure 8 The flowchart illustrates a voting and degradation control method for a triple redundant safety instrument system provided by an embodiment of the present invention. Detailed Implementation

[0016] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0017] To address the shortcomings of existing safety instrumented systems (VIS) in terms of safety protection flexibility and scenario adaptability, this invention provides a triple-redundant safety instrumented system, such as... Figure 1 As shown, the system includes three levels: an input module 100, a controller 200, and an output module 300. Each level includes parallel channels with the same function. The input module 100 includes triple redundant input channels, the controller 200 includes triple redundant controller channels, and the output module 300 includes a hardware decision circuit based on a multi-switch circuit and triple redundant output channels.

[0018] Wherein, any one of the input channels is used to receive sensor data and perform a first-level vote on the sensor data received by the global input channel; generate a first control signal based on the first voting result, and transmit the first control signal and a first quality bit to the controller; any one of the controller channels is used to perform a second-level vote based on the first quality bit and the first control signal of the global input channel, and perform a third-level vote on the second control signal generated based on the second voting result; transmit the third control signal and the second quality bit generated based on the third voting result to the output module; any one of the output channels is used to perform a fourth-level vote based on the second quality bit and the third control signal of the global controller channel, and transmit the fourth control signal and the third quality bit generated based on the fourth voting result to the hardware decision circuit; the hardware decision circuit is used to generate a drive signal based on the third quality bit and the fourth control signal of the global output channel; wherein, the voting at any level is executed according to a voting mode, and the voting mode is determined based on a 3-3-2-2-1-0 degradation strategy.

[0019] In this embodiment of the invention, the input module 100 includes triple-redundant input channels, which can be labeled as series A, series B, and series C, respectively. Each input channel may further include an analog input module and a digital input module for receiving data from field sensors (such as temperature, pressure, and switch status sensors). The controller 200 includes triple-redundant controller channels, also corresponding to series A, B, and C. Each series controller channel includes a processor unit and related logic processing resources. The output module 300 includes triple-redundant output channels (series A, B, and C) and a key hardware decision circuit. The output channels may include digital output modules and analog output modules. The hardware decision circuit is a dedicated circuit based on a multiplexer (e.g., a combination of four MOSFETs) used to ultimately drive actuators (such as solenoid valves and motors).

[0020] This system performs a total of five levels of voting, specifically including the first level of voting by the input module, the second and third levels of voting by the controller, the fourth level of voting by the output module, and the final drive of the hardware decision circuit. Among them, the second-level voting, the fourth-level voting, and the voting by the hardware decision circuit comprehensively consider the data and its quality (quality bits). For example, if a quality bit of an input channel is bad, it may be ignored or downgraded in the voting process.

[0021] In an application instance, such as Figure 2 The diagram illustrates the voting process. Each input channel (e.g., the A-series input channel) receives not only the raw sensor data from its own channel but also data from all other (global) input channels via data synchronization exchange (e.g., via the FPGA bus). Subsequently, the voting logic within that channel (implemented via an FPGA or a secure MCU) performs a first-level vote on these three data streams. Each controller channel (e.g., the A-series CPU) receives the first control signal and the first quality bit from all input channels. It first performs a second-level vote based on this global information. The three CPUs within the controller synchronize data and perform a third-level vote on their respective generated second control signals. Each output channel (e.g., the A-series output channel) receives the third control signal and the second quality bit from all controller channels. It performs a fourth-level vote based on this global information. The hardware decision circuit performs a fifth-level vote and directly generates the physical signals that drive the actuators. Here, VOTE represents a voting unit.

[0022] It should be noted that the voting mode used in voting operations at any level (input, controller, output) in the system is not fixed, but dynamically determined based on an innovative "3-3-2-2-1-0" degradation strategy. For example... Figure 3As shown, this strategy allows the system to degrade step by step in the event of a failure: from triplet operation (3), down to dualt operation (2), further down to single-channel operation (1), and finally to a fully safe state (0). Compared with the existing 3-3-2-2-0 strategy, this adds a single redundancy stage (1), enabling the system to maintain core safety monitoring functions briefly when only one normal channel remains, rather than shutting down immediately, thus significantly improving the system's resilience and fault tolerance in high-risk, high-availability scenarios. The voting mode will adaptively select based on the current degradation stage of the system and the quality bit status of each channel. For example, when all three channels are in normal condition, a 2oo3 vote is used; when two channels are in normal condition, a 1oo2 vote may be used; when only one channel is in normal condition, the value of that channel is directly used.

[0023] In one embodiment of the present invention, for further explanation and limitation, each level includes a voting unit, each level includes a working layer and a redundancy layer, and each redundancy channel of the level includes a sub-channel configured in the working layer and the redundancy layer.

[0024] Specifically, if the quality bit representation of the global sub-channels in the working layer and the redundancy layer is normal, or if the quality bit representation of at least one sub-channel in the working layer is abnormal, and the quality bit representation of the global sub-channels in the redundancy layer is normal, the system will remain in a triplet state without degradation, and the voting mode will be determined as 2oo3D voting. If the quality bit representation of at least one sub-channel in the working layer is abnormal, and the quality bit representation of the sub-channel in the redundancy layer corresponding to the abnormal sub-channel in the working layer is also abnormal, the system will be degraded from a triplet state to a binary state, and the voting mode will be determined as 1oo2D voting. If the number of sub-channels with normal quality bit representation in the working layer is less than or equal to 1, and there is one sub-channel with normal quality bit representation in the redundancy layer, the system will be degraded from a binary state to a unary state, and the voting mode will be determined as 1oo1D voting.

