Remote measurement and control terminal and safety control system

Abstract

The present invention provides a remote measurement and control terminal and a safety control system. The terminal includes an interface module and a processing module. The processing module includes an I / O channel unit and a controller. The I / O channel unit includes an analog quantity interface unit. The analog quantity interface unit includes a signal switching unit and a first switch unit. The input terminal of the first switch unit is connected to the interface module and is used to access a first analog signal input from the outside. The output terminal of the first switch unit is used to transmit the first analog signal to the first input terminal and the second input terminal of the controller. When the signal switching unit receives a first control signal output by the controller, it controls the first switch unit to turn off. When it receives a second control signal output by the controller, it generates a second analog signal and is used to transmit the second analog signal to the first input terminal and the second input terminal of the controller. The remote measurement and control terminal effectively improves the reliability and safety of signal transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of remote measurement and control terminals, and specifically to remote measurement and control terminals and safety control systems.

Background Art

[0002] The safety instrumented system (SIS) is mainly the alarm and interlock part of the factory control system. It performs alarm actions, adjustments, or stop controls on the detection results of the control system and is an important part of the factory's automatic control. For it to operate correctly, a series of devices need to function properly, and sensors that can detect abnormal operating conditions such as high flow rate, low liquid level, and inappropriate valve positions are required. Existing SIS usually has more than 30 control points and is mainly used in medium-scale and large-scale petrochemical plants. However, when the number of required control points is small, its deployment cost is relatively high, so it is not suitable for use in small-scale chemical plants. The functional modules of existing SIS products, such as processing functions, I / O functions, communication functions, safety diagnosis functions, and redundant fault tolerance, are all independent cards. These independent cards are centrally arranged in a standard cabinet and are connected to on-site meters through I / O card wiring. Although it has a mature architecture, it is bulky, difficult to handle, and expensive, so it is only suitable for large-scale process industry equipment, and its integration level is very low, and it is impossible to achieve an integrated digital / analog conversion design. In addition, existing SIS products lack a small integrated I / O channel self-diagnosis circuit suitable for highly integrated systems, and it is impossible to achieve 100% of the I / O channel fault self-diagnosis range.

[0003] A remote terminal unit (RTU) is a special computer measurement and control unit with a modular structure designed for long communication distances and harsh industrial site environments. It is usually used in safety instrumentation systems, where the terminal detection instrumentation and the actuator are connected to the main computer of the remote control center. It has data remote collection, control, and communication functions and can receive operation instructions from the main computer and control the actions of the terminal actuator. Existing RTUs lack an integrated signal self-diagnosis circuit and cannot determine the failure of external input signals, which may generate incorrect control signals and lead to control safety accidents.

Summary of the Invention

Problems to be Solved by the Invention

[0004] An object of an embodiment of the present invention is to provide a remote measurement and control terminal and a safety control system that solve the problem of conventional RTUs that cannot accurately output control signals when a normal I / O channel failure occurs, leading to control safety accidents.

Means for Solving the Problems

[0005] To achieve the above object, in a first aspect of the present invention, it includes an interface module and a processing module. The processing module includes an I / O channel unit and a controller. The interface module is sequentially connected to the I / O channel unit and the controller. The I / O channel unit includes an analog quantity interface unit. The analog quantity interface unit includes a signal switching unit and a first switch unit. The controller is connected to the signal switching unit and the first switch unit in sequence. The input terminal of the first switch unit is connected to the interface module and is used to access a first analog signal input from the outside. The output terminal of the first switch unit is used to transmit the first analog signal to the first input terminal and the second input terminal of the controller. When the signal switching unit receives a first control signal output by the controller, it controls the first switch unit to turn off, thereby disconnecting the connection between the first analog signal and the controller. When the signal switching unit receives a second control signal output by the controller, it generates a second analog signal and is used to transmit the second analog signal to the first input terminal and the second input terminal of the controller, providing a remote measurement and control terminal.

[0006] The second aspect of the present invention provides a safety control system, including an execution unit and the above-mentioned remote measurement and control terminal. The remote measurement and control terminal is used to generate a corresponding execution control signal according to an external input signal and transmit the execution control signal to the execution unit to control the execution unit to execute a corresponding action.

Advantages of the Invention

[0007] The remote measurement and control terminal of the present invention integrates an analog quantity signal self-diagnosis circuit, divides the on-site signal input from the outside or the generated self-test signal into two parts, and can input each part to two different input terminals of the controller. The controller can perform fault identification on the on-site signal or self-test signal input by the two different input terminals, thereby detecting faults in the I / O channel. By switching the on-site signal and the self-test signal, the fault self-diagnosis of the I / O channel can be completely performed. As a result, the controller can output accurate control signals, effectively improving the reliability and safety of signal transmission, and avoiding control safety accidents caused by faults in the signal processing channel.

[0008] Other features and advantages of the embodiments of the present invention will be described in detail in the following part for implementing the invention.

Brief Description of the Drawings

[0009] The drawings are used to provide a further understanding of the embodiments of the present invention, form a part of the specification, and are used together with the following forms for implementing the invention to describe the embodiments of the present invention, but do not limit the embodiments of the present invention.

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Mode for Carrying Out the Invention

[0010] Hereinafter, specific embodiments of the present invention will be described in detail with reference to the drawings. It should be understood that the mode for carrying out the invention described in this specification is for the purpose of explaining and interpreting the present invention, and does not limit the present invention.

[0011] Embodiment 1 As shown in FIG. 1, the first aspect of this embodiment provides a remote measurement and control terminal, which includes an interface module, a logic voting module, and at least two processing modules. The at least two processing modules are respectively connected to the interface module and the logic voting module. The at least two processing modules respectively acquire an external input signal through the interface module, generate a corresponding control signal according to the external input signal, and transmit the generated control signal to the logic voting module. The logic voting module determines a voting result according to the control signals generated by the at least two processing modules, and is used to generate a corresponding execution control signal according to the voting result and transmit the execution control signal to the execution unit.

[0012] Thus, the remote measurement and control terminal of this embodiment has redundant signal processing channels. When any one of its signal processing channels fails, another signal processing channel can output accurate control signals, thereby effectively improving the reliability and safety of signal transmission and avoiding control safety accidents caused by the failure of the signal processing channel.

[0013] The remote measurement and control terminal, that is, the RTU, usually functions as a basic component unit for controlling industrial data collection and monitoring the control system. It has rich communication interfaces, supports various communication methods, and has the characteristic of long communication distance, and can be adapted to various industrial sites in harsh environments. Since the number of control points of the conventional safety system that can realize control functions is usually 30 or more, the conventional RTU is large in size and difficult to install. Therefore, when a small number of control points are required, the deployment cost is high, it is difficult to install, and it is not suitable for safety control such as indoor and outdoor monitoring and alarm and emergency stop of some small chemical plants such as green hydrogen production, fine chemicals, and exhaust gas treatment.

[0014] Specifically, in order to solve the problems existing in the prior art, the remote measurement and control terminal of this embodiment includes two completely identical processing modules. The two processing modules are redundant with each other. The alternative system composed of the two processing modules and the logic voting module can effectively ensure the safety of system control. As shown in Figure 2, the interface module, the logic voting module, and the two processing modules are integrated on the backplane. The logic voting module is provided inside the backplane. The interface module is used to physically or electrically insulate the external input signals input to the two processing modules. In this way, in this application, based on the RTU architecture, an I / O channel self-diagnosis circuit suitable for miniaturization is integrated in the processing module, and by integrating the redundant processing module, the interface module, and the logic voting module on the same circuit board, there is no need to externally attach an additional independent card. The SIS realizes integration and miniaturization, is suitable for small chemical plants, and solves the problems of the conventional SIS that depends on independent cards, has a large volume of equipment, and a low degree of integration. In this embodiment, the two processing modules constitute two redundant signal processing channels. The redundant processing module accesses the external input signals of the field through the interface module, executes corresponding logical calculations according to the external input signals, generates corresponding control signals after processing, and transmits the generated control signals to the logic voting module respectively. The logic voting module executes a 1oo2 vote based on the control signals from the two processing modules, and then outputs the final execution control signal to the execution unit to control the execution unit to execute the corresponding action.For example, taking the case where the external input signal is the temperature signal collected on-site as an example, the temperature signal collected on-site is divided into two through the interface module, and these two are respectively input into two processing modules. The two processing modules execute corresponding logical operations according to the preset algorithm based on the received temperature signal. For example, the processing module converts the received temperature signal into a temperature value, compares the obtained temperature value with the preset temperature threshold. When the temperature value is higher than the temperature threshold, the processing module outputs 1 to the logic voting module. The logic voting module performs a 1oo2 vote on the two received control signals and outputs the corresponding execution control signal, such as 1, to the temperature reduction device to control the temperature reduction device to perform temperature reduction. Here, 1 represents a high-level signal and 0 represents a low-level signal.

[0015] When the logic voting module determines that any one of the control signals generated by at least two processing modules is abnormal, it uses the control signal without abnormality among the control signals generated by at least two processing modules as the execution control signal. When it determines that the control signals generated by at least two processing modules are not abnormal, it uses any one of the control signals generated by at least two processing modules as the execution control signal. And when it determines that all the control signals generated by at least two processing modules are abnormal, it is used to generate a safety control signal as the execution control signal and control the execution unit to stop operating.

[0016] In this embodiment, the processing module can further determine whether the output control signal is abnormal. For example, the output control signal is sampled and fed back, and the sampling value of the output control signal, for example, the sampling voltage value, is compared with a predetermined standard output voltage value to determine whether the output control signal is abnormal. For example, the range of the standard output voltage value when the output is 1 or 0 is determined in advance. When the output is 1, the output voltage is sampled and compared with the predetermined standard output voltage value. If the sampling voltage value is not within the range of the predetermined standard output voltage value, it is determined that the output control signal is abnormal, and a warning signal is generated to notify the operator that this signal output channel is abnormal. The logic voting module performs a 1oo2 vote on the two received control signals to generate a final execution control signal. As can be understood, the logic voting module may be a hardware voting circuit. For example, the output terminals of the two processing modules are connected in series or in parallel through hardware and then connected to the control circuit of the device to be controlled, thereby generating a final execution control signal. It may also be a software voting module. For example, it may be built into a controller for logic voting. The software voting module receives the control signals output by the two processing modules and, based on the fault judgment result by this control signal, for example, when the control signal output by one processing module is 1, the fault judgment result is normal; when the control signal output by the other processing module is 0, the fault judgment result is abnormal. In this case, the software voting module determines 1 as the execution control signal. Also, for example, when the control signal output by one processing module is 1, the fault judgment result is abnormal; when the control signal output by the other processing module is 0, the fault judgment result is also abnormal. In this case, the software voting module determines 0 as the execution control signal and controls the execution unit to enter a safe operating state or stop the operation.

