A dual controller redundant staggered light bank lighting device for channeling signal lights

Abstract

The utility model discloses a double controller redundancy interlaced lamp group light emitting device for channel signal light belongs to the inland river channel traffic signal equipment and safety control circuit technical field. The device is arranged alternately in two groups of lamp pearl in the same light emitting window, and each group covers all function sections of the preset channel command number type. Two separated circuit boards are powered by independent power supply respectively, and each is provided with a communication module, a controller, a candidate latch, a working latch, a fixed number type decoder, a constant current driver and a lamp current detection circuit. Two candidate state words are confirmed by digital isolator, consistent comparator and cross permission door, and then loaded to the working latch, and the constant current output is opened after the working state is consistent. The fault latch is set by the lamp current anomaly, and the isolating relay loses power. Two groups of constant current light up when highlighting, and one group of constant current light up when lowlighting, and the brightness level does not adopt the high frequency PWM regulation of lamp pearl.

Description

Technical Field

[0001] This utility model belongs to the technical field of inland waterway navigation signal equipment and safety control circuit. It relates to a navigation signal light emitting device with dual independent communication, power supply and control chains, hardware isolation cross confirmation, fault branch power-off isolation and redundant interleaved constant current light groups. It is suitable for situations where reliable navigation command signals need to be displayed, such as shallow and dangerous waterways, sharp bends and narrow river sections, single-span navigation bridges, navigation structures and river sections for construction control above and below water. Background Technology

[0002] In shallow, dangerous waterways, sharp bends, narrow channels, single-span navigation bridges, locks, and other navigation structures along navigable rivers, as well as sections controlled for above-water and underwater construction, waterway management authorities need to use navigation lights to continuously and clearly indicate to vessels the navigation command status, such as permission to proceed upstream, permission to proceed downstream, prohibition of navigation, suspension of upstream navigation, or communication failure. These signals directly participate in vessel navigation command and are crucial for vessels to determine whether they can safely pass through controlled sections. Incorrect signal patterns, momentary mixed signal patterns, or complete extinguishing can all lead to misjudgments by the navigator, potentially causing collisions, groundings, or traffic jams. Therefore, navigation lights themselves must possess high operational reliability and fault isolation capabilities.

[0003] Current navigation signal lights generally adopt a single-chain structure, consisting of a single communication module, a single controller, a single power supply, and a single LED driver circuit. In this structure, a single point of failure in any link of the communication module, controller, power supply, driver, or LED circuit can lead to a complete interruption of the signaling process, preventing the correct signals from being issued to ships. To improve reliability, some solutions attempt to simply connect a backup controller or backup driver in parallel. However, this approach often introduces new common points of failure into the system: such as a common power bus, a common arbitrator, a common driver enable line, or a common LED circuit. This means that the two chains are still interconnected at critical nodes, failing to truly eliminate the risk of single-point failure. In fact, the impact of the failure may even be amplified due to reverse power supply from the backup chain or conflicts in the common enable circuit.

[0004] Furthermore, when two communication links are used to receive remote commands separately, due to differences in transmission latency between different operator networks or access points, the messages received by the two links often arrive one after the other. If the two controllers directly change the display state of their respective light groups after receiving the commands, the two sets of staggered LEDs may output different patterns in a short period of time, forming a momentary mixed pattern. With only two control nodes and relying on software arbitration, when the patterns on both sides are inconsistent, the system cannot reliably determine which side is correct based solely on the software declaration of one controller, thus making it difficult to avoid the short-term presentation of incorrect patterns.

[0005] On the other hand, simply monitoring whether the controller is operating normally does not prove that the constant current drive circuit and the lamp bead circuit are actually in a normal state. In actual operation, the following situation may occur: the controller still outputs the enable level as expected, but the corresponding lamp bead branch has already experienced an open circuit, short circuit, or excessive operating current. If the faulty branch is not reliably disconnected by the physical switch, its abnormal state may affect the healthy lamp group through the shared power supply or shared enable line, making it difficult for the healthy lamp group to continue to work normally under the condition of not being affected by reverse feed-in of the power circuit or common enable interference, or even causing the entire lamp to fail.

[0006] Navigation signal lights also need to differentiate between high and low brightness levels based on day / night cycles, visibility, or management requirements. If the traditional dimming method of applying a high-frequency PWM (pulse width modulation) duty cycle to LED chips to evenly change brightness is used, the high-frequency switching action may cause flickering and electromagnetic switch interference in low-brightness states, and may also interfere with fault detection circuits based on lamp current sampling, leading to misjudgments in current window comparisons. Therefore, it is necessary to construct a device through physical circuitry that can simultaneously solve multiple technical problems, such as mixed signal patterns caused by asynchronous updates of dual chains, isolation of faulty branches, retention of complete signal patterns after single-chain failure, and brightness grading independent of high-frequency PWM. Utility Model Content

[0007] In view of this, the purpose of this utility model is to provide a dual-controller redundant interleaved light group lighting device for navigation signal lights. The candidate code formed by two sets of independent communication and control circuits is hardware-verified by latches, identity comparators, digital isolators, cross-license gates and working latches independent of the controller. Two sets of independent power supply fixed code decoding, constant current drive, light flow window detection and branch isolation circuits are used to drive two complete interleaved light groups respectively, thereby reducing the risk of incorrect code caused by program flow misexecution, single power domain failure, output circuit failure or asynchronous update of two chains.

[0008] To achieve the above objectives, this utility model provides the following technical solution: A dual-controller redundant interleaved light group illumination device for navigation signal lights includes a light body, a first control chain, a second control chain, a first independent power supply, a second independent power supply, a dual-path isolated consistent gating circuit, and a brightness selection circuit. Within the same light-emitting window of the light body, there are interleaved and electrically isolated first and second groups of LED beads. The LED beads in each group are distributed across all functional segments of each preset navigation signal pattern, ensuring that any group of LED beads, when lit independently, can form the complete dot matrix outline of the selected navigation signal pattern. The two light groups are optically overlapping, but their electrical circuits are mutually isolated.