[0025] In this embodiment of the invention, each level (input module, controller, output module) has a centralized voting unit. Furthermore, the input module as a whole is further subdivided into a working layer and a redundancy layer. For example... Figure 3 As shown, the input module includes module 1# and module 1'#. Module 1# can be considered the main working layer, and module 1'# can be considered the redundant layer. Each layer contains its own redundant sub-channels. The voting unit monitors the quality bits of all sub-channels (working layer A / B / C + redundant layer A / B / C) within that layer, thereby directly and globally determining the health status of the entire layer and even the entire system, and the appropriate degradation stage.

[0026] When the quality bits of all global sub-channels (i.e., the sub-channels of the working layer and the corresponding sub-channels of the redundant layer) in both the working layer and the redundancy layer are normal, this means that both layers of backup for the redundant channel are healthy. Alternatively, when the quality bit of at least one sub-channel in the working layer is abnormal (a fault has occurred), but as long as the quality bits of all global sub-channels in the redundant layer are normal, the system considers the redundant layer to be intact and can completely take over or compensate for the fault in the working layer. Under either of these conditions, the voting unit determines that the system remains in a triplet state and does not degrade. In this case, the system adopts the highest reliability 2oo3D voting mode (two out of three with diagnostics).

[0027] When at least one subchannel in the working layer exhibits an abnormal quality bit, and the corresponding subchannel in the redundancy layer also exhibits an abnormal quality bit, this means that a pair of mutually backup subchannels (one in the working layer and the other in the redundancy layer) have simultaneously failed, rendering one complete backup pair of the redundancy channel ineffective. The voting unit determines that the system needs to be downgraded from a triplet state to a binary state. At this point, the remaining two normal channels (systems) will adopt a 1oo2D voting mode (two-out-of-one with diagnostics). The system can still maintain its safety functions, but its fault tolerance is reduced by one level.

[0028] When the fault worsens to the point that the number of sub-channels with normal quality bit representation in the working layer is less than or equal to one (i.e., at most only one normal), and simultaneously, there is only one sub-channel with normal quality bit representation in the redundancy layer, the voting unit determines that the system has degraded from a dual state to a single state. At this point, the system has only one usable normal channel (possibly from the working layer or the redundancy layer). The system will adopt a 1oo1D voting mode (single-channel operation with diagnostics). During this stage, the system does not immediately enter a safe shutdown (state 0), but relies on this single channel and its high diagnostic coverage of up to 99% to temporarily maintain the most critical safety monitoring functions (e.g., continuously monitoring whether key process parameters exceed limits), providing operators with buffer time or executing contingency plans for non-immediate shutdown, thereby avoiding unplanned shutdowns caused by transient or non-fatal multiple faults. The single redundancy stage greatly enhances the system's resilience under multi-level fault superposition and extreme scenarios.

[0029] In one embodiment of the present invention, for further explanation and limitation, any input channel includes an analog-to-digital conversion unit, an input voting unit, and an input processor unit.

[0030] During the first-level voting process in any input channel, sensor data is converted into digital signals by an analog-to-digital converter. These digital signals are then exchanged with other input channels to obtain a global digital signal and the quality bits of each digital signal. An input voting unit determines a voting mode based on the quality bits of each digital signal and performs a first-level vote on the global digital signal according to this mode to obtain an initial voting result. An input processor unit generates an input control signal based on the initial voting result and uses this input control signal as the first voting result for that input channel.

[0031] In this embodiment of the invention, any input channel mainly includes an analog-to-digital conversion unit, an input voting unit, and an input processor unit. For example... Figure 4 The diagram shows the internal data processing flow of the input module. The triple redundant channels of the input module correspond to channels 1#, 2#, and 3#. The analog-to-digital converter (ADC) is responsible for receiving the raw analog or digital signals from the field sensors. For analog inputs, it performs sampling and analog-to-digital conversion; for digital inputs, it performs level detection and digitization. Finally, it converts the sensor data into a digital signal that can be processed by the processor. The field-programmable gate array (FPGA) of this channel interacts with the corresponding units of the other two redundant input channels via a high-speed communication bus (such as SPI). Through this interaction, each channel not only has its own acquired digital signal but also receives digital signals from the other two channels, thus obtaining a global digital signal. Simultaneously, independent diagnostic circuits such as DAC fault injection and internal circuitry testing are used during this process. Each channel generates a quality bit to indicate whether the signal is reliable (e.g., "normal" or "bad"). These quality bits are also exchanged along with the data. EXMC in the diagram represents the high-speed parallel data bus interface.

[0032] The input voting unit is composed of dedicated logic circuits within the FPGA, used to receive the global digital signal and the corresponding quality bits of each signal from the analog-to-digital converter unit. The core function of the input voting unit is to dynamically determine the voting mode to be used based on the quality bits of each digital signal. For details, please refer to the 3-3-2-2-1-0 degradation strategy executed by any level of the voting unit mentioned above; it will not be elaborated upon here. The input processor unit can be a security-oriented microcontroller (MCU). Figure 4This corresponds to CPU SIL3 and is used to receive the initial voting result from the input voting unit. It then further processes, formats, or adds identification information for this channel to the voting result, ultimately generating a standardized input control signal. Of course, the initial voting result can be obtained through different calculation methods for different types of analog and digital signals. As shown in Table 1, for digital signals, the voting mode can be 2oo3 (two out of three); for analog signals, the voting mode can be the median or average value.