[0017] The voting logic of this embodiment is as shown in Table 1. When both processing module A and processing module B output normally, the logic voting module actually executes the 1oo2 voting method, and the final output result only needs to be the same as the result of either A or B. When A can output normally but the output of B is abnormal, the system actually executes the 1oo1 voting method, and the final output result is the same as the output of A, thereby avoiding system failures caused by failures in a certain channel and improving the reliability of the system. When B can output normally but the output of A is abnormal, the system actually executes the 1oo1 voting method, and the final output result is the same as the output of B. When the outputs of both A and B are abnormal, the system automatically enters the fail-safe state and outputs the fail-safe value. In this embodiment, when the output is in the non-excited state, it is determined that the system is in the safe state, that is, when the output is in the power-off state, it is determined that the system is in the safe state, and for the safety control system, the operation of the device is stopped.

[0018]

Table 1

[0019] Specifically, an example of the voting circuit of this embodiment is as shown in FIG. 3. The outputs of the two processing modules are respectively used to control the on / off of the two switch elements of the voting module. The output terminal switch elements of the two processing modules are connected in parallel through hardware and then connected to the control circuit of the device to be controlled. When the outputs of the two processing modules are all 0, the voting module outputs a safety value of 0, controls the device to be controlled to stop operating. When the outputs of the two processing modules are all 1, the voting module outputs 1 and controls the device to be controlled to operate. When the outputs of the two processing modules are 0 and 1 respectively, the voting module outputs 1 and controls the device to be controlled to operate, thereby avoiding the device to be controlled from stopping when one input fails. For example, before transmitting a control signal, the processing module performs a fault detection on the control signal. For example, processing module A generates control signal 1, and processing module B generates control signal 0. If processing module A determines that there is no abnormality in its control signal, it outputs 1 to the voting module. If it determines that the control signal is abnormal, it outputs 0 to the voting module. If processing module B determines that there is no abnormality in its control signal, it outputs 0 to the voting module. Even if it determines that the control signal is abnormal, it also outputs 0 to the voting module. In this way, when the outputs of both processing modules are normal, voting can be performed according to normal voting logic. When one output is abnormal, a normal control signal can be accurately output, thereby diagnosing the fault of the control signal itself output by the processing module, improving the accuracy rate of the finally determined execution control signal, and reducing the probability of safety control accidents. The safety value may be set according to the actual application. For example, in a specific safety control process, the safety value may be 1, but it is not limited here. As can be understood, the structure of the hardware voting circuit may be arranged according to the specific application. For example, the output terminal switch elements of the two processing modules may be connected in series through hardware and then connected to the control circuit of the control device. Since the structure of the voting circuit is a prior art, it will not be described in detail here.

[0020] In this embodiment, the processing module includes an I / O channel unit and a controller, and the interface module is connected to the I / O channel unit and the controller in sequence. The I / O channel unit includes an analog quantity interface unit, a switching quantity interface unit, and a digital quantity interface unit.

[0021] In this embodiment, the two processing modules are exactly the same and redundant with each other. The two processing modules can also perform full-duplex bidirectional communication via electrically isolated serial ports. In the quality inspection of the two processing modules, they transmit heartbeat signals and fault self-diagnosis results to each other, and thereby, based on the heartbeat signals and fault self-diagnosis results, the operating state of the other party can be determined. If it is determined that a fault has occurred in the other processing module, the current processing module generates a warning signal to notify the operator that a fault has occurred in the other processing module. Thus, if a certain processing module stops due to a fault and cannot generate a warning signal, the other processing module generates a warning signal. On the circuit board of each processing module, the same number of controllers and I / O channels are integrated. For example, one processing module is provided with one controller and 24 I / O channels, but in this embodiment, it is not limited. The types of I / O channels supported by the processing module include three types: DI, AI, and DO. Taking a small system with a system scale of 24 I / O points as an example, the I / O channel unit may include 10 AI interfaces, 6 DI interfaces, and 8 DO interfaces. The I / O channel unit may be expanded according to the needs of the site. In this embodiment, DI has a rated value of 24VDC / 10mA, DO has a rated value of 24VDC / 500mA and a withstand voltage of 60VDC, and AI is better than 0.5%, with a current of 4 to 20mA, an input impedance of 24VDC / 250Ω, a voltage of 0 to 10VDC, an input impedance of 100K or more, the shortest response time from input to output signal is 50ms, and the system power supply is 24VDC±10%.

[0022] The controller is a device that can execute the control logic and other functions of the RTU. For example, the controller may execute the control logic for analyzing sensor data and generating control signals for actuators, or may execute the function of controlling the overall operation of the RTU, for example, supporting the function of communicating with external devices or systems. In some embodiments, the controller may include at least one processing device that executes LINUX or other operating systems. Data may be transmitted between the controller and external devices or systems, such as devices at the site like valves, meters, etc., via I / O channels integrated into the processing module. The controller may receive operation and diagnostic data from one or more devices at the site via one or more I / O channels. Also, the controller may provide operation data and historical data during operation to other control systems, such as DCS, or provide diagnostic data to the control system, and the relevant data may be stored in the controller or other locations. In this embodiment, the controller may be a CPU, MCU, etc., but is not limited here. The system in this embodiment further has an event sequence recording (SOE) function, and the input / output signals have time stamps, which contributes to finding the cause of an accident when analyzing the accident. Here, the SOE time resolution is 1 ms or less.

[0023] In this embodiment, one three-position rotary switch is provided for each integrated processing module, and the functions of the switch positions are defined as follows. Stop is to force the output of this channel to "0" and output an emergency stop signal or an alarm signal. Output invalid is to force the output of this channel to "1" and output a channel bypass signal. Output valid is that this channel outputs normally, that is, collects the input signal, processes it according to the user logic, and then outputs normally. Since the control circuit of the rotary switch is a prior art, it will not be described in detail here.

[0024] Embodiment 2 For the SIS to operate correctly, a series of devices need to function properly, and sensors capable of detecting abnormal operating conditions such as high flow rate, low liquid level, and inappropriate valve positions are required. The logic operation unit receives the input signals from the sensors, makes appropriate decisions according to the characteristics of the signals, changes its output according to the logic defined by the user, thereby controlling the execution unit to control the device operation process and achieve a safe state. The logic operation unit is the processing module of this application and may be an electrical, electronic or programmable electronic device, such as a relay, a trip amplifier or a programmable logic controller. The signal transmission is usually carried out by an I / O card. If the failure of a single I / O channel cannot be identified or processed, it may have a great impact on the safety and usability of the unit. For example, in the case of analog quantity input signals such as temperature, pressure, and flow rate, during the signal collection process, various situations such as interference and manual wiring errors can be considered in the I / O channel. As a result, the accuracy of the analog quantity signal collection decreases, the reliability and safety of the SIS are affected, and whether this input signal can be accurately collected is very important for the safety of the entire SIS function.

[0025] To solve the above problems, as shown in FIG. 4, based on Embodiment 1, the analog quantity interface unit of this embodiment includes a signal switching unit and a first switch unit. The controller is sequentially connected to the signal switching unit and the first switch unit. The input terminal of the first switch unit is connected to the interface module and is used to access the first analog signal input from the outside. The output terminal of the first switch unit is used to transmit the first analog signal to the first input terminal and the second input terminal of the controller. When the signal switching unit receives the first control signal output by the controller, it controls the first switch unit to turn off, thereby disconnecting the connection between the first analog signal and the controller. When the signal switching unit receives the second control signal output by the controller, it generates a second analog signal and is used to transmit the second analog signal to the first input terminal and the second input terminal of the controller.

[0026] Specifically, an A / D conversion module is connected to the first input terminal and the second input terminal of the controller. The analog signals input to the first input terminal and the second input terminal of the controller are A / D converted by the A / D conversion module and converted into corresponding digital signals, and then transmitted to the logic processing unit of the controller, whereby actions such as communication, self-test, and calculation are performed. The first analog signal may be a signal collected from the on-site signals, such as signals from sensors such as a flow sensor and a liquid level sensor of a safety meter system, and may be a 4~20mA current signal or a 0~10VDC voltage signal, but is not limited here. The collected on-site analog signal is further converted into a voltage signal of up to 5VDC by a sampling circuit and then input to the first switch unit. The second analog signal is a self-test signal. When a self-test is required, the controller controls the signal switching unit to generate a self-test signal. When operating normally, the first switch unit is in a conducting state, and the collected on-site signal is transmitted by the first switch unit to the two input terminals of the controller. The controller determines whether the analog signals received by the two input terminals are abnormal, and thereby can select an accurate input signal as the next calculation target signal. Also, the controller can determine whether a failure has occurred in the input terminal of the controller or the on-site signal input channel based on whether the analog signals received by the two input terminals are abnormal. When a self-test is required, the controller controls the first switch unit to be disconnected by controlling the signal switching unit. At this time, the on-site signal is disconnected from the controller, and the self-test signal by the signal switching unit is input to the two input terminals of the controller. The controller determines whether a failure has occurred in the input terminal of the controller or the self-test signal input channel based on whether the self-test signal received by the two input terminals is abnormal.

[0027] The signal switching unit includes a first signal switching subunit, a second signal switching subunit, a first switch subunit, a second switch subunit, a switch signal generation unit, and a second analog signal generation unit. The input terminal of the first signal switching subunit is connected to the first output terminal of the controller and is used to receive the first control signal. The output terminal of the first signal switching subunit is connected to the input terminal of the first switch subunit. The output terminal of the first switch subunit is connected to the switch signal generation unit and then to the control terminal of the first switch unit. The input terminal of the second signal switching subunit is connected to the second output terminal of the controller and is used to receive the second control signal. The output terminal of the second signal switching subunit is connected to the input terminal of the second switch subunit. The output terminal of the second switch subunit is connected to the analog signal generation unit and then to the first input terminal and the second input terminal of the controller. It is understood that the first switch subunit and the second switch subunit may be independent switch units or may be integrated into one module. The first output terminal of the controller is used to output the first control signal, and the second output terminal of the controller is used to output the second control signal.

[0028] As shown in FIG. 5, in this embodiment, the analog quantity interface unit further includes an isolation amplifier U1 and a signal conditioning amplifier U2. The output terminal of the switch module U3, which is the first switch unit, is connected to the input terminal of the isolation amplifier U1. The output terminal of the isolation amplifier U1 is connected to the input terminal of the signal conditioning amplifier U2. The output terminal of the signal conditioning amplifier U2 is connected to the first input terminal and the second input terminal of the controller. Here, the switch module U3 is an analog switch, U1 is an isolation amplifier, and U2 is a conditioning amplifier. Understandably, the switch module U3 further includes related peripheral circuits composed of a voltage dividing resistor R2, a diode D1, a voltage limiting diode D2, a filter resistor R5, a filter capacitor C8, etc. The isolation amplifier U1 further includes filter capacitors C2, C3, and C4 of its related peripheral circuits. The conditioning amplifier U2 further includes resistors R1, R4, R6, R7, R11, and R12, and capacitors C1, C5, C6, C7, and C9 of its related peripheral circuits. The first analog signal, that is, the collected on-site signal AI0, is connected to the S terminal of the switch module U3. The D terminal of the switch module U3 is connected to the IN terminal of the isolation amplifier U1 via the resistor R5.

