Rail transit safety computer platform, control method, equipment and medium

Abstract

The invention relates to a rail transit safety computer platform, a control method, equipment and a medium, the platform is realized based on a multi-core virtualization technology, and the safety computer platform comprises a communication gateway used for providing a unified access entrance; the MPU operation subsystem comprises a system A and a system B which are mutually redundant and hot standby, each system comprises two operation units MPU1 and MPU2, and each operation unit MPU is divided into a plurality of logic partitions through a virtualization technology according to application requirements and safety requirements; the switching unit is connected with the MPU operation subsystem and used for switching the main and standby states of the A system and the B system; and the redundant network is respectively connected with the communication gateway, the MPU operation subsystem and the switching unit and is used for realizing internal communication. Compared with the prior art, the method has the advantages that the resource utilization rate and the system performance are remarkably improved, and the safety of the platform is improved.

Description

Technical Field

[0001] The present invention relates to a rail transit signal system, and in particular to a rail transit safety computer platform, control method, device and medium based on multi-core virtualization technology. Background Art

[0002] As an important part of public transportation, rail transit has the advantages of high efficiency, large capacity, fast and convenient, safe and comfortable, and low energy consumption. It is of great significance to reduce resource and environmental pressure and alleviate traffic congestion. The signal system is the core system to ensure the safety of rail transit, provide information services, and improve transportation efficiency. The safety computer platform is a fault-oriented safety bottom-level platform. It is a general platform serving the signal system of the rail transit industry and a core component of the rail transit signal system.

[0003] Traditional safety computer platforms use embedded boards to meet the requirements of high real-time performance, high security and low power consumption. With the rapid development of the rail transit industry, the functions of rail transit signal systems are becoming increasingly complex, and the requirements for computer platforms are becoming higher and higher. Limited by the performance of the CPU, it cannot meet the requirements of the ever-expanding computing power. At the same time, the performance of single-core processors has developed to a relatively high level. It is not enough to simply rely on improving the performance of single-core processors to improve the real-time performance of the system. Traditional safety computer platforms often have problems such as low resource utilization, long fault recovery time, and poor system scalability. With the rapid development of computer technology, multi-core processors and virtualization technology have become important means to improve system performance, reliability and security. With the existence of multi-core processors, the implementation of virtualization will become relatively easier because each core can run different processes. However, virtualization is not just a virtual server for each core, but each core can run multiple virtual machines at the same time. Multi-core virtualization technology runs multiple independent virtual environments on the same physical hardware, and virtualization technology has the advantages of centralized computing, dynamic resource allocation, and full use of system resources, etc., to achieve flexible scheduling and efficient utilization of resources, which can provide a new solution for rail transit safety computer platforms.

[0004] After searching, Chinese patent publication number CN113127270A discloses a 3-out-of-2 secure computer platform based on cloud computing, which specifically discloses: a hierarchical structure from top to bottom: cloud management center, business node, secure computer virtualization container and physical infrastructure; there is one cloud management center, and the business node is the host. The cloud management center communicates with the three hosts for signaling and data respectively. The host corresponds to the secure computer virtualization container, and the secure computer virtualization container corresponds to the physical infrastructure. The host communicates data with the corresponding secure computer virtualization container, and the secure computer virtualization container communicates data with the corresponding physical infrastructure. However, the existing patent does not describe how to ensure the functional safety of the 3-out-of-2 system in a virtualized environment, and how the adopted Docker container technology ensures the isolation of multi-channel images, and the related architecture requires more dedicated software and hardware design for the secure computer cloud platform.