[0033] Table 1: Voting Mechanism of Input Module

[0034] In one embodiment of the present invention, for further explanation and limitation, any controller channel includes a controller voting unit and a controller processor unit.

[0035] Specifically, during the second-level voting process in any controller channel, the controller voting unit interacts with the controller voting units of other controller channels regarding the first voting result and the first quality bit. Based on the globally obtained first quality bit, a voting mode is determined, and the first voting result of the global controller channel is voted on according to the voting mode to obtain the second voting result of the controller channel. This second voting result is then transmitted to the controller processor unit. During the third-level voting process in any controller channel, the controller processor unit synchronizes data with the controller processor units of other controller channels regarding the second voting result, and performs a third-level vote on the second voting result of the global controller channel according to the voting mode to obtain the third voting result of the controller channel.

[0036] In embodiments of the present invention, such as Figure 5 The diagram illustrates the data processing flow within the controller. Each controller channel's voting unit (FPGA) interacts with the voting units of the other two redundant controller channels via the controller's internal communication bus, SPI. The interaction involves the first voting result (i.e., the input control signal) received by each channel from the input module, along with its corresponding first quality bit. After determining the voting mode, the controller voting unit performs a second-level vote on the first voting result (i.e., the three input control signals) of the global controller channel according to this mode. The output of the second-level vote is the final decision value for the sensor data from that controller channel, referred to as the second voting result. This result reflects the consistency of the judgment regarding the field status after dual voting by the input module and the controller.

[0037] The controller voting unit transmits the second voting result to the controller processor unit of its own channel. Upon receiving the second voting result, the controller processor unit (i.e., the CPU) uses it as input to execute pre-programmed safety logic operations (such as interlocking equations, PID control, etc.), generating a preliminary control command, i.e., the second control signal. To ensure the consistency of the three controller calculation results, each controller processor unit synchronizes data with the controller processor units of other controller channels. They exchange their respective second control signals generated based on the second voting result. After data synchronization, each controller processor unit needs to perform a third-level vote on the second control signal of the global controller channel (i.e., the calculation results of each of the three systems) according to the current system's voting mode (determined by the second-level voting and maintained consistently across the three systems). This vote does not judge the input data but ensures that the outputs of the three redundant controllers after logical operations are consistent. The vote produces the final third voting result (i.e., the third control signal) output by the controller channel. This process ensures that even if there are minor instantaneous differences or disturbances among the three CPUs, the commands output to downstream modules are consistent commands confirmed by a majority vote.

[0038] In one embodiment of the present invention, for further explanation and limitation, any output channel includes an output voting unit and an output processor unit.

[0039] Specifically, during the fourth-level voting process on any output channel, the output voting unit receives the second quality bit and the third voting result input to the output channel, and interacts with other output channels to obtain the second quality bit and the third voting result of each output channel; the voting mode is determined based on the second quality bit, and the third voting result is voted on according to the voting mode to obtain the fourth voting result of the output channel; the output processor unit receives the fourth voting result of the output channel, processes the fourth voting result, and generates control instructions.

[0040] In embodiments of the present invention, such as Figure 6The diagram shows the internal data processing flow of the output module. The triple redundant channels of the output module correspond to 1#, 2#, and 3#, respectively. AO is the analog output, and DO is the digital output. The output voting unit (FPGA) receives the controller data directly input to its output channel, namely the second quality bit and the third voting result (third control signal). It also interacts with the output voting units of the other two redundant output channels through the internal communication bus. Through this interaction, each output voting unit obtains the second quality bit and third voting result received by all output channels, forming a global perspective. Based on the obtained second quality bits of each output channel, the voting mode to be adopted is dynamically determined. See the degradation strategy of any level of voting unit for details. See Table 2 for the specific voting mechanisms for digital and analog signals. After determining the voting mode, the output voting unit performs a fourth-level vote on the global third voting result (i.e., the three control signals) according to the voting mode. This vote is a consensus decision made at the controller output level, and its result is called the fourth voting result. This result represents the collective decision of the output module on the final execution command after two levels of voting: input and controller internal voting. DAC is used for digital-to-analog conversion, and ADC is used for fault injection.

[0041] Table 2: Voting Mechanism of Output Module

[0042] The output processor unit (CPU SIL3) receives the fourth voting result from the output voting unit of this channel. The output processor unit is responsible for performing necessary data processing on the fourth voting result. This may include signal format conversion, level adjustment, adding the channel identifier, or executing a specific output algorithm. After processing, it generates control instructions that can directly drive the logic inputs of subsequent circuits, such as the decision circuit. For digital outputs, this control instruction directly corresponds to the switch state; for analog outputs, this control instruction corresponds to the target current or voltage value. Through the division of labor between the output voting unit and the output processor unit, the output channel ensures that the command from the controller undergoes a redundant voting process based on quality bits before final execution, generating reliable local control instructions and preparing for the final drive of the actuator through the hardware decision circuit.

[0043] In one embodiment of the present invention, for further explanation and limitation, the hardware decision circuit includes a first switch circuit, a second switch circuit, a third switch circuit, and a fourth switch circuit; The first switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the first output channel indicate that the channel is normal; and when the first output channel indicates an abnormality, if the third quality bit and the fourth voting result of the second or third output channel indicate that it is normal, then it outputs a valid drive signal. The second switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the second output channel indicate that the channel is normal; and when the second output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first output channel or the third output channel indicate that it is normal, then it outputs a valid drive signal. The third switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the third output channel indicate that the channel is normal; and when the third output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first output channel or the second output channel indicate that it is normal, then it outputs a valid drive signal. The fourth switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the first output channel or the third output channel indicate that it is normal; and when both the first output channel and the third output channel indicate abnormality, if the third quality bit and the fourth voting result of the second output channel indicate that it is normal, then a valid drive signal is output.