[0029] As shown in FIG. 6, in this embodiment, the first switch subunit and the second switch subunit are both optical couplers, and the signal switching unit is also used for optical coupling insulation of signals. Specifically, in this embodiment, the first switch subunit and the second switch subunit are integrated into one optical coupler module and function as two control channels of the integrated optical coupler module. For example, in a specific example, the integrated optical coupler module is ASSR5, the first switch subunit and the second switch subunit are respectively two control channels of ASSR5, and the A1 terminal, K1 terminal, NO1 terminal, and CO1 terminal of ASSR5 are respectively the first input terminal, the second input terminal, the first output terminal, and the second output terminal of the first switch subunit, and the A2 terminal, K2 terminal, NO2 terminal, and CO2 terminal of ASSR5 are respectively the first input terminal, the second input terminal, the first output terminal, and the second output terminal of the second switch subunit.

[0030] Specifically, the first signal switching subunit includes a switch element, the switch element is a triode Q17, the switch signal generation subunit includes a diode D4, a resistor R14, and a resistor R8. The base of the triode Q17 is connected to the first output terminal of the controller by a resistor R158, the emitter of the triode Q17 is grounded, the collector of the triode Q17 is connected to the K1 terminal of ASSR5 by a resistor R162, the A1 terminal of ASSR5 is connected to a 24V power supply, the NO1 terminal of ASSR5 is respectively connected to the negative terminal of the diode D4, the first terminal of the resistor R14, and the first terminal of the resistor R8, and then connected to the IN terminal of the switch module U3. The positive terminal of the diode D4 is grounded, the second terminal of the resistor R14 is connected to a first positive voltage signal, the first positive voltage signal is a +24V voltage, and the second terminal of the resistor R8 is connected to the CO1 terminal of ASSR5. In this embodiment, the first output terminal of the controller is DIAG-EN, and the connection point between the NO1 terminal of ASSR5 and the negative terminal of the diode D4, the first terminal of the resistor R14, and the first terminal of the resistor R8 is set as T-N.

[0031] The second signal switching subunit includes a switching element, and the switching element is a triode Q18. The second analog signal generation unit includes a diode D5, a resistor R10, and a resistor R16. The base of the triode Q18 is connected to the second output terminal of the controller by a resistor R163. The emitter of the triode Q18 is grounded. The collector of the triode Q18 is connected to the K2 terminal of the ASSR5 by a resistor R167. The A2 terminal of the ASSR5 is connected to the power supply. The NO2 terminal of the ASSR5 is connected to the second positive voltage signal, and the second positive voltage signal is a +12V voltage. The CO2 terminal of the ASSR5 is connected to the first terminal of the resistor R10. The second terminal of the resistor R10 is connected to the first terminal of the resistor R16 and the negative terminal of the second diode D5, and then connected to the IN terminal of the isolation amplifier U1 through the resistor R2, the diode D1, and the resistor R5, and further connected to the first input terminal and the second input terminal of the controller through the isolation amplifier U1 and the signal conditioning amplifier U2. The second terminal of the fourth resistor R16 is connected to the positive terminal of the diode D5 and then grounded. In this embodiment, the second output terminal of the controller is DIAG-TEST, and the connection point between the second terminal of the resistor R10, the first terminal of the resistor R16, and the negative terminal of the diode D5 is T-P.

[0032] The controller is further configured to compare the first analog signal received by its first input terminal and second input terminal with a preset analog quantity signal threshold respectively. When it is determined according to the comparison result that the first analog signal received by the first input terminal or the second input terminal of the controller is abnormal, a first fault alarm signal is generated, and the second analog signal received by its first input terminal and second input terminal is compared with a preset analog quantity signal threshold respectively. When it is determined according to the comparison result that the second analog signal received by the first input terminal or the second input terminal of the controller is abnormal, it is used to generate a second fault alarm signal.

[0033] When it is determined, based on the comparison result, that there is no abnormality in the first analog signal received by the first input terminal or the second input terminal of the controller, a corresponding control signal is generated according to this abnormality-free first analog signal and transmitted to the logic voting module. When it is determined, based on the comparison result, that there is no abnormality in either of the first analog signals received by the first input terminal and the second input terminal of the controller, a corresponding control signal is generated according to either of the abnormality-free first analog signals and transmitted to the logic voting module. When it is determined, based on the comparison result, that all of the first analog signals received by the first input terminal and the second input terminal of the controller are abnormal, it is used to generate an output fault warning signal.

[0034] When all of the external on-site analog quantity input signals received by the first input terminal and the second input terminal of the controller are within a preset range, and the deviation between the two external on-site analog quantity input signals received by the first input terminal and the second input terminal of the controller is also within a preset deviation range, it is determined that both of the two analog quantity values are valid. In this case, the average of the two external on-site analog quantity input signal values received by the first input terminal and the second input terminal of the controller is used as the target input signal, that is, the analog quantity input calculation value of this analog quantity input channel. Otherwise, it is considered that all of the two converted analog quantity values are invalid, and a fault alarm is generated. When only one of the external on-site analog quantity input signals received by one of the first input terminal or the second input terminal of the controller is within a preset range, the analog quantity value converted thereby is considered valid and used as the target input signal, that is, the analog quantity input calculation value of this analog quantity input channel. Since the analog quantity value converted by the other one is not within a preset range, the analog quantity value converted by the other one is considered invalid, and a fault alarm is generated.

[0035] In this application, the input on-site signal is divided into two parts and input to two different input terminals of the controller. The controller ensures the accuracy of the on-site signal for calculating the control signal by performing abnormality diagnosis on the on-site signals input through the two different input terminals, and can improve the accuracy of the control signal output by the controller. By switching between the on-site signal and the self-test signal, the I / O channel self-diagnosis can be completely covered. For example, if it is determined that there is no abnormality in the on-site signal by the controller but there is an abnormality in the self-test signal, the fault location can be determined as the signal switching unit. If it is determined that there is no abnormality in the self-test signal by the controller but there is an abnormality in the on-site signal, the fault location can be determined as the interface module, the first switch unit, or the transmission medium of the on-site signal. In this way, in this application, substantially, the output signal is diagnosed in two stages. In the first-stage diagnosis, the abnormality of the on-site signal / self-test signal is diagnosed, and the accuracy of the control signal output by the controller is ensured. In the second-stage diagnosis, it is diagnosed whether the redundant control signal itself is abnormal, and finally the accuracy of the control signal output to the execution unit is ensured. Thereby, the technical problem of the conventional SIS that lacks a miniaturized self-diagnosis circuit and cannot implement 100% self-diagnosis of the I / O channel is solved.

[0036] When the system is operating normally and not performing self-diagnosis, DIAG-EN is at a low level, the triode Q17 is non-conductive, T-N is at a high level, the S terminal and D terminal of the analog switch U3 are conductive, and the external field signal AI0 is input to the resistor-capacitor filtering circuit composed of R5 and C8 and the isolation amplifier U1 through the D-S conductive terminal of U3. Further, it undergoes level shifting, active filtering, and gain conversion by the signal conditioning amplifier U2 and is converted into an analog voltage signal within the conversion range by the A / D converter inside the controller. Also, at this time, since the self-test is not being performed, DIAG-TEST is at a low level, the CO2 terminal of ASSR5 which is TEST is at a zero level, and the voltage of the T-P self-test signal is zero. By utilizing the reverse blocking characteristic of the diode D1 in this way, it does not affect the external field signal AI0. The analog voltage signal input by the conditioning amplifier U2 is respectively collected by two independent A / D converters inside the controller and converted into digital quantities. Then, the controller compares the two digital quantities after A / D conversion. When the converted digital quantity values are all within the preset range and the deviation between the two digital quantity values is within the preset range, the input signal is used as the target analog quantity input signal for the logical processing calculation by the user. Otherwise, it generates an alarm indicating that the deviation of the analog quantity input signal is large.

[0037] When the system operates normally and self-diagnosis is required, the first output terminal of the controller outputs a first control signal. At this time, DIAG-EN is at a high level, Q17 is conducting, T-N is at a low level, the S terminal and D terminal of the analog switch U3 are turned off, forming a disconnection circuit, and the signal AI0 at the external field is blocked. Also, the second output terminal of the controller outputs a second control signal. At this time, DIAG-TEST is at a high level, TEST is at a high level, a T-P self-test voltage signal is generated, conducts unidirectionally through the diode D1, undergoes voltage division by the resistors R2 and R5 and resistor-capacitor filtering, and is input to the isolation amplifier U1. Next, it undergoes level shift, active filtering, gain conversion, etc. by the signal conditioning amplifier U2 and is converted into an analog voltage signal within the conversion range by the A / D converter inside the controller. The analog voltage signal input by the conditioning amplifier U2 is collected by two independent A / D converters inside the controller and converted into digital quantities respectively. Then, the controller compares the two A / D-converted digital quantities and generates an alarm indicating that the deviation of the analog quantity input signal is large if the deviation is outside the preset range.

[0038] The controller further continuously acquires the first analog signal or the second analog signal received by the first input terminal and the second input terminal of the controller within a preset period, generates a first curve representing the change trend of the first analog signal or the second analog signal acquired within the preset period by the first input terminal of the controller, and a second curve representing the change trend of the first analog signal or the second analog signal acquired within the preset period by the second input terminal of the controller, and compares the first curve and the second curve with the change curve of the preset analog quantity signal. When the deviation between the first curve or the second curve and the change curve of the preset analog quantity signal is greater than the curve deviation threshold, it is used to determine that the first curve or the second curve is abnormal.

[0039] For example, continuously acquire an external / on-site analog quantity input signal or a self-test voltage signal within 3 months, and respectively create a first curve of the analog signal received by the first input terminal of the controller and a second curve of the analog signal received by the second input terminal of the controller during this period. Match the first curve and the second curve with the change curves of the preset analog quantity signals respectively, and determine the deviations between the first curve and the second curve and the change curves of the analog quantity signals. The change curve of the preset analog quantity signal is the change curve of the analog quantity signal collected and stored during the same period when the system was in a normal operating condition in the previous operating cycle, and is used as the normal comparison curve for this operating cycle. Here, the operating cycle may be set to 3 months. Understandably, if the deviation between a plurality of sites on the first curve or the second curve and the same site on the change curve of the analog quantity signal is greater than the deviation threshold, it is assumed that there is a circuit fault in the corresponding analog quantity input path. If the deviation between a plurality of sites and the same site on the change curve of the analog quantity signal is greater than the deviation threshold, the analog quantity values of consecutive N monitoring sites may have a deviation greater than the deviation threshold from the analog quantity value of the same site on the change curve of the analog quantity signal, or the analog quantity values of N monitoring sites within a certain range of the first curve or the second curve may have a deviation greater than the deviation threshold from the analog quantity value of the same site on the change curve of the analog quantity signal, or the analog quantity values of N monitoring sites among all the monitoring sites of the first curve or the second curve may have a deviation greater than the deviation threshold from the analog quantity value of the same site on the change curve of the analog quantity signal. This is not limited in this embodiment.