[0005] Therefore, how to significantly improve the safety, reliability and real-time performance of the rail transit system by optimizing the hardware architecture, introducing virtualization technology, and building fault redundancy and fault-tolerant mechanisms has become a technical problem that needs to be solved. Summary of the invention

[0006] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and to provide a rail transit safety computer platform, control method, device and medium based on multi-core virtualization technology.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] According to a first aspect of the present invention, a rail transit safety computer platform is provided, which is implemented based on multi-core virtualization technology, and the safety computer platform includes:

[0009] Communication gateway, used to provide a unified access portal;

[0010] The MPU computing subsystem includes a system A and a system B that are mutually redundant and hot-standby, and each system includes two computing units MPU1 and MPU2. Each computing unit MPU is divided into multiple logical partitions through virtualization technology and according to application requirements and security requirements;

[0011] A switching unit is connected to the MPU computing subsystem and is used to switch the active and standby states of the A and B systems;

[0012] The redundant network connects the communication gateway, the MPU operation subsystem and the switching unit respectively to realize internal communication.

[0013] As a preferred technical solution, each computing unit MPU divides the platform into four logical partitions, namely:

[0014] The non-secure diagnostic maintenance partition VM1 is used to record system logs and fault information;

[0015] Secure application management and application partition VM2, used to provide data and call interfaces for applications;

[0016] The safety platform middleware partition VM3 is used to control the clock, CPU and memory check functions, safe 2-out-of-2, safe communication, and hot standby redundancy management to meet SIL4 level;

[0017] The non-secure communication function partition VM4 is used to implement non-secure communication functions.

[0018] As a preferred technical solution, the logical partitions of the two computing units MPU1 and MPU2 are deployed in different orders, and partitions with the same functions use different CPU cores and memory segments in the upper and lower modules.

[0019] As a preferred technical solution, each computing unit MPU adopts a multi-core processor as a core computing unit and optimizes the communication and collaboration mechanism between processors.

[0020] As a preferred technical solution, each computing unit MPU abstracts physical hardware resources into multiple independent virtual environments, each of which is called a virtual machine instance VM, and implements secure isolation of resources between virtual machine instances VM.

[0021] As a preferred technical solution, the virtual machine instance VM adopts a real-time operating system RTOS as the underlying operating environment.

[0022] As a preferred technical solution, the A series and the B series are powered by different power supplies respectively. The two computing units A-MPU1 and A-MPU2 in the A series are powered by one power supply, and the two computing units B-MPU1 and B-MPU2 in the B series are powered by another power supply.

[0023] As a preferred technical solution, the two computing units A-MPU1, A-MPU2 and the two computing units B-MPU1, B-MPU2 all adopt a 2-out-of-2 structure.

[0024] As a preferred technical solution, the communication gateway adopts a redundant structure, including a gateway R and a gateway B, wherein the gateway R is powered by a separate power supply, which also supplies power to the switching unit; the gateway B is powered by another separate power supply, which also supplies power to the switching unit.

[0025] According to a second aspect of the present invention, a control method for the rail transit safety computer platform is provided, the method comprising the following steps:

[0026] Step S1, communication gateways R and B receive external system data;

[0027] Step S2, the communication gateways R and B forward the external data to the non-secure communication function partitions of MPU1 and MPU2;

[0028] Step S3, the non-secure communication function partition of MPU1 or MPU2 processes the data and sends it to the secure platform middleware partition VM3;

[0029] Step S4, after the security platform middleware partition VM3 processes the data securely, it sends it to the security application management and application partition VM2;

[0030] Step S5, the application management and application partition VM2 transmits the data to the application through the application interface;

[0031] Step S6, the application management and application partition VM2 calls the application for processing;

[0032] Step S7, the application management and application partition VM2 obtains the data processed by the application and forwards it to the security platform middleware partition VM3;

[0033] Step S8: After the secure platform middleware partition VM3 processes the application data securely, it sends it to the non-secure communication function partition of MPU1 and the non-secure communication function partition of MPU2 for output consistency comparison.

[0034] Step S9, if they are consistent, the non-safe communication function partitions of MPU1 and MPU2 send the data to the communication gateways R and B respectively, otherwise they shut down;

[0035] Step S10: Communication gateways R and B forward the data to an external communication system.