[0009] The first and second control chains are respectively mounted on separate control circuit boards and powered by independent power supplies that are not directly connected in parallel. Each control chain has an independent communication module, controller, candidate instruction latch, operating status latch, fixed code decoder, constant current drive circuit, lamp current window detection circuit, fault latch, and branch isolation relay; the two communication modules each use independent communication access components. The communication modules can be 4G, 5G, or other wireless communication modules, or wired communication modules; the 4G communication module is only a preferred embodiment and is not intended to limit the communication standard. When using wireless communication modules, the two communication modules use independent communication cards and antennas respectively. Specifically, the first control chain is mounted on the first control circuit board and includes, in sequence, a first communication module, a first controller, a first candidate instruction latch, a first operating status latch, a first fixed code decoder, a first final enable gate, a first constant current drive circuit, and a first lamp bead group, and also includes, in sequence, a first lamp current window detection circuit, a first fault latch, and a first branch isolation relay. The second control chain is located on a separate control circuit board from the first control circuit board, and mirrors the second communication module, second controller, second candidate instruction latch, second operating status latch, second fixed-signal decoder, second final enable gate, second constant current drive circuit, second LED group, second lamp current window detection circuit, second fault latch, and second branch isolation relay. The first independent power supply supplies power only to the first control chain, and the second independent power supply supplies power only to the second control chain. The DC output buses of the two independent power supplies are not directly connected in parallel.

[0010] The two controllers output only the fixed-width pattern code, brightness bit, and valid bit obtained through existing conventional communication procedures to their respective candidate instruction latches. The parallel output buses of the two candidate latches are sent to the multi-bit identity comparators of the two power domains via bidirectional digital isolators. The equality output, the ready status of both candidates, and the valid signal of the external watchdog of this chain are used to form a pre-grant of this domain through a pre-grant AND gate. The two pre-grants of this domain are cross-isolated and then driven by the final load AND gate and the monostable pulse shaper to drive the two working state latches.

[0011] The parallel outputs of the two operating state latches are again fed into two operating state consistency comparators via a digital isolator group. In normal double-chain mode, only when both operating state consistency comparators output equal states will the enable gate open the hardware path from the corresponding fixed-signature decoder to the constant current driver; the brief time difference between the updates of the two operating state latches is shielded by this output confirmation connection, preventing the simultaneous display of two different signatures.

[0012] The high-brightness input simultaneously activates two sets of constant current drives through two brightness selection gates, while the low-brightness input activates only one LED group through a pair of complementary outputs of the brightness selection latch. When the disconnect auxiliary contact of any branch and its opposite zero-current confirmation are both valid, the fault access gate of the unisolated branch allows the healthy LED group to continue to illuminate with constant current according to the confirmed model number in the working state latch of this chain.

[0013] The current setting terminal of the constant current driver is connected to a fixed setting element, and the brightness level is determined by the number of selected LED groups. The enable terminal of the constant current driver remains at an active level during steady-state illumination, without inputting a high-frequency PWM signal for brightness adjustment. When the model requires flashing, an independent real-time clock, a low-frequency divider, and a low-frequency flashing gate switch between rated constant current conduction and cutoff at a low frequency.

[0014] Specifically, the parallel pattern code output, brightness bit output, and valid bit output of each controller are connected to the data input of the candidate instruction latch for this chain, and the candidate write end is connected to the clock end of the candidate instruction latch for this chain. The dual-channel isolated consistency gating circuit includes a bidirectional digital isolator group (used for cross-transmission of candidate words, pre-grant, working words, and fault status hardware feedback), and two candidate multi-bit consistency comparators powered by two independent power supplies (used for comparing the word in this chain with the word on the opposite side and outputting an equality signal when they are equal), two pre-grant AND gates (outputting pre-grant when the word in this chain is equal to the word on the opposite side, both sides are ready, and the watchdog is valid), two final load AND gates (outputting load grant when both the word in this chain and the word on the opposite side are granted), two load pulse shapers, and two working status consistency comparators; the output bus of the candidate instruction latch for this chain and the candidate instruction latch on the opposite side input via the bidirectional digital isolator group. The output bus is connected to the two sets of input terminals of the candidate multi-bit consistency comparator of this chain, respectively; the equality output terminal, the candidate ready terminal, and the opposite candidate ready terminal via the bidirectional digital isolator are connected to the pre-grant AND gate of this chain; the output terminal of the pre-grant AND gate and the output terminal of the opposite pre-grant AND gate via the bidirectional digital isolator are connected to the final load AND gate of this chain, and the output terminal of the final load AND gate is connected to the clock terminal of the working state latch of this chain via the loading pulse shaper of this chain; the output bus of the working state latch of this chain and the output bus of the working state latch via the bidirectional digital isolator are connected to the two sets of input terminals of the working state consistency comparator of this chain, respectively, and the equality output terminal of the working state consistency comparator is connected to the final enable gate of this chain; the code output terminal of each working state latch is connected to the fixed code decoder of this chain, and the two fixed code decoders have the same fixed code mapping.

[0015] The brightness selection circuit is connected between two fixed-type decoders and two final enable gates. When the high brightness input is valid, both final enable gates are opened simultaneously, and when the low brightness input is valid, only one final enable gate is opened. During the enable period, the first constant current drive circuit and the second constant current drive circuit continuously provide the corresponding LED group with a constant current determined by the constant current setting element. The brightness level is not formed by applying high-frequency duty cycle modulation to the LED. The output of each lamp current window detection circuit is connected to the coil of the branch isolation relay of this chain via the chain fault latch and relay driver. The normally open main contact of the branch isolation relay of this chain is connected in series between the independent power supply of this chain and the constant current drive circuit of this chain, so that the normally open main contact is opened when the chain fault latch is set or when the independent power supply of this chain is de-energized. Each final enable gate is also connected to the chain fault control gate. The input of the chain fault control gate is connected to the effective output of the chain working status latch, the forced guided disconnect auxiliary contact of the opposite branch isolation relay, and the opposite zero lamp current confirmation terminal powered by the independent power supply of this chain, so that after the normally open main contact of the opposite branch isolation relay has been opened and the zero lamp current of the opposite lamp group has been confirmed, this chain drives the lamp group of this chain according to the last confirmed dual-path number in the chain working status latch. Preferably, the display area of ​​the number includes an upper triangular functional segment and a lower rectangular functional segment. The light-emitting rows of the triangular functional segment gradually widen from top to bottom, while the light-emitting rows of the rectangular functional segment maintain the same width. Each light-emitting row of the two functional segments is provided with an even number of lamp positions. The first lamp group includes the odd-numbered lamps in each light-emitting row from left to right, and the second lamp group includes the even-numbered lamps in each light-emitting row from left to right. This allows adjacent lamps to alternately belong to the two lamp groups, and ensures that when either lamp group is powered independently, it forms a complete, allowable upward-moving number pattern with a triangular upper part and a rectangular lower part.