[0040] Embodiment 3 As shown in FIG. 7, based on the first embodiment, in order to enable self-diagnosis of the switching amount interface of the I / O channel, the switching amount interface unit includes a switching amount output unit and a sampling unit. The output terminal of the controller is connected to the input terminal of the switching amount output unit, the input terminal of the sampling unit is connected to the output terminal of the switching amount output unit, the output terminal of the sampling unit is connected to the input terminal of the controller, and the output terminal of the switching amount output unit is connected to the execution unit. The switching amount output unit generates a third control signal corresponding to the current switching amount signal according to the switching amount signal transmitted by the controller, and transmits the third control signal as a control signal to the logic voting module. At the same time, it is used to generate a fourth control signal corresponding to the self-test signal according to the self-test signal transmitted by the controller. The sampling unit is used to feedback the third control signal and the fourth control signal to the controller.

[0041] When operating normally, the output terminal DO of the controller outputs a switching quantity signal. The switching quantity output unit generates a corresponding third control signal according to the switching quantity signal output by the controller to control the device to be controlled. For example, when the switching quantity signal is a high-level signal, the switching quantity output unit outputs a high-level third control signal. When the switching quantity signal is a low-level signal, the switching quantity output unit outputs a low-level third control signal. The sampling unit samples the third control signal output by the switching quantity output unit and feeds back the voltage sampling signal of the third control signal to the controller. It is understandable that an A / D conversion module is further connected to the input terminal of the controller. The voltage sampling signal of the input terminal of the input controller is A / D converted by the A / D conversion module and converted into a corresponding digital signal, and then transmitted to the logic processing unit of the controller for actions such as communication, self-test, and calculation. In this way, the controller can determine whether the output signal is normal by matching the sampling voltage signal with the switching quantity signal output thereby. For example, if the switching quantity signal output by the controller is a high-level signal, the third control signal output by the switching quantity output unit must also be a high-level signal. When the sampling voltage signal fed back by the sampling unit is a low-level signal, it indicates that the output control signal is abnormal. In this case, the controller transmits warning information notifying that the output signal is abnormal or a fault has occurred in the switching quantity signal output channel.Similarly, during the self-test, the self-test signal output by the controller drives the fourth control signal output by the switching amount output unit. The sampling unit feeds back the voltage sampling signal of the fourth control signal to the controller. When the controller determines that the sampling voltage signal of the fourth control signal matches the self-test signal, it is determined that the switching amount signal output channel is normal. When the controller determines that the sampling voltage signal of the fourth control signal does not match the self-test signal, it is determined that a fault has occurred in the switching amount signal output channel, and the controller sends warning information notifying that a fault has occurred in the switching amount signal output channel.

[0042] As shown in FIG. 8, in this embodiment, the switching amount output unit includes a first switch element and an opto-coupler insulation unit. The control terminal of the first switch element is connected to the output terminal of the controller. The input terminal of the opto-coupler insulation unit constitutes an insulation control circuit by the first switch element. The output terminal of the opto-coupler insulation unit is connected to the device to be controlled. The first switch element controls the conduction / cut-off of the insulation control circuit according to the switching amount signal output by the controller, thereby controlling the output terminal of the opto-coupler insulation unit to generate a third control signal corresponding to the current switching amount signal.

[0043] The optical coupling insulation unit ASSR1 is a solid-state relay having two channels. The first switch element is the triode Q6. The switching amount output unit further includes a first resistor R118, a second resistor R120, and a first diode D61. The output terminal DIO1 of the controller is connected to the base of the first switch element by the first resistor R118. The emitter of the first switch element is grounded. The collector of the first switch element is connected to the second input terminal K1 of the optical coupling insulation unit ASSR1 by the second resistor R120. The first input terminal A1 of the optical coupling insulation unit ASSR1 is connected to the power supply. The first output terminal NO1 of the optical coupling insulation unit ASSR1 is connected to the negative terminal of the first diode D61. The positive terminal of the first diode D61 is connected to the device to be controlled. The second output terminal CO1 of the optical coupling insulation unit ASSR1 is connected to the device to be controlled. The first output terminal NO1, the second output terminal CO1 of the optical coupling insulation unit ASSR1 and the device to be controlled constitute the control circuit of the device to be controlled. The first input terminal A1 and the second input terminal K1 of the optical coupling insulation unit ASSR1 constitute a first insulation control circuit by the first switch element. The first switch element controls the conduction / cutting-off of the first insulation control circuit by the switching amount signal output by the controller, thereby controlling the conduction / cutting-off between the first output terminal NO1 and the second output terminal CO1 of the optical coupling insulation unit ASSR1, and generating a third control signal corresponding to the current switching amount signal in the control circuit of the device to be controlled. For example, the first output terminal NO1 and the second output terminal CO1 of the optical coupling insulation unit ASSR1 constitute a circuit together with the control circuit of the device to be controlled. When the controller outputs a high-level switching amount signal, the triode Q6 conducts, the circuit of the first input terminal A1 and the second input terminal K1 of the optical coupling insulation unit ASSR1 conducts, and the light-emitting diode in the circuit lights up. Thereby, the first output terminal NO1 and the second output terminal CO1 of the optical coupling insulation unit ASSR1 conduct. In this case, the control circuit of the device to be controlled conducts, and a corresponding third control signal, such as a high-level third control signal, is output, thereby controlling the device to be controlled.

[0044] As shown in FIG. 9, the sampling unit includes a voltage sampling unit ACPL1 and a third resistor R111. As the voltage sampling unit ACPL1, a DC voltage sampling chip is adopted. The DC+ terminal of the voltage sampling unit ACPL1 is connected to the NO1 terminal of the opto-coupling insulation unit ASSR1 and the negative terminal of the first diode D61 through the third resistor R111. The DC- terminal of the voltage sampling unit ACPL1 is connected to the CO1 terminal of the opto-coupling insulation unit ASSR1 and is used to collect the voltage signal of the third control signal. The output terminal of the voltage sampling unit ACPL1 is connected to the input terminal of the controller and is used to feedback the voltage signal of the third control signal to the controller. Preferably, the sampling unit further includes a resistor R112 and a capacitor C129. The VCC terminal of the voltage sampling unit ACPL1 is connected to the first terminal of the resistor R112 and then connected to the input terminal of the controller. The second terminal of the resistor R112 is connected to the VO terminal of the voltage sampling unit ACPL1. The first terminal of the capacitor C129 is connected to the VCC terminal of the voltage sampling unit ACPL1. The second terminal of the capacitor C129 is connected to the GND terminal of the voltage sampling unit ACPL1, and the GND terminal of the voltage sampling unit ACPL1 is grounded. The above circuit is an optical insulation feedback voltage sampling circuit.

[0045] In this embodiment, the self-test signal is a narrow pulse signal, and the controller is further used to generate a corresponding narrow pulse signal according to the current switching amount signal. When the current switching amount signal is a high-level signal, it generates a narrow pulse signal with a low level first and then a high level, and when the current switching amount signal is a low-level signal, it includes generating a narrow pulse signal with a high level first and then a low level. Specifically, the self-test program may be started every switching amount output period. The CPU outputs a narrow pulse self-test signal at the microsecond level opposite to the normal output switching amount signal. For example, when the third control signal is a high-level signal and the contacts are closed in the normal output of the solid-state relay ASSR1, the NO1 terminal and the CO1 terminal are conducting. In this case, the output narrow pulse self-test signal is a narrow pulse signal with a low level - high level, whereby the corresponding contacts of the solid-state relay ASSR1 instantaneously open and then close. On the other hand, when the contacts open in the normal output of the solid-state relay ASSR1, the narrow pulse self-test signal causes the contacts of the solid-state relay ASSR1 to instantaneously close and then open. This narrow pulse self-test signal is output to the field after being isolated by the opto-isolated solid-state relay ASSR1. The CPU uses the opto-isolated feedback voltage sampling unit to feedback the voltage waveform of the output contact state of the solid-state relay ASSR1 and compares it with the waveform of the output narrow pulse self-test signal. If they do not match, an alarm is issued. Since the output narrow pulse self-test signal is at the microsecond level, the change in the state of the switching amount output contact caused by it does not cause the action of the on-site actuator, thereby enabling 100% self-diagnosis of the switching amount output signal channel.

[0046] As shown in FIG. 10, the self-diagnosis circuit of the switching amount output signal channel of this embodiment may be extended to control a multi-channel controlled device. For example, the circuit further includes a voltage sampling unit ACPL2, a diode D63, a capacitor C131, a resistor R117, a resistor R116, a resistor R123, a resistor R125, and a triode Q8.

[0047] The VCC terminal of the voltage sampling unit ACPL2 is connected to the first terminal of the fifth resistor R117 and then to the input terminal of the controller. The second terminal of the resistor R117 is connected to the VO terminal of the voltage sampling unit ACPL2. The first terminal of the capacitor C131 is connected to the VCC terminal of the voltage sampling unit ACPL2, and the second terminal of the capacitor C131 is connected to the GND terminal of the voltage sampling unit ACPL2. The GND terminal of the voltage sampling unit ACPL2 is grounded. The DC+ terminal of the voltage sampling unit ACPL2 is connected to the NO2 terminal of the opto-coupler isolation unit ASSR1 and the negative terminal of the diode D63 through the resistor R116. The DC- terminal of the voltage sampling unit ACPL2 is connected to the CO2 terminal of the opto-coupler isolation unit ASSR1. The NO2 terminal of the opto-coupler isolation unit ASSR1 is connected to the negative terminal of the diode D63. The positive terminal of the diode D63 and the CO2 terminal of the opto-coupler isolation unit ASSR1 are connected to the control circuit of the second controlled device, thus forming the control circuit of the controlled device.

[0048] The output terminal DIO0 of the controller is connected to the base of the triode Q8 through the resistor R123. The emitter of the triode Q8 is grounded, and the collector of the triode Q8 is connected to the fourth input terminal K2 of the opto-coupler isolation unit ASSR1 through the resistor R12. The third input terminal A2 of the opto-coupler isolation unit ASSR1 is connected to the power supply.

[0049] In this embodiment, the controller is further used to match the current switching amount signal with a third control signal, and generate a first fault warning signal when the current switching amount signal does not match the third control signal, and to match the self-test signal with a fourth control signal, and generate a second fault warning signal when the self-test signal does not match the fourth control signal. For example, the switching amount signal output by the controller is a high-level signal, but the voltage signal of the sampled third control signal is a low-level signal, which indicates an output abnormality. In this case, it is determined that a fault may occur in the switching amount signal output channel, and a first fault warning signal is generated. The logic voting module executes voting on the switching amount signals output by the processing module A and the processing module B according to a preset voting logic, and generates an execution control signal. Similarly, during self-test, if the self-test signal output by the controller is a high-level to low-level signal, but the voltage signal of the sampled fourth control signal is not a high-level to low-level signal, this indicates an output abnormality. In this case, it is determined that a fault may occur in the switching amount signal output channel, and a second fault warning signal is generated. It can be understood that the controller generates a primary self-test signal for each switching amount period and performs self-test on the switching amount signal output channel once.