[0044] In embodiments of the present invention, such as Figure 7The hardware decision circuit is shown. The first switching circuit is configured to primarily respond to the first output channel (A series), while also providing backup for the second (B series) and third (C series) output channels. The generation logic for its control signal A is: A = AO & AQ + BO & BQ & NOT(AQ) & NOT(CQ) + CO & CQ & NOT(AQ) & NOT(BQ). That is, when channel A is functioning normally, this circuit is on. If channel A fails, but channel B or C is functioning normally, a valid drive signal is also output. The second switching circuit is configured to primarily respond to the second output channel (B series), while also providing backup for the first (A series) and third (C series) output channels. The generation logic for its control signal B is: B = BO & BQ + CO & CQ & NOT(AQ) & NOT(BQ) + AO & AQ & NOT(BQ) & NOT(CQ). Its logic is symmetrical to the first switching circuit. Its core is to ensure that channel B is conducting when it is normal, and to output a valid drive signal even if channel A or C is normal when channel B fails. The third switching circuit is configured to primarily respond to the third output channel (C series), while also providing backup for the first (A series) and second (B series) output channels. The generation logic of its control signal C is: C = CO & CQ + AO & AQ & NOT(BQ) & NOT(CQ) + BO & BQ & NOT(AQ) & NOT(CQ), meaning that when channel C is normal, a valid drive signal is output; when channel C fails, a valid drive signal is also output if channel A or B is normal. The fourth switching circuit is designed as a high-availability backup path. Its strategy is to prioritize the first (A series) and third (C series) output channels, while using the second (B series) output channel as an auxiliary channel under special conditions. The generation logic of its control signal D is: D = AO & AQ + CO & CQ + BO & BQ & NOT(AQ) & NOT(CQ). That is, when channel A or channel C is normal, a valid drive signal is output; when both channels A and C are faulty, if channel B is normal, a valid drive signal is also output.

[0045] It should be noted that by configuring the four switching circuits of the hardware decision circuit with redundancy and logical crossover, even if any two of the three output channels fail, at least one switching circuit can be driven to conduct by the remaining normal channel, thereby providing a reliable drive signal for the actuator. Physically, this achieves a "seamless" connection from the triple-level degradation process to the single-level degradation process, greatly improving system availability.

[0046] In one embodiment of the present invention, for further explanation and limitation, the system further includes an input module diagnostic unit, a controller diagnostic unit, and an output module diagnostic unit; The input module diagnostic unit is configured in the input module and is used to perform a first diagnostic measure on at least one component in each input channel and generate a first quality bit based on the first diagnostic result. The controller diagnostic unit is configured in the controller and is used to perform a second diagnostic measure on at least one component in each controller channel and generate a second quality bit based on the second diagnostic result; The output module diagnostic unit is configured in the output module and is used to perform a third diagnostic measure on at least one component in each output channel and generate a third quality bit based on the third diagnostic result.

[0047] In this embodiment of the invention, to ensure that the system can reliably execute the degradation strategy and voting logic, the health status of each redundant channel must be evaluated in real time and comprehensively. Therefore, dedicated diagnostic units are integrated into the input module, controller, and output module respectively. The first diagnostic measure is integrated within the input module hardware (e.g., distributed in the logic of the security MCU and FPGA). Its core function is to perform the first diagnostic measure on at least one critical component in each input channel. Specifically, it includes at least one of the following: processor health status monitoring, memory integrity testing, continuous power quality monitoring, digital input channel performance cycle diagnosis, digital data consistency voting, analog data consistency voting, external signal loop health status monitoring, and analog input channel accuracy cycle diagnosis. Among them, processor health status monitoring can perform routine instruction testing and watchdog monitoring on the three-system security MCU. Memory integrity testing can perform periodic read and write tests on the memory (including ROM and RAM) storing programs and data to detect permanent or transient faults. Continuous power quality monitoring is used to monitor whether the power supply voltage and current of each part of the input module are within the rated range. Digital input channel performance periodic diagnostics, for example, verify the channel's ability to acquire low and high levels by periodically injecting test signals (such as DAC fault injection). Digital data consistency voting involves cross-comparing and voting on the same DI signal acquired from three systems to promptly detect and isolate acquisition deviations. Analog data consistency voting involves cross-comparing and calculating the median / average of the same AI signal acquired from three systems to detect abnormal data. External signal loop health monitoring continuously monitors the signal lines between the sensor and the input module for open or short circuit faults. Analog input channel accuracy periodic diagnostics verifies whether the sampling accuracy meets requirements by inputting a standard calibration signal to the ADC. Based on one or more of the above diagnostic results, the input module diagnostic unit comprehensively judges whether the input channel is reliable, and then generates the corresponding first quality bit (such as "normal" or "bad"), which is then appended to the acquired data.