[0016] Preferably, both the first and second independent power supplies include independent batteries, charge / discharge protection circuits, fuses, surge suppression circuits, DC-DC converters, and DC output buses. The first and second control circuit boards are separate printed circuit boards, each connected to an independent communication card and antenna. Except for signals transmitted via a bidirectional digital isolator group, the two control circuit boards do not share a power supply line, a constant current output line, or a drive enable line.

[0017] Preferably, the first candidate instruction latch, the second candidate instruction latch, the first working state latch, and the second working state latch are all composed of parallel D flip-flop groups, and the candidate multi-bit consistency comparator and the working state consistency comparator are all composed of at least one multi-bit identity comparator; the output of each pre-grant AND gate is also connected to the pre-grant latch of this chain, and the output of the pre-grant latch is connected to the final load AND gate of this chain in one path, and connected to the final load AND gate on the opposite side through a bidirectional digital isolator group in another path. The connection path from the final load AND gate to the clock end of the working state latch does not pass through the first controller or the second controller.

[0018] Preferably, the fixed-code decoder uses a line decoder and a diode matrix to map the finite code to a static enable combination of each LED's functional segment. The controller does not directly send arbitrary pixel data to the constant current drive circuit; high-priority inputs such as manual navigation blocking can also directly select a fixed navigation prohibition code via relay switching contacts.

[0019] Preferably, each lamp current window detection circuit includes a sampling resistor connected in series with the corresponding lamp bead group circuit, a current detection amplifier connected across the sampling resistor, and an upper limit comparator and a lower limit comparator connected to the output of the current detection amplifier. The abnormal output terminals of the upper limit comparator and the lower limit comparator are connected to a fault latch composed of cross-coupled gate circuits. The reset terminal of each fault latch is connected to a manual reset contact located inside the lamp body. Each branch isolation relay has a normally open main contact and a forced-guided disconnect auxiliary contact connected in series with the power input circuit of the corresponding constant current drive circuit. The forced-guided disconnect auxiliary contact is connected to the fault access gate on the opposite side via a bidirectional digital isolator group.

[0020] Preferably, the total circuit of each LED group also passes through an isolated DC current sensor powered by an independent power supply on the opposite side. The zero current comparison output terminal of the isolated DC current sensor is connected to the fault access gate on the opposite side. The same fault access gate is only opened when the forced guided disconnect auxiliary contact of the isolation relay on the opposite branch and the zero lamp current confirmation terminal on the opposite side are both effective.

[0021] Preferably, the brightness selection circuit includes a brightness selection latch, a first brightness selection gate connected in series with the first control chain, and a second brightness selection gate connected in series with the second control chain; the high brightness input terminal is connected to the high brightness enable terminal of the first brightness selection gate and the second brightness selection gate respectively, and the low brightness input terminal is connected to the low brightness enable terminal of the first brightness selection gate and the second brightness selection gate respectively via a pair of complementary outputs of the brightness selection latch; in the low brightness state, the brightness selection latch alternately selects the first LED group and the second LED group according to the low brightness command confirmed by both channels each time; when the selected LED group fails and is confirmed to be isolated, the LED group that is not isolated is selected by the corresponding fault gate.

[0022] Preferably, each control chain further includes a window watchdog circuit and a repeatable triggerable monostable circuit, which are set independently of the controller; the input of the window watchdog circuit is connected to the periodic pulse output of the corresponding controller, and its failure output is connected to the clear terminal of the corresponding candidate instruction latch and the pre-grant AND gate, respectively; the trigger terminal of the repeatable triggerable monostable circuit is connected to the network status pulse output of the corresponding communication module, and its timeout output is connected to the pre-grant AND gate.

[0023] Preferably, each control chain is also connected to a water depth permit input circuit and a manual navigation closure input circuit; the water depth permit input circuit includes two field passive contacts that close when the water depth is within the controlled range, each field passive contact has an electrically isolated secondary contact connected to two independent power domains respectively, the two electrically isolated secondary contacts in each independent power domain are connected in series to the water depth permit relay coil circuit of the domain, and the normally open contact of the water depth permit relay is connected in series to the normal occupancy enable circuit; the manual navigation closure input circuit includes two field passive contacts that close when there is no navigation closure order, the two corresponding secondary contacts in each independent power domain are connected in series to the navigation closure permit relay coil circuit of the domain, the normally open contact of the navigation closure permit relay is connected in series to the normal occupancy path, and its normally closed changeover contact is connected to the fixed prohibition navigation occupancy input terminal.

[0024] Preferably, each control chain further includes an independent real-time clock, a low-frequency divider, and a low-frequency flashing gate. The square wave output of the independent real-time clock is connected to the low-frequency flashing gate via the low-frequency divider. The flashing enable bit of the working state latch is connected to the other input of the low-frequency flashing gate. The output of the low-frequency flashing gate is connected in series between the fixed-type decoder and the enable terminal of the constant current drive circuit. The low-frequency flashing gate only switches between the rated constant current on state and the off state and is not used to form a brightness difference between the high brightness state and the low brightness state.

[0025] The beneficial effects of this utility model are as follows: (1) This solution improves the deterministic connection relationship between components within the dual independent power domains without relying on new computer program flow; even if the controller is replaced with a model running an equivalent known program, the physical circuit construction of candidate comparison, cross-licensing, working latch, fixed decoding and fault isolation remains unchanged.

[0026] (2) The candidate latch, multi-bit identity comparator, pre-permission gate, cross-isolation connection and final loading gate used in this scheme form a hardware consistency confirmation independent of the controller. The different arrival times of the two communication messages will not directly cause the two groups of lamp beads to output different numbers.

[0027] (3) The working status of this scheme is compared again and the final enable is controlled, which can shield the slight difference in the loading time of the two working latches and avoid short-term mixing of the old and new models.

[0028] (4) The two control boards, two sets of battery busbars, two sets of communication inputs, two sets of fixed decoders and two sets of constant current outputs used in this scheme do not share power supply lines and drive enable lines, which reduces the probability of two sets failing simultaneously due to a single power supply, common arbitrator or common enable device.

[0029] (5) The lamp current sampling, window comparison, fault latching, power failure disconnection relay, auxiliary contacts and opposite side power supply zero lamp current confirmation constitute an observable physical isolation chain. After the fault branch is disconnected, the healthy branch is not affected by its reverse power supply.