[0050] The method of this embodiment will be described below with specific examples.

[0051] When self-diagnosis is not performed during normal operation, if DIO1 is at a high level, Q6 will conduct, and the output contacts NO1 and CO1 of the first opto-isolated solid-state relay of ASSR1 will be closed. As a result, a voltage change will occur in R111. The CPU reads back the R111 voltage change signal through the opto-isolated voltage acquisition chip ACPL1, and compares it with the high or low level of the signal output by DIO1. If they do not match, an alarm is generated.

[0052] When self-diagnosis is not performed for normal operation, if DIO1 is at a low level, Q6 will not conduct, and the output contacts NO1 and CO1 of the first opto-isolated solid-state relay of ASSR1 will open. As a result, a voltage change will occur in R111. The CPU reads back the R111 voltage change signal through the opto-isolated voltage acquisition chip ACPL1, compares it with the high / low level of the signal output by DIO1, and generates an alarm if they do not match.

[0053] When normal operation requires self-diagnosis, the current switching amount signal is at a high level. That is, if DIO1 is at a high level, the output contacts NO1 and CO1 of the first opto-isolated solid-state relay of ASSR1 will be closed. At this time, the CPU causes DIO1 to generate a low-level narrow pulse self-test signal at the microsecond level, instantaneously opening the NO1 and CO1 contacts, thereby causing a voltage change in R111. The CPU reads back the R111 voltage change signal through the opto-isolated voltage acquisition chip ACPL1, compares it with the high / low level of the self-test signal output by DIO1, and generates an alarm if they do not match.

[0054] When normal operation requires self-diagnosis, if DIO1 is at a low level, the output contacts NO1 and CO1 of the first opto-isolated solid-state relay of ASSR1 will open. At this time, the CPU causes DIO1 to generate a high-level narrow pulse self-test signal at the microsecond level, instantaneously closing the NO1 and CO1 contacts, thereby causing a voltage change in R111. The CPU reads back the voltage change signal of R111 through the opto-isolated voltage acquisition chip ACPL1, compares it with the high / low level of the self-test signal output by DIO1, and generates an alarm if they do not match.

[0055] The controller is further configured to continuously acquire, by a sampling unit, a third control signal or a fourth control signal within a preset period, generate a first curve representing the voltage change trend of the third control signal or a second curve representing the voltage change trend of the fourth control signal, and compare the first curve or the second curve with a preset voltage change curve. When the deviation between the first curve or the second curve and the preset voltage change curve is greater than a curve deviation threshold, it is used to determine that the first curve or the second curve is abnormal. The preset voltage change curve may be a trend curve obtained according to the temporal change of the theoretical voltage of the switching amount output signal in at least one switching amount output period, or a trend curve obtained according to the temporal change of the theoretical voltage of the self-test signal in at least one switching amount output period. As can be understood, the output of the switching amount is constant for each switching amount output period.

[0056] Taking the case of monitoring the switching amount signal as an example, continuously acquire the sampling voltage signals of the switching amount output signals in N switching amount output cycles to obtain a first curve, and compare the first curve with a preset voltage change curve. If the deviation between a plurality of sampling points on the first curve and the same site on the preset voltage change curve is greater than the voltage deviation threshold, it is assumed that a fault has occurred in the switching amount output channel. When it is said that the deviation between a plurality of sampling points and the same site on the preset voltage change curve is greater than the voltage deviation threshold, it may be that the voltage values of continuous N sampling sites deviate from the voltage value of the same site on the preset voltage change curve by more than the voltage deviation threshold. The voltage values of N sampling sites within a certain range of the first curve may deviate from the voltage value of the same site on the preset voltage change curve by more than the voltage deviation threshold. Among all the sampling sites of the first curve, the voltage values of N sampling sites may deviate from the voltage value of the same site on the preset voltage change curve by more than the voltage deviation threshold, but this is not limited in this embodiment. As can be understood, in this embodiment, by continuously monitoring the self-test signal, it is possible to determine whether a fault has occurred in the output channel. By collecting the narrow pulse waveform signals of the self-test signal within a predetermined period and comparing the change trend of the pulse waveform within the predetermined period, the degradation performance of the circuit device can be continuously monitored and circuit faults can be predicted.

[0057] Embodiment 4 As shown in FIG. 11, based on Example 1, in order to enable self-diagnosis of the digital quantity interface of the I / O channel, the digital quantity interface unit includes a second switch unit, a first signal isolation unit, and an output determination unit. The second switch unit is serially connected to the input terminal circuit of the first signal isolation unit. The controller is connected to the input terminal circuits of the second switch unit and the first signal isolation unit. The output determination unit is connected to the output terminal circuit of the first signal isolation unit. The output terminal circuit of the first signal isolation unit is connected to the first input terminal and the second input terminal of the controller. The input terminal circuit of the first signal isolation unit is further used to access the digital quantity input signal input from the outside. The controller is used to send a self-test signal to the input terminal circuit of the first signal isolation unit and send a switch control signal to the second switch unit to control the conduction or disconnection of the second switch unit. The input terminal circuit of the first signal isolation unit conducts when the second switch unit conducts and disconnects when the second switch unit is disconnected. The output determination unit is used to output a high-level determination signal by the output terminal circuit of the first signal isolation unit when the input terminal circuit of the first signal isolation unit is disconnected. The output terminal circuit of the first signal isolation unit outputs a low-level determination signal when the input terminal circuit of the first signal isolation unit conducts and the digital quantity input signal or the self-test signal is a high-level signal.

[0058] In this embodiment, at least two input terminals of the controller are preferably the first input terminal and the second input terminal of the controller. An A / D conversion module is connected to the first input terminal and the second input terminal of the controller. The analog signals input to the first input terminal and the second input terminal of the controller are A / D converted by the A / D conversion module and converted into corresponding digital signals, and then transmitted to the logic processing unit of the controller for actions such as communication, self-test, and calculation. The controller controls and conducts the second switch unit by sending a control signal to the second switch unit. At this time, the input terminal circuit of the first signal insulation unit is in a conductive state. Here, the first signal insulation unit may be an optical coupler. The 0 / 24VDC actual digital quantity signal from the field is input to the input terminal circuit of the first signal insulation unit. The output terminal circuit of the first signal insulation unit outputs a corresponding judgment signal according to the digital quantity signal in the field. For example, when the digital quantity signal in the field is a 24VDC signal, the input terminal circuit of the first signal insulation unit is powered, the light-emitting diode inside it lights up, and the output terminal circuit of the first signal insulation unit is controlled to conduct. At this time, the output terminal circuit of the first signal insulation unit outputs a low-level judgment signal. When the digital quantity signal in the field is a 0VDC signal, the light-emitting diode inside the first signal insulation unit does not light up, and the output terminal circuit of the first signal insulation unit is disconnected. At this time, the output terminal circuit of the first signal insulation unit outputs a high-level judgment signal under the action of the output judgment unit, whereby the digital quantity input signal is converted into a standard analog voltage signal within the A / D conversion range. The judgment signals output by the output terminal circuit of the first signal insulation unit are respectively transmitted to the first input terminal and the second input terminal of the controller, and then simultaneously collected by two A / D converters and converted into digital quantities. The controller compares the two converted digital quantities with preset values, compares the results through two operations, and finally obtains a judgment signal used for logical processing calculation. If the deviation is within the preset range, this signal is finally used as the input signal for logical processing calculation by the user. Otherwise, an alarm is generated because the deviation of the input signal is large.When a self - test is required, the controller outputs an I / O control signal through a self - test control program. After performing opto - coupled insulation, it controls the second switch unit to conduct, inputs a self - test signal to the first signal insulation unit, switches the actual on - site signal to a self - test voltage signal, thereby supplying a detection signal to the digital quantity input channel. The controller determines whether a fault has occurred in the input channel of the digital quantity input signal based on whether the self - test signals received by the two input terminals are abnormal, thereby implementing 100% self - diagnosis of the fault in the digital quantity input signal acquisition channel. Here, the self - test signal may be a 0 / 24VDC self - test signal.

[0059] As shown in FIG. 12, in this embodiment, the second switch unit includes a second switch element and a fourth resistor R110. The first output terminal of the controller is connected to the control terminal of the second switch element through the fourth resistor R110, and the controller transmits a switch control signal through the first output terminal of the controller. The first signal insulation unit includes an opto - coupler unit U44. The first input terminal of the opto - coupler unit U44 is connected to the second output terminal of the controller to access the digital quantity input signal. The second input terminal of the opto - coupler unit U44 is grounded through the switch element. The controller transmits a self - test signal through the second output terminal of the controller. The first output terminal of the opto - coupler unit U44 is connected to at least two input terminals of the controller and the output determination unit, and the second output terminal is grounded.

[0060] The second switch element is the triode Q5, and the optical coupler unit U44 employs an optical coupler device of model FOD817. The first output terminal of the controller is connected to the base of the triode Q5 by the fourth resistor R110. The emitter of the triode Q5 is grounded, and the collector of the triode Q5 is connected to the negative terminal of the optical coupler unit U44. The positive terminal of the optical coupler unit U44 is connected to the second output terminal of the controller and the digital quantity signal input on-site. The collector of the optical coupler unit U44 is connected to the first input terminal and the second input terminal of the controller, the emitter is grounded, and the output determination unit is connected to the collector of the optical coupler unit U44. The switch control signal T-N output by the first output terminal of the controller is sent to the base of the triode Q5 through the fourth resistor R110, thereby controlling the collector and emitter of the triode Q5 to conduct, and the input terminal circuit of the optical coupler unit U44 is in a conductive state.

[0061] Optionally, the digital quantity interface unit further includes a second signal insulation module and a fifth resistor R114. The second signal insulation module is connected to the first input terminal of the optical coupler unit U44 by the fifth resistor R114. The second output terminal of the controller is connected to the fifth resistor R114 by the second signal insulation module, and the digital quantity input signal is transmitted to the first input terminal of the optical coupler unit U44 by the second signal insulation module. The second insulation module is used to insulate the digital quantity input signal and the self-test signal.

[0062] Specifically, the second signal isolation module includes a second diode D3 and a third diode D4. The negative terminal of the second diode D3 is connected to the positive terminal of the optical coupler unit U44 by a fifth resistor R114, and the positive terminal of the second diode D3 is connected to the on-site digital quantity input signal. The negative terminal of the third diode D4 is connected to the positive terminal of the optical coupler unit U44 by a fifth resistor R114, and the positive terminal of the third diode D4 is connected to the second output terminal of the controller and is used to receive the self-test signal TEST output by the controller. Due to the action of the second diode D3 and the third diode D4, the mutual interference between the on-site digital quantity input signal and the self-test signal is effectively avoided. It can be understood that the on-site digital quantity input signal is connected to the emitter of the triode Q5 through a transmission interface. The transmission interface is an interface for any digital quantity input signal, but is not limited here. As shown in FIG. 10, the on-site digital quantity input signal is DI2.