[0048] The second diagnostic measure is configured within the controller to monitor the health status of each controller channel, focusing on ensuring the integrity and consistency of control logic operations. Specifically, it includes at least one of the following: processor health status monitoring, memory integrity diagnosis, continuous power quality monitoring, online process data consistency diagnosis, and synchronization monitoring diagnosis. The third diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity diagnosis, continuous power quality monitoring, output signal integrity verification, external load loop monitoring, periodic self-testing of digital output drive capability, and analog output consistency and accuracy verification. Processor health status monitoring involves routine testing and watchdog monitoring of the CPUs on each PU. Memory integrity diagnosis involves permanent and transient fault testing of the variable and immutable memories on each PU. Continuous power quality monitoring involves continuously monitoring the power status of each PU. Online process data consistency diagnosis, during operation, involves the continuous voting behavior of input data and output commands, which itself is a diagnostic tool and can promptly detect errors in the arithmetic units. Synchronization monitoring diagnosis monitors the timing and consistency of data synchronization between redundant PUs, ensuring normal synchronous operation through an independent watchdog or timeout mechanism. Based on these diagnostic results, the controller diagnostic unit generates a second quality bit to indicate whether the calculation results of the controller channel are reliable.

[0049] The third diagnostic measure is built into the output module to ensure the correct generation of the final drive signal. This third diagnostic measure focuses on the integrity and accuracy of the output drive chain. Processor health monitoring involves testing the MCU of the output channel and monitoring its watchdog timer. Memory integrity diagnostics tests for relevant memory faults. Continuous power quality monitoring monitors the power supply of the output module. Output signal integrity verification involves reading back the output voltage via ADC for digital outputs and continuously comparing it with the expected value; for analog outputs, it involves reading back the output current / voltage and continuously comparing it with the three-system output data. External load loop monitoring continuously monitors the connection between the module and the actuator (load) for open or short circuits. Digital output drive capability periodic self-test periodically tests the output high-level capability and output low-level capability. Analog output consistency and accuracy verification verifies the correctness and accuracy of the analog channel output values ​​through independent ADC readbacks and cross-comparisons.

[0050] It should be noted that the diagnostic measures and / or execution frequency of the input module diagnostic unit, controller diagnostic unit, and output module diagnostic unit are dynamically adjusted based on the current degradation level. Mapping relationships between different states and different diagnostic levels can be pre-built. For example, a triplet state is mapped to the full diagnostic level, where all first, second, and third diagnostic measures are activated and run in standard cycle or continuous mode to prevent potential faults. A dualt state is mapped to the core diagnostic level. The diagnostic unit automatically pauses or extends the diagnostic cycle of some non-critical or high-resource functions. For example, it may pause deep, time-consuming integrity scans of memory but continue to run diagnostics of core links related to current operational safety functions, such as processor watchdog timer, power monitoring, and online data consistency comparison. A singlet state is mapped to the minimum diagnostic level. The diagnostic unit focuses its resources on ensuring the absolute reliability of this single normal channel and monitoring for external failures. In this case, only processor health status monitoring (watchdog) may be retained to ensure the control core does not crash; continuous power quality monitoring to ensure the hardware foundation; and external loop monitoring (such as sensor open / short circuits, load loop status) to monitor the most likely external faults that directly affect safety functions. For output modules, only output signal integrity verification is retained to ensure that commands for a single drive channel are executed correctly. Other processes, such as periodic channel capability self-tests and non-critical memory tests, may be temporarily suspended.

[0051] This invention provides a triple-redundant safety instrumented system. In this embodiment, sensor data is received through any of the input channels, and a first-level vote is performed on the sensor data received by the global input channel. A first control signal is generated based on the first vote result, and the first control signal and a first quality bit are transmitted to the controller. A second-level vote is performed through any of the controller channels based on the first quality bit and the first control signal from the global input channel, and a third-level vote is performed on the second control signal generated based on the second vote result. The third control signal and the second quality bit generated based on the third vote result are transmitted to the output module. A fourth-level vote is performed through any of the output channels based on the second quality bit and the third control signal from the global controller channel, and the fourth control signal and the third quality bit generated based on the fourth vote result are transmitted to the hardware decision circuit. The hardware decision circuit generates a drive signal based on the third quality bit and the fourth control signal from the global output channel. This significantly reduces the number of unnecessary safety shutdowns caused by rigid degradation logic in complex fault scenarios, especially when multiple levels and distributed faults are superimposed. Simultaneously, by introducing an innovative five-level voting mechanism and a dynamically adjusted voting mode, the system significantly enhances the fault isolation accuracy and the breadth of diagnostic coverage.

[0052] Furthermore, as a response to the above Figure 1The implementation process of the system shown in this invention provides a voting and degradation control method for a triple-redundant safety instrumented system, such as... Figure 8 As shown, the method includes: The method is applied to the above-mentioned triple-redundant safety instrumented system, and the method includes: 41. Receive sensor data through any of the input channels, and perform a first-level vote on the sensor data received by the global input channel; generate a first control signal based on the first vote result, and transmit the first control signal and the first mass bit to the controller.

[0053] 42. Perform a second-level vote through any of the controller channels based on the first quality bit and the first control signal of the global input channel, and perform a third-level vote on the second control signal generated based on the second voting result; transmit the third control signal and the second quality bit generated based on the third voting result to the output module.

[0054] 43. A fourth-level vote is performed through any of the output channels based on the second quality bit and the third control signal of the global controller channel, and the fourth control signal and the third quality bit generated based on the fourth vote result are transmitted to the hardware decision circuit.

[0055] 44. The hardware decision circuit generates a drive signal based on the third quality bit and the fourth control signal of the global output channel.