[0030] (6) Each group of LEDs used in this scheme covers the complete outline of the hull number. After a single chain failure is confirmed, the healthy LED group can still display the complete hull number that was confirmed by the double chain before the failure, thus improving the continuity of command.

[0031] (7) The fixed-type decoder used in this scheme only generates preset legal types, and the controller cannot directly splice undefined pixel combinations; the on-site water depth permission and manual navigation closure contacts can also bypass the controller and directly act on hardware enable or fixed code selection.

[0032] (8) The high-brightness dual-group constant current, low-brightness single-group constant current and fault-free healthy group constant current adopted in this scheme do not use high-frequency PWM duty cycle dimming applied to LED beads, which is beneficial to reduce low-brightness flicker, high-frequency interference and lamp current detection misjudgment.

[0033] Other advantages, objectives, and features of this invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination and study, or may be learned from practice of this invention. The objectives and other advantages of this invention can be realized and obtained through the following description. Attached Figure Description

[0034] To make the objectives, technical solutions, and advantages of this utility model clearer, the preferred embodiments of this utility model will be described in detail below with reference to the accompanying drawings, wherein: Figure 1 This is the overall circuit connection block diagram of the dual-controller redundant interleaved lamp group light-emitting device of this utility model; wherein the two lamp groups are optically overlapped and their electrical circuits are isolated from each other, and each communication, control, power supply, drive and lamp bead branch is independent of each other. When a single point of failure occurs in any branch, it will not cause the two control chains to fail simultaneously through the common power supply or common drive path. Figure 2The connection block diagram is used for hardware consistency confirmation of candidate state and loading of working state; among them, the bidirectional digital isolator group is used for cross-transmission of candidate word, pre-license and working word. When the candidate words are equal and both parties agree, the working state is loaded. When the two working words are equal again, the output is opened. When the two communication messages arrive one after the other, the original working state is maintained and no new and old number patterns are superimposed. Figure 3 The connection block diagram is for fixed number decoding, water depth permission and manual navigation blockade hard-wired priority selection, brightness group selection, low frequency flashing timing and constant current drive enable; among them, the fixed number decoder only outputs the pre-wired legal number, the water depth permission and manual navigation blockade contacts form hard-wired priority, high brightness is formed by two groups of constant current at the same time, low brightness is formed by one group of constant current, and low frequency flashing is not used for brightness adjustment. Figure 4 The connection block diagram for lamp current sampling, window comparison, fault latching, branch isolation relay and opposite side fault takeover (taking the first output chain fault as an example); where the controller declares that the fault cannot be triggered by the takeover alone, the fault takeover must obtain the physical disconnection of the branch and zero lamp current hardware evidence at the same time, and the healthy lamp group continues to display the confirmed complete model with the rated constant current; Figure 5 This is a schematic diagram showing the permissible upward-line number for two sets of LED beads arranged in an alternating odd-even sequence in each light-emitting row, as well as the display of high brightness, low brightness, and single-chain fault status. The light-emitting outline dimensions of each status are allowed to be different, but the upper part is a triangular functional segment and the lower part is a rectangular functional segment. Figure 6 This is an example wiring diagram of a control chain using a specific chip model and its isolation interface with the opposite side.

[0035] Reference numerals: 1-Lamp body; 2-Light-emitting window; 3-First LED group; 4-Second LED group; 5-First control circuit board; 6-Second control circuit board; 7-First controller; 8-Second controller; 9-First communication module; 10-Second communication module; 11-First independent power supply; 12-Second independent power supply; 13-First constant current drive circuit; 14-Second constant current drive circuit; 15-First candidate instruction latch; 16-Second candidate instruction latch; 17-First working state latch; 18-Second working state latch; 19-First fixed pattern decoder; 20-Second fixed pattern decoder; 21-First window watchdog circuit; 22-Second window watchdog circuit; 23-First final enable gate; 24-Second final enable gate; 25-Brightness selection group latch; 26a-First brightness selection gate; 26b-Second brightness selection gate; 27-First repeatable touch 28-Second retrievable monostable circuit; 29-First independent real-time clock; 30-Second independent real-time clock; 31-First low-frequency divider; 32-Second low-frequency divider; 33-First low-frequency flashing gate; 34-Second low-frequency flashing gate; 35-First lamp flow window detection circuit; 36-Second lamp flow window detection circuit; 37-Dual-channel isolated consistency gating circuit; 38-First gating branch; 39-Second gating branch; 40-Loading pulse shaper; 41-Bidirectional digital isolator group; 42-Candidate multi-bit consistency comparator; 43-Pre-permission AND gate; 44-Final loading AND gate; 45-First fault latch; 46-Second fault latch; 47-First branch isolation relay; 48-Second branch isolation relay; 49-Fault takeover gate; 50-Operating state consistency comparator; 51-Depth permission input circuit; 52-Manual navigation blockade input circuit. Detailed Implementation

[0036] The following specific examples illustrate the implementation of this utility model. Those skilled in the art can easily understand other advantages and effects of this utility model from the content disclosed in this specification. This utility model can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this utility model. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this utility model. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0037] The designation of this utility model refers to the navigation control graphics selected according to the management rules for the controlled river section, such as permitted upstream navigation, permitted downstream navigation, prohibited navigation, suspended upstream navigation, communication failure, or other preset navigation control graphics; the specific graphic type can be set according to the actual river section, but does not change the dual-chain hardware connection of this utility model.

[0038] Example 1: Please see Figures 1-6 This embodiment provides a dual-controller redundant interleaved light group illumination device for navigation signal lights, such as... Figure 1 As shown, the first control circuit board 5 and the second control circuit board 6 are installed in separate electrical mounting areas within the lamp body 1. The first independent power supply 11 and the second independent power supply 12 are respectively connected to the two control boards. The two independent power supplies (i.e., the first independent power supply 11 and the second independent power supply 12) can be a 12V battery and its charging protection unit, respectively; each input is sequentially equipped with a fuse, reverse connection protection device, transient suppression diode, and DC-DC converter. The two 12V buses, the logic power supply bus, and the LED constant current output are not directly connected in parallel. Each branch is independent of each other, and if a single point of failure occurs in any communication, control, power supply, drive, or lamp branch, it will not cause the two control chains to fail simultaneously through the common power supply or common drive path.