[0036] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0037] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program implements the method described when executed by a processor.

[0038] Compared with the prior art, the present invention has the following advantages:

[0039] 1) The present invention adopts secure virtualization technology to fully utilize hardware resources, significantly improving resource utilization and system performance; at the same time, it can ensure secure isolation between different virtual machines, isolate secure functions from non-secure functions, and improve the security of the platform.

[0040] 2) The present invention adopts secure virtualization technology, which can enable old embedded applications to run without modification, without worrying about changes brought by multi-core, thereby improving the portability of the system.

[0041] 3) The present invention realizes the design of separating platform security functions from application operations, improves the concurrent processing capability of the system, and improves the overall performance of the system application.

[0042] 4) The present invention separates the safety function from the non-safety function, allowing them to run in different virtual machine partitions, reducing the complexity of developing non-safety functions. Otherwise, non-safety functions must be developed according to the same process requirements as safety functions, and the development and testing workload is very large. At the same time, the real-time and deterministic requirements of safety-critical functions are also guaranteed, avoiding interference from non-safety functions.

[0043] 5) The present invention adopts heterogeneous logical partition deployment. Partitions with the same function use different CPU cores and memory segments in the upper and lower modules, which simplifies the security requirements of the entire system for the virtualization layer and the hardware layer, making the entire system design simpler. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 is a structural block diagram of the secure computer platform of the present invention;

[0045] Figure 2 A schematic diagram of the hardware structure of the secure computer platform of the present invention;

[0046] Figure 3 It is a detailed structural diagram of the secure computer platform of the present invention;

[0047] Figure 4 This is a flow chart of the control method of the secure computer platform of the present invention;

[0048] Figure 5 It is a workflow diagram of the MPU computing unit of the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] like Figure 1As shown in the figure, a rail transit safety computer platform based on multi-core virtualization technology. The platform is designed in accordance with the fail-safe principle and meets the requirements of EN50129 functional safety SIL4 level. It has the characteristics of high safety, high reliability, high availability, high maintainability and high performance. The platform includes a communication gateway, a redundant network, a switching unit and an MPU computing subsystem, wherein the computing subsystem includes two groups of computing processing systems, namely A\B systems, which are redundant hot standby for each other. Each A / B system is composed of two computing units, MPU1 and MPU2, which perform 2-out-of-2 operations, and are marked as A-MPU1, A-MPU2, B-MPU1, and B-MPU2.

[0051] 1) The communication gateway provides a unified access portal and flow control for the entire system.

[0052] 2) Redundant networks provide communications within the system.

[0053] 3) The switching unit provides a manual device, which allows the user to switch the active / standby status of the A / B system;

[0054] 4) The MPU operation subsystem is the core subsystem of the entire secure computer platform, which implements fault tolerance, secure communication data processing, hot standby redundancy management, and provides a working platform and interface for secure application software.

[0055] Each MPU unit,

[0056] 1) Use high-performance multi-core processors as core computing units, optimize the communication and collaboration mechanisms between processors, give full play to the parallel processing capabilities of multi-core processors, and improve the overall computing power of the system.

[0057] 2) On top of the hardware, the secure virtualization function is implemented. The secure virtualization function completes the management of basic hardware resources, including CPU, memory, network, storage and other resources, and abstracts physical hardware resources (such as CPU, memory, I / O devices, etc.) into multiple independent virtual environments. Each virtual environment is called a virtual machine instance (VM). It can also achieve secure isolation of resources between virtual machines without interfering with each other, ensuring the independence of the upper-level software at runtime, thereby achieving flexible scheduling and efficient utilization of resources.