[0056] Furthermore, any of the aforementioned levels includes a working layer and a redundancy layer, and any redundant channel of the level includes a sub-channel configured in the working layer and the redundancy layer; During voting at any level within any of the aforementioned hierarchies, the voting pattern is determined based on a 3-3-2-2-1-0 downgrade strategy, including: If the quality bit representation of the global sub-channels in the working layer and the redundant layer is normal, or if the quality bit representation of at least one sub-channel in the working layer is abnormal and the quality bit representation of the global sub-channels in the redundant layer is normal, the system will remain in a triplet state, will not be degraded, and the voting mode will be determined as 2oo3D voting. If the quality bit representation of at least one sub-channel in the working layer is abnormal, and the quality bit representation of the sub-channel in the redundant layer corresponding to the abnormal sub-channel in the working layer is also abnormal, the system will be downgraded from a triplet state to a dualt state, and the voting mode will be determined as 1oo2D voting. If the number of sub-channels with normal quality bit representation in the working layer is less than or equal to 1, and there is one sub-channel with normal quality bit representation in the redundant layer, the system is downgraded from a dual state to a single state, and the voting mode is determined to be 1oo1D voting.

[0057] Furthermore, each input channel includes an analog-to-digital conversion unit, an input voting unit, and an input processor unit; During the first-level voting process in any input channel, the sensor data is converted into a digital signal through the analog-to-digital conversion unit, and the digital signal is exchanged with other input channels to obtain the global digital signal and the quality bits of each digital signal. The input voting unit determines the voting mode based on the quality bits of each digital signal, and performs a first-level vote on the global digital signal according to the voting mode to obtain the initial voting result. The input processor unit generates an input control signal based on the initial voting result, and uses the input control signal as the first voting result of the input channel.

[0058] Furthermore, during the second-level voting process in any controller channel, the controller voting unit interacts with the controller voting units of other controller channels to exchange data regarding the first voting result and the first quality bit. Based on the global first quality bit obtained through the interaction, a voting mode is determined, and the first voting result of the global controller channel is subjected to a second-level vote according to the voting mode to obtain the second voting result of the controller channel. The second voting result is then transmitted to the controller processor unit. During the third-level voting process in any controller channel, the controller processor unit synchronizes the second voting result with the controller processor units of other controller channels, and performs a third-level voting on the second voting result of the global controller channel according to the voting mode to obtain the third voting result of the controller channel.

[0059] Furthermore, any output channel includes an output voting unit and an output processor unit; During the fourth-level voting process in any output channel, the output voting unit receives the second quality bit and the third voting result input to the output channel, and interacts with other output channels to obtain the second quality bit and the third voting result of each output channel; the voting mode is determined based on the second quality bit, and the third voting result is voted on based on the voting mode to obtain the fourth voting result of the output channel; The output processor unit receives the fourth voting result from the output channel, processes the fourth voting result, and generates control instructions.

[0060] Furthermore, the hardware decision circuit includes a first switching circuit, a second switching circuit, a third switching circuit, and a fourth switching circuit; The first switching circuit outputs a valid drive signal when the third quality bit and the fourth voting result of the first output channel indicate that the channel is normal; and when the first output channel indicates an abnormality, if the third quality bit and the fourth voting result of the second or third output channel indicate that it is normal, then a valid drive signal is output. The second switching circuit outputs a valid drive signal when the third quality bit and the fourth voting result of the second output channel indicate that the channel is normal; and when the second output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first or third output channel indicate that it is normal, then a valid drive signal is output. The third switching circuit outputs a valid drive signal when the third quality bit and the fourth voting result of the third output channel indicate that the channel is normal; and when the third output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first or second output channel indicate that it is normal, then a valid drive signal is output. The fourth switching circuit outputs a valid drive signal when the third quality bit and the fourth voting result of the first or third output channel indicate that it is normal; and when both the first and third output channels indicate abnormality, if the third quality bit and the fourth voting result of the second output channel indicate that it is normal, then a valid drive signal is output.

[0061] Furthermore, the system also includes an input module diagnostic unit, a controller diagnostic unit, and an output module diagnostic unit; the input module diagnostic unit is configured in the input module. The input module diagnostic unit performs a first diagnostic measure on at least one component in each input channel and generates a first quality bit based on the first diagnostic result. The first diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity testing, continuous power supply quality monitoring, digital input channel performance cycle diagnosis, digital data consistency voting, analog data consistency voting, external signal loop health status monitoring, and analog input channel accuracy cycle diagnosis. By configuring a controller diagnostic unit in the controller, a second diagnostic measure is performed on at least one component in each controller channel, and a second quality bit is generated based on the second diagnostic result. The second diagnostic measure includes at least one of processor health status monitoring, memory integrity diagnosis, continuous power quality monitoring, online process data consistency diagnosis, and synchronous monitoring diagnosis. The output module diagnostic unit configured in the output module performs a third diagnostic measure on at least one component in each output channel and generates a third quality bit based on the third diagnostic result. The third diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity diagnosis, continuous power supply quality monitoring, output signal integrity verification, external load loop monitoring, digital output drive capability periodic self-test, and analog output consistency and accuracy verification. The content and / or execution frequency of the diagnostic measures of the input module diagnostic unit, controller diagnostic unit, and output module diagnostic unit are dynamically adjusted based on the current degradation level.