[0039] The first communication module 9 and the second communication module 10 are respectively connected to independent communication access components, and can access different operator networks, different dedicated access points, or other communication networks. The communication data output terminal, communication data input terminal, and network status terminal of the first communication module 9 are respectively connected to the communication receiving terminal, communication sending terminal, and communication status input terminal of the first controller 7; the second chain adopts a mirror connection.

[0040] In a preferred embodiment, the first communication module 9 and the second communication module 10 can be Quectel EC200U series 4G modules, and the first controller 7 and the second controller 8 can be STM32G0B1CC microcontrollers. Level matching, power decoupling, reset, and power-on control circuits are configured between the communication modules and the microcontrollers according to the device datasheet. The two sets of modules are powered separately, and the power supply and reset lines of either communication module are not connected to the other control board. Figure 6 The diagram shows an example of the device connection for the first control chain. The second control chain uses a mirror connection. The listed device models are for illustrative purposes only.

[0041] The two controllers only perform routine data communication of the communication module, message parsing using existing technology, and fixed-width field output. This complete communication program is implemented using technology known in the art. This invention does not improve message parsing, authentication algorithms, data processing steps, fault attribution procedures, or software state machines; the improvement of this invention begins with the physical connection between the controller's GPIO output and the candidate instruction latch's data terminal.

[0042] In this embodiment, the model number, brightness bit, blink enable bit, valid bit, and reserved parity bit are combined to form an eight-bit candidate word. The eight GPIOs of the first controller 7 are connected to the D0 to D7 terminals of the first candidate instruction latch 15, and the candidate write pulse output is connected to its CP terminal; the second controller 8 is connected in the same way as the second candidate instruction latch 16. The candidate instruction latch can be an SN74HC574 eight-bit D flip-flop, and the clear terminal is constrained by the low-active output of the external watchdog timer in this chain.

[0043] Q0 to Q7 of the first candidate instruction latch 15 are directly connected to one set of inputs of the candidate multi-bit consistency comparator 42 in the first gated branch 38 (used for consistency comparison and cross-licensing), and are also sent to another set of inputs of the candidate multi-bit consistency comparator 42 in the second gated branch 39 via a multi-chip bidirectional digital isolator group 41; the second candidate instruction latch 16 is connected in the opposite direction. The bidirectional digital isolator group 41 preferably uses an ISO7741F with a default low level when power is off, or an isolator with an equivalent channel direction and a default failure state. The required channels for the multi-bit bus are composed of multiple devices forming the bidirectional digital isolator group 41. Figure 2 As shown, the workflow of the first gated branch 38 and the second gated branch 39 is as follows: Step 1: Loading is only performed when the candidate words are equal and both parties agree; Step 2: Output is only enabled when the two working words are equal again. When the two 4G messages arrive one after the other, they maintain their original working state and do not generate superposition of old and new number patterns.

[0044] Each candidate multi-bit consistency comparator 42 can be an SN74HC688 eight-bit identity comparator. The comparator in the first field compares the first candidate word with the isolated input second candidate word, and the comparator in the second field compares the second candidate word with the isolated input first candidate word. The equality output of the comparators, the candidate ready levels on both sides, and the valid output of the TPS3430 window watchdog of this chain are connected to a pre-grant AND gate 43 composed of 74HC11 AND gates.

[0045] The outputs of the two pre-license AND gates 43 are written to the local pre-license latch and then sent to the opposite final load AND gate 44 via the bidirectional digital isolator group 41. Each final load AND gate 44 simultaneously receives the local pre-license latch output and the opposite pre-license latch output from the isolated input, and its output is connected to the load pulse shaper 40 composed of a CD74HC123 dual repeatable trigger monostable multivibrator. The output of the load pulse shaper 40 is directly connected to the CP terminal of the local operating state latch, and the connection path does not pass through the microcontroller.

[0046] The first operating state latch 17 and the second operating state latch 18 can also be SN74HC574. The eight-bit outputs of the two operating state latches are cross-transmitted via bidirectional digital isolator group 41 in the same manner as the candidate bus, and compared in each power domain by an operating state consistency comparator 50 composed of another SN74HC688. Normal dual-chain output permission must pass through the equal output of the operating state consistency comparator 50, so the brief time difference between the loading of the two operating latches only causes output interruption and does not cause mixing of old and new patterns.

[0047] The normal output permission path for each gated branch is formed by the equal output of the operating state consistency comparator 50, the valid output of the local chain window watchdog, the non-timeout output of the local chain communication monostable state, and the auxiliary state of the local chain branch isolation relay, all passing through an AND gate. The output of this normal permission and fault takeover gate 49 is connected to the first final enable gate 23 or the second final enable gate 24 via an OR gate; apart from this hardware OR gate, no common arbitration output exclusively controlled by any single controller is provided.

[0048] exist Figure 3 In the illustrated embodiment (fixed pattern decoding, hard-wired priority, low-frequency flashing, and dual constant current output), the first fixed pattern decoder 19 and the second fixed pattern decoder 20 respectively employ an SN74HC138 line decoder and a diode matrix. The fixed pattern decoder only outputs the pre-wired valid pattern; water depth permission and manual navigation blockade contacts form hard-wired priority; the controller does not directly drive any LED pixel. High brightness is formed by two sets of simultaneous constant current, and low brightness is formed by one set of constant current; low-frequency flashing is not used for brightness adjustment. The pattern code in the working state latch is connected to the SN74HC138 address terminal, and each low-active strobe output is converted into a static enable combination of the corresponding LED functional segment via the diode matrix. The two diode matrices use the same wiring and respectively contain fixed mappings such as allowed uplink, allowed downlink, prohibited navigation, uplink pause, and communication failure.

[0049] The controller is not directly connected to the LED pixels, nor does it output arbitrary dot matrix data to the constant current driver. A hardware priority contact, a brightness selection gate, a low-frequency blinking gate, and a final enable gate are sequentially connected in series between the output of the fixed-type decoder and the enable terminal of the constant current driver. The conduction relationship of these physical devices forms the LED branch enable. The normally open main contact of the branch isolation relay is independently connected in series between the independent power supply of this chain and the power input terminal of the constant current driver circuit.

[0050] The first constant current drive circuit 13 and the second constant current drive circuit 14 can be configured with a set of constant current branches for each LED functional segment. In embodiments with larger power lamp groups, the constant current branch uses an LM3409HV constant current controller and an external power MOSFET, the current detection terminal is connected to a fixed sampling resistor, and the dimming or enable terminal only receives the stable high and low levels of the aforementioned final enable gate; in smaller power lamp groups, an equivalent constant current device with a fixed current setting resistor and a static enable terminal can also be used.