[0058] 3) On the virtualization layer, the system is divided into multiple logical partitions according to application requirements and security requirements. Each partition runs an independent operating system and application program. The isolation mechanism provided by the virtualization layer ensures data security and operation independence between partitions. This platform is divided into 4 logical partitions. VM1 is a non-safety diagnostic maintenance partition, which is used to record system logs and fault information; VM2 is a safety application management and application partition, which provides data and call interfaces for applications, and safety applications can run in this partition; VM3 is a safety platform middleware partition, which implements functions such as control clock, CPU and memory inspection functions, safety 2-out-of-2, safety communication, and hot standby redundancy management that meet SIL4 level; VM4 is a non-safety communication function partition, which implements non-safety communication functions such as redundant communication processing, network protocol stack, driver, etc. The logical partitions of MPU1 and MPU2 can be deployed in different orders. Partitions with the same function use different CPU cores and memory segments in the upper and lower modules to improve the heterogeneity of the entire system and ensure that even if there is a hardware problem that causes interference between partitions, it can be detected when 2-out-of-2 due to different interference effects.

[0059] 4) In view of the real-time requirements of the secure computer platform, a real-time operating system (RTOS) is used as the underlying operating environment of the VM to ensure real-time response of critical tasks and high availability of the system.

[0060] The specific implementation process of the present invention is as follows:

[0061] like Figure 1 As shown, the present invention includes redundant power supplies, redundant networks, communication gateways, switching units, redundant MPU computing subsystems, secure virtualization, basic hardware equipment, etc.; Figure 2 As shown, A-MPU1 and A-MPU2 are powered by one power supply, and B-MPU1 and B-MPU2 are powered by one power supply; Gateway-R is powered by a separate power supply, which also supplies power to the switching unit; Gateway-B is powered by a separate power supply, which also supplies power to the switching unit; Figure 3 As shown in the figure, each system consists of two computing units, MPU1 and MPU2, which perform 2-out-of-2 operations. For each MPU, the basic hardware device is the security virtualization software, which creates four logical partitions, namely VM1 for non-security diagnosis and maintenance partition, VM2 for security application management and application partition, VM3 for security platform middleware partition, and VM4 for non-security communication function partition. The hardware system uses the 4-core Feiteng CPU E2000Q based on the ARM V8 (AdvancedRISC Machine) architecture.

[0062] The CPU includes 4 identical advanced reduced instruction set machines ARMv8, which is an SMP (Symmetric Multi-Processing) architecture. Compared with AMP (Asymmetric Multi-Processing), all CPUs in the SMP architecture are equal, without master-slave or primary-secondary distinction. They can independently execute tasks and access system resources; the computing unit and gateway unit are based on E2000Q, self-developed hardware boards, which include Ethernet interfaces, memory, hard disks, etc.; self-developed secure real-time virtualization software is deployed on the computing unit to ensure real-time and secure isolation between different virtual machines. The virtualization software can allocate CPU, memory, network, storage and other resources to different virtual machines according to the configuration. Real-time operating systems such as vxworks, reworks, syslixOS, etc. can be deployed in secure virtual machines; embedded Linux operating systems can be deployed in non-secure virtual machines. The gateway unit directly deploys an embedded Linux operating system.

[0063] The above is an introduction to the platform embodiment. The following is a further explanation of the solution of the present invention through an embodiment of the control method.

[0064] like Figure 4 As shown, a control method for the rail transit safety computer platform comprises the following steps:

[0065] Step S1, communication gateways R and B receive external system data;

[0066] Step S2, the communication gateways R and B forward the external data to the non-secure communication function partitions of MPU1 and MPU2;

[0067] Step S3, the non-secure communication function partition of MPU1 or MPU2 processes the data and sends it to the secure platform middleware partition VM3;

[0068] Step S4, after the security platform middleware partition VM3 processes the data securely, it sends it to the security application management and application partition VM2;

[0069] Step S5, the application management and application partition VM2 transmits the data to the application through the application interface;

[0070] Step S6, the application management and application partition VM2 calls the application for processing;

[0071] Step S7, the application management and application partition VM2 obtains the data processed by the application and forwards it to the security platform middleware partition VM3;

[0072] Step S8: After the secure platform middleware partition VM3 processes the application data securely, it sends it to the non-secure communication function partition of MPU1 and the non-secure communication function partition of MPU2 for output consistency comparison.