[0062] This invention provides a voting and degradation control method for a triple-redundant safety instrumented system. In this embodiment, sensor data is received through any of the input channels, and a first-level voting is performed on the sensor data received by the global input channel. A first control signal is generated based on the first voting result, and the first control signal and a first quality bit are transmitted to the controller. A second-level voting is performed through any of the controller channels based on the first quality bit and the first control signal from the global input channel, and a third-level voting is performed on the second control signal generated based on the second voting result. The third control signal and the second quality bit generated based on the third voting result are transmitted to the output module. A fourth-level voting is performed through any of the output channels based on the second quality bit and the third control signal from the global controller channel, and the fourth control signal and the third quality bit generated based on the fourth voting result are transmitted to the hardware decision circuit. The hardware decision circuit generates a drive signal based on the third quality bit and the fourth control signal from the global output channel. This significantly reduces the number of unnecessary safety shutdowns caused by rigid degradation logic in complex fault scenarios, especially when multiple levels and distributed faults are superimposed. Simultaneously, by introducing an innovative five-level voting mechanism and a dynamically adjusted voting mode, the system significantly enhances the fault isolation accuracy and the breadth of diagnostic coverage.

[0063] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general computing methods. They can be centralized on a single computing method or distributed across a network of multiple computing methods. Optionally, they can be implemented using program code executable by the computing methods, thereby storing them in a storage method for execution by the computing methods. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular hardware and software combination.

[0064] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A triple-redundant safety instrument system, characterized in that, The system comprises three levels: an input module, a controller, and an output module. Each level includes parallel channels with the same function. The input module includes triple-redundant input channels, the controller includes triple-redundant controller channels, and the output module includes a hardware decision circuit based on a multi-switch circuit and triple-redundant output channels. Each of the aforementioned input channels is used to receive sensor data and to perform a first-level vote on the sensor data received by the global input channel; A first control signal is generated based on the first voting result, and the first control signal and the first mass bit are transmitted to the controller; Any of the controller channels is configured to perform a second-level vote based on the first quality bit and the first control signal of the global input channel, and to perform a third-level vote on the second control signal generated based on the second vote result; and to transmit the third control signal and the second quality bit generated based on the third vote result to the output module. Any of the aforementioned output channels is used to perform a fourth-level vote based on the second quality bit and the third control signal of the global controller channel, and to transmit the fourth control signal and the third quality bit generated based on the fourth vote result to the hardware decision circuit. The hardware decision circuit is used to generate a drive signal based on the third quality bit and the fourth control signal of the global output channel. Voting at any level is conducted according to a voting pattern, which is determined based on a 3-3-2-2-1-0 downgrade strategy.

2. The system according to claim 1, characterized in that, Each level includes a voting unit, each level includes a working layer and a redundancy layer, and each redundancy channel of the level includes a sub-channel configured in the working layer and the redundancy layer; The voting unit is used to maintain the system in a triplet state and not degrade it when the quality bit representation of the global sub-channels in the working layer and the redundant layer is normal, or when the quality bit representation of at least one sub-channel in the working layer is abnormal and the quality bit representation of the global sub-channels in the redundant layer is normal, and the voting mode is determined to be 2oo3D voting. If the quality bit representation of at least one sub-channel in the working layer is abnormal, and the quality bit representation of the sub-channel in the redundant layer corresponding to the abnormal sub-channel in the working layer is also abnormal, the system will be downgraded from a triplet state to a dualt state, and the voting mode will be determined as 1oo2D voting. If the number of sub-channels with normal quality bit representation in the working layer is less than or equal to 1, and there is one sub-channel with normal quality bit representation in the redundant layer, the system is downgraded from a dual state to a single state, and the voting mode is determined to be 1oo1D voting.

3. The system according to claim 1, characterized in that, Each input channel includes an analog-to-digital conversion unit, an input voting unit, and an input processor unit; During the first-level voting process in any input channel, the analog-to-digital conversion unit is used to convert sensor data into digital signals and interact the digital signals with other input channels to obtain a global digital signal and the quality bits of each digital signal. The input voting unit is used to determine the voting mode based on the quality bits of each digital signal, and to perform a first-level voting on the global digital signal according to the voting mode to obtain an initial voting result. The input processor unit is configured to generate an input control signal based on the initial voting result, and use the input control signal as the first voting result of the input channel.

4. The system according to claim 1, characterized in that, Each controller channel includes a controller voting unit and a controller processor unit; During the second-level voting process in any controller channel, the controller voting unit is used to interact with the controller voting units of other controller channels on the first voting result and the first quality bit, determine the voting mode based on the global first quality bit obtained by the interaction, and perform the second-level voting on the first voting result of the global controller channel according to the voting mode to obtain the second voting result of the controller channel. The second voting result is then transmitted to the controller processor unit. During the execution of the third-level voting in any controller channel, the controller processor unit is used to synchronize the second voting result with the controller processor units of other controller channels, and to perform the third-level voting on the second voting result of the global controller channel according to the voting mode, so as to obtain the third voting result of the controller channel.

5. The system according to claim 1, characterized in that, Each output channel includes an output voting unit and an output processor unit; During the fourth-level voting process in any output channel, the output voting unit is used to receive the second quality bit and the third voting result input to the output channel, and to interact with other output channels to obtain the second quality bit and the third voting result of each output channel; determine the voting mode based on the second quality bit, and vote on the third voting result based on the voting mode to obtain the fourth voting result of the output channel; The output processor unit is used to receive the fourth voting result of the output channel, process the fourth voting result, and generate control instructions.