[0051] The claim in this invention that brightness adjustment does not employ high-frequency PWM means that the average current difference between high and low brightness is not created by changing the high-frequency duty cycle applied to the LED beads. The high-frequency switching operations performed internally by the constant current controller for current stabilization are not subject to this restriction; the low-frequency flickering required by the model designation rules also does not fall under the category of brightness level PWM.

[0052] like Figure 5 As shown, the allowed upward-facing LED pattern consists of an upper triangular functional segment and a lower rectangular functional segment. The light-emitting rows in the triangular functional segment gradually widen from top to bottom, while the light-emitting rows in the rectangular functional segment maintain the same width. Each light-emitting row in both functional segments has an even number of LED positions. The first LED group 3 is arranged in the odd-numbered positions from left to right in each light-emitting row, and the second LED group 4 is arranged in the even-numbered positions from left to right in each light-emitting row, so that adjacent LEDs in the same light-emitting row alternately belong to the two LED groups. In the rectangular functional segment, the two LED groups occupy fixed staggered LED columns, so that when either LED group is lit alone, the lower light-emitting outline remains a straight rectangle. Each LED group has continuously distributed light-emitting points in both the triangular and rectangular functional segments and can independently form the complete outline of the allowed upward-facing LED pattern. The actual number of light-emitting points and the size of the light-emitting outline may differ in high-brightness, low-brightness, and fault-controlled states, but the upper light-emitting outline remains triangular and the lower light-emitting outline remains rectangular in all states.

[0053] In high-brightness mode, the first brightness selection gate 26a and the second brightness selection gate 26b respectively grant permissions to the two constant current drive chains, and the two groups of LEDs light up simultaneously under the same fixed pattern mapping. In low-brightness mode, the pair of complementary outputs of the brightness selection latch 25 only open one of the first brightness selection gate 26a and the second brightness selection gate 26b, so that one group of LEDs lights up at the rated constant current. The brightness selection latch can use a D flip-flop, and its group selection bit is only updated after the new working status word completes the dual-chain hardware confirmation.

[0054] like Figure 4As shown, the first lamp current window detection circuit 35 and the second lamp current window detection circuit 36 ​​each include a sampling resistor, a current sensing amplifier, and a window comparator. In this embodiment, the current sensing amplifier is an INA180, and the window comparator is a TLV1702 or an upper and lower limit window formed by two LM393 comparators. When the actual current is lower than the lower limit or higher than the upper limit after the LED function segment is enabled and continues to exceed the hardware RC confirmation time, the window comparator outputs an abnormal level.

[0055] The abnormal output of the window comparator is connected to a fault latch (including a first fault latch 45 or a second fault latch 46) consisting of a cross-coupled NAND gate or an SN74HC279. The reset terminal of the fault latch is connected to a normally open reset contact located inside the lamp body and requiring manual operation. The output of the fault latch controls the coil of a branch isolation relay (including a first branch isolation relay 47 or a second branch isolation relay 48) via a transistor. The branch isolation relay can be an Omron G7SA-2A2B with a 12V coil or an equivalent relay with a forced-guided contact; its normally open main contact is connected in series in the power input circuit from the independent power supply of this chain to the constant current drive circuit. When the coil is de-energized, the main contact opens naturally, and the forced-guided disconnect auxiliary contact closes simultaneously, providing an observable physical disconnection state to the opposite gated branch.

[0056] The main circuit of the first LED group 3 passes through an isolated DC current sensor powered by the second independent power supply 12, and the main circuit of the second LED group 4 passes through another isolated DC current sensor powered by the first independent power supply 11. The isolated DC current sensor can be a TMCS1100, whose zero-current window comparison output and the forced-guided disconnect auxiliary contact of the fault branch relay are connected together to the healthy side fault access gate 49.

[0057] When the lamp current in the first output chain is abnormal, the first fault latch 45 deactivates the first branch isolation relay 47. The second gated branch 39 only bypasses the lost comparison condition of the opposite side's operating state through the fault gate 49 when both the first relay's auxiliary contact disconnection and the zero current confirmation of the first lamp group are valid. The pattern that has been previously confirmed by both chains in the second operating state latch 18 continues to be output through the second fixed pattern decoder 20 and the second constant current drive circuit 14. The process is symmetrical when the second chain fails.

[0058] When the power supply on the opposite side fails completely, the power failure switching contact of the relay on the opposite side can replace the fault latched output, and it is still connected in series with the branch isolation relay disconnect auxiliary contact and the zero current confirmation on the opposite side to the fault takeover gate. Therefore, the controller declares that a fault in this chain is not sufficient to trigger takeover on its own, and at least observable hardware evidence of output isolation and zero lamp current is required.

[0059] The window watchdog circuit (including the first window watchdog circuit 21 and the second window watchdog circuit 22) preferably uses a TPS3430, whose input is connected to the periodic pulse GPIO of the corresponding controller, and whose active-low output is connected to the candidate latch clear terminal and the pre-grant AND gate. The retriggerable monostable circuit (including the first retriggerable monostable circuit 27 and the second retriggerable monostable circuit 28) can use a CD74HC123, whose trigger terminal is connected to the network status pulse of the communication module or the external link activity pulse; if it is not repeatedly triggered within a set time, its timeout output cancels the pre-grant of this domain.

[0060] The water depth permit input circuit 51 uses two independent field-operated passive contacts, each with an electrically isolated secondary contact connected to the first and second power domains respectively; the two water depth secondary contacts in the same power domain are connected in series in the water depth permit relay coil circuit. The normally open permit contact closes only when both contacts are closed, and the normal signal enable is cut off when either contact or the circuit is disconnected.

[0061] The manual navigation blockade input circuit 52 also employs two field-active contacts with dual electrically isolated auxiliary contacts. When no navigation blockade command is received, the two contacts activate the navigation blockade permission relay; if either contact operates, disconnects, or the local input power is lost, the relay de-energizes, its normally open contact disconnects the normal code path, and its normally closed changeover contact connects the fixed navigation prohibition code to the local fixed code decoder. This connection bypasses the communication module and controller.