[0063] Optionally, the output determination unit includes a sixth resistor R113 and a seventh resistor R115. The first terminal of the sixth resistor R113 is connected to a 5V constant voltage power supply, and the second terminal of the sixth resistor R113 is connected to the first terminal of the seventh resistor R115 and the collector terminal of the optical coupler unit U44, and then connected to the first input terminal and the second input terminal of the controller. The second terminal of the seventh resistor R115 is grounded.

[0064] The sixth resistor R113 and the seventh resistor R115 are connected in parallel and then connected to the collector terminal of the optical coupler unit U44, and finally output a judgment signal, which is an analog quantity voltage signal CHAN2 used for the user's logical processing calculation, to the first input terminal and the second input terminal of the controller. Inside the controller, the collected analog voltage signal CHAN2 is used for diagnosis and fault prediction by A / D conversion.

[0065] In this embodiment, the digital quantity interface unit further includes a third signal insulation module. The third signal insulation module is an optical coupler. The first output terminal of the controller is connected to a fourth resistor R110 through the third signal insulation module.

[0066] The operating principle of this embodiment is as follows.

[0067] When the system is operating normally and self-diagnosis is not being performed, since self-diagnosis is not required, the TEST signal is at a low level. That is, no self-test signal is input to the controller, and the T-N control signal is at a high level. At this time, the triode Q5 conducts. When the external digital quantity input signal DI2 at this time is input as a 24V high level, DI2 conducts the second diode D3 and the fifth resistor R114, controls the input terminal of the optical coupler U44, and the light-emitting diode inside the input terminal of the optical coupler U44 conducts and emits light. The output terminal of the optical coupler U44 receives the light-emitting signal of the input terminal, conducts and grounds, and the output analog voltage signal CHAN2 transmitted to the controller is at a low level of 0V. When the external digital quantity input signal DI2 at this time is input as a 0V low level, the second diode D3 and the fifth resistor R114 are in a disconnected state. The input terminal of the optical coupler U44 is disconnected and does not emit light. The output terminal of the optical coupler U44 is disconnected because it cannot receive the light-emitting signal of the input terminal. The output analog voltage signal CHAN2 transmitted to the controller becomes a high level under the action of the pull-up resistor R113 and the 5V power supply, indicating 5V.

[0068] When the system needs self-diagnosis to operate normally, if the TEST signal is at a high level, the T-N control signal is at a high level. At this time, the triode Q5 conducts. This is a non-safe state. When the digital quantity input external signal DI2 is not charged, that is, when it is at a low level of 0V, the TEST signal conducts through the second diode D3 and the fifth resistor R114, controls the input terminal of the optocoupler U44. The input terminal of the optocoupler U44 conducts and emits light. The output terminal of the optocoupler U44 receives the light emission signal of the input terminal, conducts and grounds. The output analog voltage signal CHAN2 sent to the controller is at a low level of 0V.

[0069] When the system needs self-diagnosis to operate normally, if the TEST signal is at a low level, the T-N control signal is at a high level. At this time, the triode Q5 conducts. This is a non-safe state. When the digital quantity input external signal DI2 is not charged, that is, when DI2 is at a low level of 0V, the second diode D3 and the fifth resistor R114 are in a cut-off state. The input terminal of the optocoupler U44 is cut off and does not emit light. The output terminal of the optocoupler U44 is cut off because it cannot receive the light emission signal of the input terminal. The output analog voltage signal CHAN2 sent to the CPU is at a high level due to the action of the pull-up resistor R113 and the 5V power supply, indicating 5V.

[0070] When the system needs self-diagnosis to operate normally, if the TEST signal is at a high level, the T-N control signal is at a high level. At this time, the triode Q5 conducts. This is a safe state. When the digital quantity input external signal DI2 is charged, that is, when DI2 is input as a 24V high level, DI2 conducts through the second diode D3 and the fifth resistor R114, controls the input terminal of the optocoupler U44. The input terminal of the optocoupler U44 conducts and emits light. The output terminal of the optocoupler U44 receives the light emission signal of the input terminal, conducts and grounds. The output analog voltage signal CHAN2 sent to the controller is at a low level of 0V.

[0071] When normal operation requires self-diagnosis, if the TEST signal is at a low level, the T-N control signal is at a high level. At this time, the triode Q5 conducts. This is a safe state. When the digital quantity input external signal DI2 is charged, that is, when DI2 is input as a 24V high level, DI2 conducts the second diode D3 and the fifth resistor R114, controls the input terminal of the optocoupler U44. The input terminal of the optocoupler U44 conducts and emits light. The output terminal of the optocoupler U44 receives the light emission signal of the input terminal, conducts and grounds, and the output analog voltage signal CHAN2 sent to the CPU is at a low level of 0V.

[0072] When the normal operation of the system requires self-diagnosis, if the T-N control signal is at a low level, the triode Q5 is cut off. In this case, regardless of whether the TEST signal is at a high level or a low level, the input terminal of the optocoupler U44 is cut off and does not emit light. The U44 output terminal is cut off because it cannot receive the light emission signal of the input terminal. The output analog voltage signal CHAN2 sent to the controller is at a high level due to the action of the pull-up resistor R113 and the 5V power supply, indicating 5V.

[0073] Also, the output analog voltage signal CHAN2 corresponding to the external on-site digital quantity input signal is continuously collected by the A / D converter inside the controller. For example, through three months of operation, the drift and degradation trends of the optocoupler U44, the sixth resistor R113, and the seventh resistor R115 can be continuously monitored to predict faults. As can be understood, since the resistance values of the sixth resistor R113 and the seventh resistor R115 are known, the voltage values of the sixth resistor R113 and the seventh resistor R115 can be calculated by collecting the voltage value of the output analog voltage signal CHAN2. This calculation process is a prior art and is not limited here.

[0074] In this embodiment, the input terminal circuit of the first signal insulation unit receives a digital quantity input signal input from the outside, and the output terminal circuit of the first signal insulation unit outputs a first judgment signal corresponding to the digital quantity input signal to the first input terminal and the second input terminal of the controller. The controller further performs analog-to-digital conversion on the first judgment signal received by its first input terminal and second input terminal, then compares it with the digital quantity signal threshold respectively. When it is determined that the first judgment signal received by any of the input terminals of the controller is abnormal according to the comparison result, it is used to generate a first fault alarm signal, and during self-test, a self-test signal is sent to the input terminal circuit of the first signal insulation unit, and the output terminal circuit of the first signal insulation unit outputs a second judgment signal corresponding to the self-test signal to the first input terminal and the second input terminal of the controller. After performing analog-to-digital conversion on the second judgment signal received by its first input terminal and second input terminal, and comparing it with the digital quantity signal threshold respectively, when it is determined that the second judgment signal received by any of the input terminals of the controller is abnormal according to the comparison result, it is used to generate a second fault alarm signal.

[0075] Specifically, the 0 / 24VDC digital quantity signal from the field undergoes opto-coupled insulation and is converted into a standard analog voltage signal within the A / D conversion range. Next, it is simultaneously collected by two A / D converters of the controller and converted into a digital quantity. The controller compares the two converted digital quantities with a preset digital quantity signal threshold, performs two operations to compare the results, and finally obtains a judgment signal used for logical processing calculation. When the deviation is within the preset range, this signal is finally used as the analog quantity input signal for the user's logical processing calculation. Otherwise, an alarm indicating that the deviation of the analog quantity input signal is large is generated.

[0076] When the difference between the first determination signal received by any input terminal of the controller and the digital quantity signal threshold is greater than a preset difference range, it is determined that the first determination signal received by the input terminal corresponding to the controller is abnormal. When the difference between the second determination signal received by any input terminal of the controller and the digital quantity signal threshold is greater than a preset difference range, it is determined that the second determination signal received by the input terminal corresponding to the controller is abnormal. For example, if it is determined that the difference between the digital quantity after the signal has undergone A / D conversion and the preset digital quantity signal threshold is greater than the preset difference range by any one of the first input terminal and the second input terminal of the controller, it is determined that the determination signal input by the terminal is abnormal, this input value is invalid, this value cannot be used as a target value for the logical calculation of the controller, and the controller generates a fault alarm.

[0077] In this embodiment, the controller further continuously acquires the determination signal received by any of the input terminals of the controller within a preset period, generates a first curve representing the voltage change trend of the determination signal acquired within the preset period by the input terminal corresponding to the controller, and is used to determine that the first curve is abnormal when the deviation between the first curve and the standard voltage change curve is greater than the curve deviation threshold.

[0078] Specifically, the determination signal within a predetermined period, for example within three months, is continuously acquired. By means of two input terminals of the controller, the voltage value corresponding to the determination signal is obtained, and the first curve of the voltage value received by the first input terminal of the controller and the first curve of the voltage value received by the second input terminal of the controller within the said period are respectively created. The first curve corresponding to the first input terminal of the controller and the first curve corresponding to the second input terminal of the controller are respectively matched with a preset standard voltage change curve, and the deviation between each first curve and the standard voltage change curve is determined. The standard voltage change curve is the voltage change curve of the determination signal in an ideal state. Understandably, when the deviation between a plurality of sites on the first curve and the same site on the standard voltage change curve is greater than the deviation threshold, it is assumed that there is a circuit fault in the corresponding digital quantity input channel. The fact that the deviation between a plurality of sites and the same site on the standard voltage change curve is greater than the deviation threshold means that the voltage values of consecutive N monitoring sites may be greater than the deviation threshold compared with the voltage value of the same site on the standard voltage change curve, the voltage values of N monitoring sites within a certain range of the first curve may be greater than the deviation threshold compared with the voltage value of the same site on the standard voltage change curve, and the voltage values of N monitoring sites among all the monitoring sites of the first curve may be greater than the deviation threshold compared with the deviation of the voltage value of the same site on the standard voltage change curve. In this embodiment, it is not limited.

[0079] When the controller further determines, based on the comparison result, that there is no abnormality in the first determination signal received by the first input terminal or the second input terminal of the controller, the controller generates a corresponding control signal according to the first determination signal without abnormality; when the controller determines, based on the comparison result, that there is no abnormality in the first determination signals received by all the input terminals of the controller, the controller generates a corresponding control signal according to any one of the first determination signals without abnormality; and when the controller determines, based on the comparison result, that all the first determination signals received by all the input terminals of the controller are abnormal, the controller is used to generate a warning signal for output failure and transmit it to the logic voting module. The logic voting module executes voting according to the control signal or the warning signal generated by the processing module A and the processing module B, and generates an execution control signal.

[0080] Embodiment 5 Based on Embodiment 1, faults are monitored for all of the DI, AI, and DO channels. The I / O channel unit of this embodiment includes the analog quantity interface unit of Embodiment 2, the switching quantity interface unit of Embodiment 3, and the digital quantity interface unit of Embodiment 4.