6. The system according to claim 1, characterized in that, The hardware decision circuit includes a first switch circuit, a second switch circuit, a third switch circuit, and a fourth switch circuit. The first switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the first output channel indicate that the channel is normal; and when the first output channel indicates an abnormality, if the third quality bit and the fourth voting result of the second or third output channel indicate that it is normal, then it outputs a valid drive signal. The second switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the second output channel indicate that the channel is normal; and when the second output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first output channel or the third output channel indicate that it is normal, then it outputs a valid drive signal. The third switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the third output channel indicate that the channel is normal; and when the third output channel indicates an abnormality, if the third quality bit and the fourth voting result of the first output channel or the second output channel indicate that it is normal, then it outputs a valid drive signal. The fourth switching circuit is used to output a valid drive signal when the third quality bit and the fourth voting result of the first output channel or the third output channel indicate that it is normal; and when both the first output channel and the third output channel indicate abnormality, if the third quality bit and the fourth voting result of the second output channel indicate that it is normal, then a valid drive signal is output.

7. The system according to claim 1, characterized in that, The system also includes an input module diagnostic unit, a controller diagnostic unit, and an output module diagnostic unit; The input module diagnostic unit is configured in the input module and is used to perform a first diagnostic measure on at least one component in each input channel and generate a first quality bit based on the first diagnostic result. The first diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity testing, continuous power supply quality monitoring, digital input channel performance cycle diagnosis, digital data consistency voting, analog data consistency voting, external signal loop health status monitoring, and analog input channel accuracy cycle diagnosis. The controller diagnostic unit is configured on the controller and is used to perform a second diagnostic measure on at least one component in each controller channel and generate a second quality bit based on the second diagnostic result. The second diagnostic measure includes at least one of processor health status monitoring, memory integrity diagnosis, continuous power quality monitoring, online process data consistency diagnosis, and synchronous monitoring diagnosis. The output module diagnostic unit is configured in the output module and is used to perform a third diagnostic measure on at least one component in each output channel and generate a third quality bit based on the third diagnostic result. The third diagnostic measure includes at least one of the following: processor health status monitoring, memory integrity diagnosis, continuous power supply quality monitoring, output signal integrity verification, external load loop monitoring, digital output drive capability periodic self-test, and analog output consistency and accuracy verification. The diagnostic measures and / or execution frequency of the input module diagnostic unit, controller diagnostic unit, and output module diagnostic unit are dynamically adjusted based on the current downgrade level.

8. A voting and degradation control method for a triple-redundant safety instrumented system, characterized in that, The method is applied to a triple-redundant safety instrumented system as described in any one of claims 1-7. The system includes three levels: an input module, a controller, and an output module. Each level includes parallel channels with the same function. The input module includes triple-redundant input channels, the controller includes triple-redundant controller channels, and the output module includes a hardware decision circuit based on a multi-switch circuit and triple-redundant output channels. The method includes: Sensor data is received through any of the input channels, and a first-level vote is performed on the sensor data received by the global input channel; a first control signal is generated based on the first vote result, and the first control signal and the first mass bit are transmitted to the controller; The controller channel performs a second-level vote based on the first quality bit and the first control signal of the global input channel, and performs a third-level vote on the second control signal generated based on the second vote result; the third control signal and the second quality bit generated based on the third vote result are transmitted to the output module. The fourth-level voting is performed through any of the output channels based on the second quality bit and the third control signal of the global controller channel, and the fourth control signal and the third quality bit generated based on the fourth voting result are transmitted to the hardware decision circuit. The hardware decision circuit generates a drive signal based on the third quality bit and the fourth control signal of the global output channel; wherein, the voting at any level is executed according to the voting mode, which is determined based on the 3-3-2-2-1-0 degradation strategy.

9. The method according to claim 8, characterized in that, Each of the aforementioned levels includes a working layer and a redundancy layer, and each redundancy channel of the level includes a sub-channel configured in the working layer and the redundancy layer; During voting at any level within any of the aforementioned hierarchies, the voting pattern is determined based on a 3-3-2-2-1-0 downgrade strategy, including: If the quality bit representation of the global sub-channels in the working layer and the redundant layer is normal, or if the quality bit representation of at least one sub-channel in the working layer is abnormal and the quality bit representation of the global sub-channels in the redundant layer is normal, the system will remain in a triplet state, will not be degraded, and the voting mode will be determined as 2oo3D voting. If the quality bit representation of at least one sub-channel in the working layer is abnormal, and the quality bit representation of the sub-channel in the redundant layer corresponding to the abnormal sub-channel in the working layer is also abnormal, the system will be downgraded from a triplet state to a dualt state, and the voting mode will be determined as 1oo2D voting. If the number of sub-channels with normal quality bit representation in the working layer is less than or equal to 1, and there is one sub-channel with normal quality bit representation in the redundant layer, the system is downgraded from a dual state to a single state, and the voting mode is determined to be 1oo1D voting.

10. The method according to claim 8, characterized in that, Each input channel includes an analog-to-digital conversion unit, an input voting unit, and an input processor unit; During the first-level voting process in any input channel, the sensor data is converted into a digital signal through the analog-to-digital conversion unit, and the digital signal is exchanged with other input channels to obtain the global digital signal and the quality bits of each digital signal. The input voting unit determines the voting mode based on the quality bits of each digital signal, and performs a first-level vote on the global digital signal according to the voting mode to obtain the initial voting result. The input processor unit generates an input control signal based on the initial voting result, and uses the input control signal as the first voting result of the input channel.

Images