[0062] Each control chain can be configured with an independent real-time clock (including a first independent real-time clock 29 or a second independent real-time clock 30). This embodiment uses the DS3231. The square wave input of the real-time clock is connected to a hardware low-frequency divider (including a first low-frequency divider 31 or a second low-frequency divider 32), and the divided output is connected to a low-frequency flashing gate (including a first low-frequency flashing gate 33 or a second low-frequency flashing gate 34). The flashing enable bit of the operating state latch is connected to another input of the low-frequency flashing gate. The low-frequency flashing gate only switches between rated constant current conduction and cutoff, without changing the set current during conduction.

[0063] During normal operation, the two communication modules receive the same remote command, and the two controllers output candidate words using the existing program. The side that receives the command first only updates its own candidate latch; before the other side's candidate latch forms the same output and the candidate is ready, the candidate comparator does not form a double-sided pre-grant, and the original operating state latch remains unchanged.

[0064] After two candidate words are identical and both pre-permissions are confirmed through isolation cross-validation, the two final load AND gates trigger the load pulse shaper of their respective domains. Two working latches complete loading sequentially; normal output permission is only granted after the comparators achieve equal outputs in both domains. This action is implemented through pin connections of latches, comparators, AND gates, digital isolators, and monostable multivibrators, rather than through additional program flow within the controller.

[0065] When any candidate word is inconsistent, any window watchdog timeout, any communication monostable timeout, or any isolation channel loses its effective level, the pre-permitted AND gate remains closed and no new operating state is loaded. Depending on project requirements, a hardware priority contact can be used to maintain the original confirmed lamp pattern for still-healthy lamps, output a fixed communication fault pattern, or cut off the output. These selections are achieved through fixed decoding inputs and relay switching contacts.

[0066] The EC200U, STM32G0B1CC, ISO7741F, SN74HC574, SN74HC688, CD74HC123, TPS3430, SN74HC138, LM3409HV, INA180, TLV1702, TMCS1100, G7SA-2A2B, and DS3231 mentioned above are merely examples of directly implementable devices and are not intended to limit the scope of protection. As long as the two independent power domains, candidate bus isolation comparison, cross-licensing latching, fixed pattern decoding, constant current output, lamp current fault latching isolation, and defined connections between complete interleaved lamp groups are maintained, equivalent devices that meet the interface level, current capacity, isolation level, and protection requirements can be used.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of this utility model and are not intended to limit it. Although this utility model has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solution of this utility model without departing from the spirit and scope of this technical solution, and all such modifications or substitutions should be covered within the scope of the claims of this utility model.

Claims

1. A dual-controller redundant interleaved light group illumination device for navigation signal lights, characterized in that, It includes a lamp body (1), a first control chain, a second control chain, a first independent power supply (11), a second independent power supply (12), a dual-path isolation consistent gating circuit (37), and a brightness selection circuit; the same light-emitting window (2) of the lamp body (1) is provided with a first group of LED beads (3) and a second group of LED beads (4) that are interleaved and electrically isolated. The LED beads of each group of LED beads are distributed in all functional sections of each preset channel command pattern, so that when any group of LED beads is lit independently, it can form the complete dot matrix outline of the selected channel command pattern; The first control chain is set on the first control circuit board (5) and includes a first communication module, a first controller (7), a first candidate instruction latch (15), a first working state latch (17), a first fixed number decoder (19), a first final enable gate (23), a first constant current drive circuit (13), and a first lamp bead group (3) connected in sequence. It also includes a first lamp flow window detection circuit (35), a first fault latch (45), and a first branch isolation relay (47) connected in sequence. The second control chain is set on a second control circuit board (6) that is separate from the first control circuit board (5) and mirrors the second communication module, the second controller (8), the second candidate instruction latch (16), the second working state latch (18), the second fixed number decoder (20), the second final enable gate (24), the second constant current drive circuit (14), the second lamp bead group (4), the second lamp flow window detection circuit (36), the second fault latch (46), and the second branch isolation relay (48). The parallel code output, brightness bit output, and valid bit output of each controller are connected to the data input of the candidate instruction latch in this chain, and the candidate write end is connected to the clock end of the candidate instruction latch in this chain; the dual-channel isolated consistency gate circuit (37) includes a bidirectional digital isolator group (41), and two candidate multi-bit consistency comparators (42), two pre-permission AND gates (43), two final load AND gates (44), two load pulse shapers (40), and two working state consistency comparators (50) powered by two independent power supplies respectively; the output bus of the candidate instruction latch in this chain and the output bus of the candidate instruction latch on the opposite side input through the bidirectional digital isolator group (41) are respectively connected to the two sets of input terminals of the candidate multi-bit consistency comparator (42) in this chain; the equality output terminal, the candidate ready terminal, and the bidirectional digital isolator input of the candidate multi-bit consistency comparator (42) in this chain are connected to the two sets of input terminals of the candidate multi-bit consistency comparator (42) in this chain. The candidate ready input of the isolator group (41) is connected to the pre-grant AND gate (43) of this chain; the output of the pre-grant AND gate (43) of this chain and the output of the pre-grant AND gate (43) of the bidirectional digital isolator group (41) are connected to the final load AND gate (44) of this chain; the output of the final load AND gate (44) of this chain is connected to the clock terminal of the working state latch of this chain via the loading pulse shaper (40) of this chain; the output bus of the working state latch of this chain and the output bus of the working state latch of the bidirectional digital isolator group (41) are respectively connected to the two sets of input terminals of the working state consistency comparator (50) of this chain; the equality output terminal of the working state consistency comparator (50) of this chain is connected to the final enable gate of this chain; the code output terminal of each working state latch is connected to the fixed code decoder of this chain, and the two fixed code decoders have the same fixed code mapping; The brightness selection circuit is connected between two fixed-type decoders and two final enable gates. When the high brightness input is valid, both final enable gates are opened simultaneously, and when the low brightness input is valid, only one final enable gate is opened. The first constant current drive circuit (13) and the second constant current drive circuit (14) continuously provide the corresponding lamp bead group with a constant current determined by the constant current setting element during the enable period. The brightness level is not formed by applying high frequency duty cycle modulation to the lamp beads. The output of each lamp current window detection circuit is connected to the coil of the branch isolation relay of the chain via the chain fault latch and the relay drive tube. The normally open main contact of the branch isolation relay of the chain is connected in series between the independent power supply of the chain and the constant current drive circuit of the chain, so that the normally open main contact is opened when the chain fault latch is set or when the independent power supply of the chain is de-energized. Each final enable gate is also connected to the chain fault management gate (49). The input of the chain fault management gate (49) is connected to the effective output of the chain working state latch, the forced guided disconnect auxiliary contact of the opposite branch isolation relay, and the opposite zero lamp current confirmation terminal powered by the independent power supply of the chain, so that the normally open main contact of the opposite branch isolation relay has been opened and the zero lamp current of the opposite lamp group has been confirmed, the chain drives the lamp group of the chain according to the last confirmed number in the chain working state latch. The first independent power supply (11) supplies power only to the first control chain, and the second independent power supply (12) supplies power only to the second control chain. The DC output buses of the two independent power supplies are not directly connected in parallel.

2. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1, characterized in that, The display area of ​​the model includes an upper triangular functional segment and a lower rectangular functional segment. The light-emitting rows of the triangular functional segment gradually widen from top to bottom, while the light-emitting rows of the rectangular functional segment maintain the same width. Each light-emitting row of the two functional segments is provided with an even number of lamp positions. The first lamp group (3) includes odd-numbered lamps in each light-emitting row from left to right, and the second lamp group (4) includes even-numbered lamps in each light-emitting row from left to right, so that adjacent lamps alternately belong to the two lamp groups, and so that when either lamp group is powered on independently, a complete model with a triangle at the top and a rectangle at the bottom is formed.

3. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1, characterized in that, The first independent power supply (11) and the second independent power supply (12) both include an independent battery, a charge and discharge protection circuit, a fuse, a surge suppression circuit, a DC converter and a DC output bus; The first control circuit board (5) and the second control circuit board (6) are separate printed circuit boards, which are connected to independent communication cards and antennas respectively. Except for the signal transmitted through the bidirectional digital isolator group (41), the two control circuit boards do not share a power supply line, a constant current output line or a drive enable line.

4. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1, characterized in that, The first candidate instruction latch (15), the second candidate instruction latch (16), the first working state latch (17), and the second working state latch (18) are all composed of parallel D flip-flop groups. The candidate multi-bit consistency comparator (42) and the working state consistency comparator (50) are both composed of at least one multi-bit identity comparator. The output of each pre-permit AND gate (43) is also connected to the pre-permit latch of this chain. One output of the pre-permit latch is connected to the final loading AND gate (44) of this chain, and the other output is connected to the final loading AND gate (44) on the opposite side via a bidirectional digital isolator group (41). The connection path from the final loading AND gate (44) to the clock end of the working state latch does not pass through the first controller (7) or the second controller (8).

5. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1, characterized in that, Each lamp current window detection circuit includes a sampling resistor connected in series with the corresponding lamp bead group circuit, a current detection amplifier connected to both ends of the sampling resistor, and an upper limit comparator and a lower limit comparator connected to the output of the current detection amplifier. The abnormal output of the upper limit comparator and the lower limit comparator is connected to a fault latch composed of cross-coupled gate circuits. The reset terminal of each fault latch is connected to a manual reset contact located in the lamp body (1). Each branch isolation relay is provided with a normally open main contact and a forced-guided disconnect auxiliary contact connected in series with the power input circuit of the corresponding constant current drive circuit. The forced-guided disconnect auxiliary contact is connected to the fault access gate (49) on the opposite side via a bidirectional digital isolator group (41).

6. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1 or 5, characterized in that, The total circuit of each lamp group also passes through an isolated DC current sensor powered by an independent power supply on the opposite side. The zero current comparison output terminal of the isolated DC current sensor is connected to the fault access gate (49) on the opposite side. The same fault access gate (49) is only opened when the forced guided disconnect auxiliary contact of the isolation relay on the opposite side branch and the zero lamp current confirmation terminal on the opposite side are both effective.

7. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1, characterized in that, The brightness selection circuit includes a brightness selection latch (25), a first brightness selection gate (26a) connected in series with the first control chain, and a second brightness selection gate (26b) connected in series with the second control chain. The high brightness input terminal is connected to the high brightness enable terminals of the first brightness selection gate (26a) and the second brightness selection gate (26b), respectively. The low brightness input terminal is connected to the low brightness enable terminals of the first brightness selection gate (26a) and the second brightness selection gate (26b) respectively via a pair of complementary outputs of the brightness selection latch (25). In the low brightness state, the brightness selection latch (25) alternately selects the first LED group (3) and the second LED group (4) according to the low brightness command confirmed by both channels each time. When the selected LED group fails and is confirmed to be isolated, the LED group that is not isolated is selected by the corresponding fault control gate (49).

8. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1, characterized in that, Each control chain also includes a window watchdog circuit and a repeatable triggerable monostable circuit, which are independent of the controller. The input of the window watchdog circuit is connected to the periodic pulse output of the corresponding controller, and its failure output is connected to the clear terminal of the corresponding candidate instruction latch and the pre-grant AND gate (43), respectively. The trigger terminal of the repeatable triggerable monostable circuit is connected to the network status pulse output of the corresponding communication module, and its timeout output is connected to the pre-grant AND gate (43).

9. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1 or 8, characterized in that, Each control chain is also connected to a water depth permit input circuit (51) and a manual navigation blockade input circuit (52); the water depth permit input circuit (51) includes two field passive contacts that close when the water depth is within the control range. Each field passive contact has an electrically isolated secondary contact that is connected to two independent power domains respectively. The two electrically isolated secondary contacts in each independent power domain are connected in series to the water depth permit relay coil circuit of the domain. The normally open contact of the water depth permit relay is connected in series to the normal occupancy enable circuit. The manual navigation blockade input circuit (52) includes two field passive contacts that close when there is no navigation blockade order. The two corresponding secondary contacts in each independent power domain are connected in series to the navigation blockade permit relay coil circuit of the domain. The normally open contact of the navigation blockade permit relay is connected in series to the normal occupancy path. Its normally closed changeover contact is connected to the fixed prohibition navigation occupancy input terminal.

10. The dual-controller redundant interleaved light group illumination device for navigation signal lights according to claim 1 or 8, characterized in that, Each control chain also includes an independent real-time clock, a low-frequency divider, and a low-frequency flashing gate. The square wave output of the independent real-time clock is connected to the low-frequency flashing gate via the low-frequency divider. The flashing enable bit of the working state latch is connected to the other input of the low-frequency flashing gate. The output of the low-frequency flashing gate is connected in series between the fixed-signal decoder and the enable terminal of the constant current drive circuit. The low-frequency flashing gate only switches between the rated constant current conduction state and the off state and is not used to form a brightness difference between the high-brightness state and the low-brightness state.

Images