[0081] Embodiment 6 Based on Embodiment 1, the RTU of this application adopts a heterogeneous redundant channel design. For example, in the redundant processing module A and the processing module B, related peripheral circuits and controllers can use devices with the same function but different specifications and models. Thereby, a heterogeneous redundant channel is constructed, the common cause failure rate is reduced, and the reliability of the redundant system is improved.

[0082] In this application, an FMEA model is used to calculate the common cause failure rate of redundant channels. Specifically, first, based on the diagnostic test, the total contribution of each countermeasure is classified into two categories, X and Y, and the X:Y ratio of each countermeasure indicates how much the diagnostic countermeasure can improve the effectiveness of the countermeasure against common cause failures. X means a characteristic that can enhance the effect of overcoming the common cause failure rate by the diagnostic test, and Y means that the effect of overcoming the common cause failure by the diagnostic test cannot be enhanced. In this case, S = X + Y, S D = X(Z + 1)+ Y, where the values of X and Y can be determined according to preset criteria based on the test results, and the value of Z can be determined based on the frequency and coverage of the diagnostic test. After determining the values of X and Y in each test, calculate the sum of X and Y, and according to preset criteria such as IEC61508 - 6, refer to the table by the sum of X and Y to determine the β and β D coefficient scores and calculate the common cause failure value. Here, β represents the coefficient of undetected failures, and β D represents the coefficient of detected failures.

[0083] The contribution statistics of the diagnostic test of the electronic components in this application are as follows.

[0084]

Table 2

[0085] Based on the scores of the above test items, the relevant parameters of this application are calculated and shown in the following table.

[0086]

Table 3

[0087] For comparison, in the comparative example according to this application, the redundant channel structure adopts the same hardware design, and the contribution statistics of the diagnostic test of its electronic components are as follows.

[0088]

Table 4

[0089] Based on the scores of the above test items, the relevant parameters of the comparative example are calculated and shown in the following table.

[0090]

Table 5

[0091] From the above, compared with the comparative example using the same - type redundant channel structure, the coefficient β of the present application is smaller than that of the comparative example, and the total failure rate caused by dangerous common - cause failures is λ = λ DU β + λ DD β D where λ DU is the failure rate of a single channel when the failure is not detected, and λ DD is the failure rate of a single channel when the failure is detected. Therefore, as a result of the calculation, the heterogeneous redundant channel of the present application has a smaller common - cause failure rate than the comparative example.

[0092] Example 7 As shown in FIG. 13, based on Example 5, a safety control system is disclosed that includes an execution unit and the above - mentioned remote measurement and control terminal, and the remote measurement and control terminal is used to generate a corresponding execution control signal according to an external input signal and transmit the execution control signal to the execution unit to control the execution unit to execute a corresponding action.

[0093] The safety control system may be distributed among a plurality of remote measurement and control terminals RTUs in one or more regions. The RTU may be a device or system that provides local control and data access at a site remote from other control systems such as a DCS. For example, the RTU can be placed at or near the site of the device or tank. The RTU may be connected to other control systems via wired and wireless networks such as microwave, cellular, and other radio frequency communications. The RTU also communicates and interacts with one or more industrial field devices. This field device may include a monitoring unit such as a sensor that monitors one or more characteristics of the process, an execution unit such as an actuator that changes one or more characteristics of the process, or other industrial field devices. In this embodiment, the RTU communicates with field devices such as valves and instruments via a wired connection. Here, the wired connection may include a serial connection such as an RS458 connection, an Ethernet connection, an industrial protocol connection, or other wired connections.

[0094] For example, the RTU can be used as safety control equipment for the disproportionation raw material heating furnace of an aromatic complex device. The disproportionation raw material flow rate of the heating furnace and the pressure value of the fuel gas manifold are collected in real time through a flow sensor and a pressure sensor installed in the heating furnace and transmitted to two processing modules of the RTU via a wired or wireless network. When the pressure in the fuel gas manifold is too low, the RTU controls the on-site valve to cut off the supply of fuel gas, preventing the fuel gas from staying in the heating furnace due to the frame-out of the heating furnace and exploding when encountering direct fire. When the supply flow rate of the heating furnace is too low, the RTU cuts off the supply of fuel gas to avoid damage to the furnace tubes due to dry firing of the furnace tubes and realizes the safety control of the heating furnace. To avoid the failure of the safety control of the heating furnace, the logic voting module of the RTU votes on the output signals of the two processing modules of the RTU through a pre-set logic voting structure. Thereby, when one of the output signals indicates that the monitoring value is too low, a safety control value is output to ensure that the supply of fuel gas is cut off.

[0095] The RTU can also be connected to one or more human-machine interfaces (HMIs) such as displays and consoles. The HMI can display the operating status of the RTU and control the RTU through data transmission. The security camera can capture still images or video images and provide the images to a remote location such as a security center via the RTU. The wireless device can be used to support wireless communication between the RTU and a remote access point that communicates with other control systems via the network.

[0096] The SIS of this embodiment also includes an engineer station and an operator station. The engineering station is a PC machine that can perform programming of user applications and download to an SD card installed in the SD slot of the module. The operator station communicates with the system through a standard communication protocol, monitors the operating status of the system, and collects and records input, output status, diagnosis and alarm information, and SOE information. To ensure information security, the communication between the operator station and the system is unidirectional, performing only reading instead of writing, and the SOE history data is stored in the operator station.

[0097] By verifying the system using the RTU of this embodiment, the coverage DC of the system diagnosis of this embodiment exceeds 90%, the safety failure fraction SFF of the system exceeds 90%, the fault response time is less than 30 seconds, the mean time to repair MTTR is less than 48 hours, and the reliability of the system can be effectively improved.

[0098] As described above, the remote measurement and control terminal of the present invention is provided with redundant signal processing channels. When a failure occurs in any of the signal processing channels, the other signal processing channel can output an accurate control signal, thereby effectively improving the reliability and safety of signal transmission and avoiding control safety accidents caused by failures of the signal processing channels. Further, in the present invention, the processing module is integrated with DI, AI, and DO interface units each provided with a diagnostic circuit, which may be controlled by a controller. When self-testing is required, the on-site signals are shielded to generate self-test signals, which enables switching between on-site signals and self-test signals, is suitable for integration with the controller, and meets the need for miniaturization. Furthermore, the redundant processing module and the interface unit of the processing module of the present application combine technical features such as logical voting for the control signals output by the controller, and actually achieve two-level security guarantee for the I / O channel. Level 1 is to divide the on-site signal or self-test signal into two input terminals of one input controller for fault diagnosis, thereby realizing fault diagnosis on the interface module-controller side. Level 2 is to perform abnormal judgment on the control signal output by the redundant controller and then perform logical voting to ensure the output of accurate control signals. Also, in the security guarantee at Level 1, by switching between on-site signals and self-test signals, it is possible to completely diagnose I / O channel failures and identify the fault locations, enabling 100% self-diagnosis of digital input channels, analog input channels, and switching output channels. As a diagnostic result, only an alarm is given, and the output result of the system is not changed. In addition, the present invention can monitor the tendency of performance degradation of devices in digital input channels, analog input channels, and switching output channels and predict faults, and also has the advantages of simple, reliable circuit structure and few devices.

[0099] As described above, any embodiment of the present invention has been described in detail with reference to the drawings. However, the embodiments of the present invention are not limited to the details of the above embodiments, and many simple modifications can be made to the technical solutions of the embodiments of the present invention without departing from the technical idea of the embodiments of the present invention. All of these simple modifications belong to the protection scope of the embodiments of the present invention. Also, the specific technical features described in the above-described forms for carrying out the invention can be combined in any appropriate manner as long as there is no contradiction. To avoid unnecessary repetition, in the embodiments of the present invention, various possible combinations will not be described further. A person skilled in the art can understand that all or part of the steps in the method for carrying out the above embodiments can be completed by instructing related hardware through a program. This program is stored in a storage medium and includes several instructions for causing a microcontroller, a chip, or a processor to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes a USB memory, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0100] Furthermore, various embodiments of the present invention can be arbitrarily combined, and as long as they do not contravene the idea of the embodiments of the present invention, they should also be regarded as the content disclosed in the embodiments of the present invention.

Claims

1. A remote measurement and control terminal, including an interface module and a processing module, wherein the processing module includes an I / O channel unit and a controller, the interface module is sequentially connected to the I / O channel unit and the controller, and the I / O channel unit includes an analog quantity interface unit, The analog quantity interface unit includes a signal switching unit and a first switch unit, The controller is sequentially connected to the signal switching unit and the first switch unit. The input terminal of the first switch unit is connected to the interface module and is used to access a first analog signal input from the outside. The output terminal of the first switch unit is used to transmit the first analog signal to the first input terminal and the second input terminal of the controller. When the signal switching unit receives a first control signal output by the controller, it controls the first switch unit to turn off, thereby disconnecting the connection between the first analog signal and the controller. When the signal switching unit receives a second control signal output by the controller, it generates a second analog signal and is used to transmit the second analog signal to the first input terminal and the second input terminal of the controller. A remote measurement and control terminal characterized by the above.

2. including at least two processing modules and further including a logic voting module, The at least two processing modules are respectively connected to the interface module and the logic voting module, The at least two processing modules respectively obtain an external input signal through the interface module, generate a corresponding control signal based on the external input signal, and transmit the generated control signal to the logic voting module, The logic voting module When it is determined that any of the control signals generated by the at least two processing modules is abnormal, using the control signal without abnormality among the control signals generated by the at least two processing modules as the execution control signal When it is determined that not all of the control signals generated by the at least two processing modules are abnormal, using any one of the control signals generated by the at least two processing modules as an execution control signal, and When it is determined that all of the control signals generated by the at least two processing modules are abnormal, generating a safety control signal as an execution control signal and using it to control the execution unit to stop operating, The remote measurement control terminal according to claim 1, characterized by the above.

3. The I / O channel unit The remote measurement control terminal according to claim 2, further comprising a switching quantity interface unit and a digital quantity interface unit.

4. The signal switching unit Includes a first signal switching subunit, a second signal switching subunit, a first switch subunit, a second switch subunit, a switch signal generation subunit, and a second analog signal generation subunit. The input terminal of the first signal switching subunit is connected to the first output terminal of the controller and is used to receive the first control signal. The output terminal of the first signal switching subunit is connected to the input terminal of the first switch subunit. The output terminal of the first switch subunit is connected to the switch signal generation subunit and then to the control terminal of the first switch unit. The input terminal of the second signal switching subunit is connected to the second output terminal of the controller and is used to receive the second control signal. The output terminal of the second signal switching subunit is connected to the input terminal of the second switch subunit. The output terminal of the second switch subunit is connected to the second analog signal generation subunit and then to the first input terminal and the second input terminal of the controller. The remote measurement control terminal according to claim 2, wherein the first switch subunit and the second switch subunit are all optical couplers.

5. The controller further Compare the first analog signals received by the first input terminal and the second input terminal with preset analog quantity signal thresholds respectively. When it is determined according to the comparison result that there is an abnormality in the first analog signal received by the first input terminal or the second input terminal of the controller, generate a first failure warning signal, and Compare the second analog signals received by the first input terminal and the second input terminal with the preset analog quantity signal thresholds respectively. When it is determined according to the comparison result that there is an abnormality in the second analog signal received by the first input terminal or the second input terminal of the controller, it is used for generating a second failure warning signal. The remote measurement control terminal according to claim 2, characterized in that

6. The controller further When it is determined according to the comparison result that there is no abnormality in the first analog signal received by the first input terminal or the second input terminal of the controller, generate a corresponding control signal according to the first analog signal without abnormality, and When it is determined according to the comparison result that there is no abnormality in any of the first analog signals received by the first input terminal and the second input terminal of the controller, it is used for generating a corresponding control signal according to any of the first analog signals without abnormality. The remote measurement control terminal according to claim 5, characterized in that

7. The controller further Continuously acquire the first analog signal or the second analog signal received by the first input terminal and the second input terminal of the controller within a preset period, and generate a first curve representing the change trend of the first analog signal or the second analog signal acquired within the preset period by the first input terminal of the controller, and a second curve representing the change trend of the first analog signal or the second analog signal acquired within the preset period by the second input terminal of the controller, and Compare the first curve and the second curve with the change curve of the preset analog quantity signal. When the deviation between the first curve or the second curve and the change curve of the preset analog quantity signal is greater than the curve deviation threshold, it is used for determining that the first curve or the second curve is abnormal. The remote measurement control terminal according to claim 2, characterized in that

8. The switching quantity interface unit It includes a switching amount output unit and a sampling unit. The output terminal of the controller is connected to the input terminal of the switching amount output unit, the input terminal of the sampling unit is connected to the output terminal of the switching amount output unit, the output terminal of the sampling unit is connected to the input terminal of the controller, and the output terminal of the switching amount output unit is connected to the execution unit. The switching amount output unit generates a third control signal corresponding to the current switching amount signal according to the switching amount signal transmitted by the controller, and transmits the third control signal as a control signal to the logic voting module. It is used to generate a fourth control signal corresponding to the self-test signal according to the self-test signal transmitted by the controller. The sampling unit is used to feedback the third control signal and the fourth control signal to the controller. The remote measurement control terminal according to claim 3, characterized in that.

9. The switching amount output unit includes a first switch element and an opto-coupling insulation unit. The control terminal of the first switch element is connected to the output terminal of the controller. The input terminal of the opto-coupling insulation unit constitutes an insulation control circuit by the first switch element, and the output terminal of the opto-coupling insulation unit is connected to the logic voting module. The first switch element controls the conduction / cutting-off of the insulation control circuit based on the switching amount signal output by the controller, controls the output terminal of the opto-coupling insulation unit, and generates a third control signal corresponding to the current switching amount signal. The remote measurement control terminal according to claim 8, characterized in that.

10. The first switch element is a triode, and the switching amount output unit further includes a first resistor, a second resistor, and a first diode. The output terminal of the controller is connected to the base of the first switch element by the first resistor. The emitter of the first switch element is grounded. The collector of the first switch element is connected to the second input terminal of the opto-coupling insulation unit by the second resistor. The first input terminal of the opto-coupling insulation unit is connected to the power supply. The first output terminal of the optical coupling insulation unit is connected to the negative terminal of the first diode, the positive terminal of the first diode is connected to the execution unit by the logic voting module, the second output terminal of the optical coupling insulation unit is connected to the execution unit, and the first output terminal, the second output terminal, the logic voting module and the execution unit of the optical coupling insulation unit constitute the control circuit of the execution unit. The first input terminal and the second input terminal of the optical coupling insulation unit constitute a first insulation control circuit by the first switch element. The first switch element controls the conduction / cut-off of the first insulation control circuit based on the switching amount signal output by the controller, and controls the conduction / cut-off between the first output terminal and the second output terminal of the optical coupling insulation unit, so as to generate a third control signal corresponding to the current switching amount signal in the control circuit of the execution unit. The remote measurement and control terminal according to claim 9, characterized in that.

11. The sampling unit includes a voltage sampling unit and a third resistor. The input terminal of the voltage sampling unit is connected to the output terminal of the optical coupling insulation unit by the third resistor and is used to collect the voltage signal of the third control signal. The output terminal of the voltage sampling unit is connected to the input terminal of the controller and is used to feedback the voltage signal of the third control signal to the controller. The remote measurement and control terminal according to claim 9, characterized in that.

12. The self-test signal is a narrow pulse signal, and the controller further when the current switching amount signal is a high-level signal, generates a narrow pulse signal of first low level and then high level, and when the current switching amount signal is a low-level signal, generates a narrow pulse signal of first high level and then low level, and is used to generate a corresponding narrow pulse signal according to the current switching amount signal. The remote measurement and control terminal according to claim 10, characterized in that.

13. The controller further matches the current switching amount signal with the third control signal, and when the current switching amount signal does not match the third control signal, generates a first fault alarm signal, and It is used to match the self - test signal with the fourth control signal and generate a second fault warning signal when the self - test signal does not match the fourth control signal. The remote measurement and control terminal according to claim 8, characterized in that.

14. The controller further continuously acquires the third control signal or the fourth control signal within a preset period by the sampling module, generates a first curve representing the voltage change trend of the third control signal or a second curve representing the voltage change trend of the fourth control signal, and compares the first curve or the second curve with a preset voltage change curve, and is used to determine that the first curve or the second curve is abnormal when the deviation between the first curve or the second curve and the preset voltage change curve is greater than the curve deviation threshold. The remote measurement and control terminal according to claim 8, characterized in that.

15. The digital quantity interface unit includes a second switch unit, a first signal insulation unit, and an output judgment unit. The second switch unit is serially connected to the input terminal circuit of the first signal insulation unit. The controller is connected to the second switch unit and the input terminal circuit of the first signal insulation unit. The output judgment unit is connected to the output terminal circuit of the first signal insulation unit. The output terminal circuit of the first signal insulation unit is connected to the first input terminal and the second input terminal of the controller. The input terminal circuit of the first signal insulation unit is further used to access a digital quantity input signal input from the outside. The controller is used to transmit a self - test signal to the input terminal circuit of the first signal insulation unit and transmit a switch control signal to the second switch unit to control the conduction or disconnection of the second switch unit. The input terminal circuit of the first signal insulation unit conducts when the second switch unit conducts and disconnects when the second switch unit is disconnected. The output determination unit is used to output a high-level determination signal by the output terminal circuit of the first signal insulation unit when the input terminal circuit of the first signal insulation unit is disconnected. The output terminal circuit of the first signal insulation unit outputs a low-level determination signal when the input terminal circuit of the first signal insulation unit is conductive and the digital quantity input signal or the self-test signal is a high-level signal. The remote measurement control terminal according to claim 3, characterized in that.

16. The second switch unit includes a second switch element and a fourth resistor, The first output terminal of the controller is connected to the control terminal of the second switch element by the fourth resistor, and the controller transmits the switch control signal by the first output terminal of the controller. The remote measurement control terminal according to claim 15, characterized in that.

17. The first signal insulation unit includes an optical coupler unit, The first input terminal of the optical coupler unit is connected to the second output terminal of the controller to access the digital quantity input signal. The second input terminal of the optical coupler unit is grounded by the second switch element, and the controller transmits the self-test signal by the second output terminal of the controller. The first output terminal of the optical coupler unit is connected to the first input terminal, the second input terminal of the controller and the output determination unit, and the second output terminal of the optical coupler unit is grounded. The remote measurement control terminal according to claim 16, characterized in that.

18. The digital quantity interface unit further includes a second signal insulation unit and a fifth resistor, The second signal insulation unit is connected to the first input terminal of the optical coupler unit by the fifth resistor, The second output terminal of the controller is connected to the fifth resistor by the second signal insulation unit, and the digital quantity input signal is transmitted to the first input terminal of the optical coupler unit by the second signal insulation unit. The second signal insulation unit is used to insulate the digital quantity input signal and the self-test signal. The remote measurement control terminal according to claim 17, characterized in that.

19. The second signal insulation unit includes a second diode and a third diode, The negative terminal of the second diode is connected to the first input terminal of the optical coupler unit by the fifth resistor, and the positive terminal of the second diode is used to access the digital quantity input signal. The remote measurement and control terminal according to claim 18, wherein the negative terminal of the third diode is connected to the first input terminal of the optical coupler unit by the fifth resistor, and the positive terminal of the third diode is connected to the second output terminal of the controller.

20. The output determination unit includes a sixth resistor and a seventh resistor. The first terminal of the sixth resistor is connected to a power supply, and the second terminal of the sixth resistor is connected to the first terminal of the seventh resistor and the first output terminal of the optical coupler unit, and then connected to the first input terminal and the second input terminal of the controller. The remote measurement and control terminal according to claim 17, wherein the second terminal of the seventh resistor is grounded.

21. The input terminal circuit of the first signal insulation unit receives a digital quantity input signal input from the outside, and the output terminal circuit of the first signal insulation unit outputs a first determination signal corresponding to the digital quantity input signal to the first input terminal and the second input terminal of the controller. The controller further analog-digital converts the first determination signal received by its first input terminal and second input terminal, and then compares it with a digital quantity signal threshold respectively. When it is determined that the first determination signal received by any of the input terminals of the controller is abnormal according to the comparison result, generating a first fault alarm signal, and during self-test, sending a self-test signal to the input terminal circuit of the first signal insulation unit, and the output terminal circuit of the first signal insulation unit outputs a second determination signal corresponding to the self-test signal to the first input terminal and the second input terminal of the controller. After analog-digital converting the second determination signal received by its first input terminal and second input terminal, and then comparing it with the digital quantity signal threshold respectively. When it is determined that the second determination signal received by any of the input terminals of the controller is abnormal according to the comparison result, it is used for generating a second fault alarm signal. The remote measurement and control terminal according to claim 15, characterized in that.

22. The controller further Continuously acquire a determination signal received by any of the input terminals of the controller within a preset period, and generate a first curve representing the voltage change trend of the determination signal acquired within the preset period by the input terminal corresponding to the controller, and When the deviation between the first curve and the standard voltage change curve is greater than the curve deviation threshold, it is used to determine that the first curve is abnormal. The remote measurement control terminal according to claim 15, characterized in that.

23. The controller further According to the comparison result, when it is determined that there is no abnormality in the first determination signal received by the first input terminal or the second input terminal of the controller, generating a corresponding control signal according to the first determination signal without abnormality, and According to the comparison result, when it is determined that there is no abnormality in the first determination signals received by all the input terminals of the controller, it is used to generate a corresponding control signal according to any one of the first determination signals without abnormality. The remote measurement control terminal according to claim 15, characterized in that.

24. A safety control system, comprising An execution unit, and The remote measurement control terminal according to any one of claims 1 to 23, wherein The remote measurement control terminal is used to generate a corresponding execution control signal according to an external input signal and transmit the execution control signal to the execution unit so as to control the execution unit to execute a corresponding action. A safety control system, characterized in that.

Images