[0073] Step S9, if they are consistent, the non-safe communication function partitions of MPU1 and MPU2 send the data to the communication gateways R and B respectively, otherwise they shut down;

[0074] Step S10: Communication gateways R and B forward the data to an external communication system.

[0075] like Figure 5 As shown, the workflow of the MPU computing unit of the present invention is described in detail as follows:

[0076] 1) Power on the system;

[0077] 2) The system loads secure virtualization software;

[0078] 3) The secure virtualization software creates and loads a virtual machine according to the configuration, and MPU1 / MPU2 enters the ready state;

[0079] 4) The security middleware virtual machine negotiates the timing of entering the main cycle;

[0080] 5) After MPU1 / MPU2 enters the main cycle, its redundancy management module performs master-slave judgment. If it is the master, it switches to 6.1; if it is the slave, it switches to 7.1;

[0081] 6.1) The main MPU1 / MPU2 sends clock synchronization information to other 2oo2 units;

[0082] 6.2) The main MPU1 / MPU2 processes security data and triggers the application logic to process security data;

[0083] 6.3) The main MPU1 / MPU2 obtains data from the application for security voting; if it passes, it proceeds to 6.4, otherwise it proceeds to 8;

[0084] 6.4) The main MPU1 / MPU2 outputs the data obtained from the application;

[0085] 6.5) The main MPU1 / MPU2 sends its status data to the standby system;

[0086] 6.6) The main MPU1 / MPU2 returns to 5) and enters the next cycle;

[0087] 7.1) The slave MPU1 / MPU2 performs clock synchronization with the master MPU1 / MPU2;

[0088] 7.2) Get the status data to be synchronized from MPU1 / MPU2. If OK, refresh the local information synchronously;

[0089] 7.3) Process security data from MPU1 / MPU2 and trigger application logic to process security data;

[0090] 7.4) Obtain data from the application from MPU1 / MPU2 for security voting; if passed, return to 5) and enter the next cycle;

[0091] Otherwise go to 8;

[0092] 8) MPU1 / MPU2 enters the safe state and remains in the safe state.

[0093] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific structure of the described module can refer to the corresponding content in the aforementioned platform embodiment, and will not be repeated here.

[0094] The electronic device of the present invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0095] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0096] The processing unit performs the various methods and processes described above, such as the method of the present invention. For example, in some embodiments, the method of the present invention can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of the method of the present invention described above can be performed. Alternatively, in other embodiments, the CPU can be configured to perform the method of the present invention by any other appropriate means (e.g., by means of firmware).

[0097] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0098] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0099] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0100] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A rail transit safety computer platform, characterized in that: The platform is implemented based on multi-core virtualization technology, and the secure computer platform includes: Communication gateway, used to provide a unified access portal; The MPU computing subsystem includes a system A and a system B that are mutually redundant and hot-standby, and each system includes two computing units MPU1 and MPU2. Each computing unit MPU is divided into multiple logical partitions through virtualization technology and according to application requirements and security requirements; A switching unit is connected to the MPU computing subsystem and is used to switch the active and standby states of the A and B systems; The redundant network connects the communication gateway, the MPU operation subsystem and the switching unit respectively to realize internal communication.

2. A rail transit safety computer platform according to claim 1, characterized in that: Each computing unit MPU divides the platform into four logical partitions, namely: The non-secure diagnostic maintenance partition VM1 is used to record system logs and fault information; Secure application management and application partition VM2, used to provide data and call interfaces for applications; The safety platform middleware partition VM3 is used to control the clock, CPU and memory check functions, safe 2-out-of-2, safe communication, and hot standby redundancy management to meet SIL4 level; The non-secure communication function partition VM4 is used to implement non-secure communication functions.

3. A rail transit safety computer platform according to claim 2, characterized in that: The logical partitions of the two computing units MPU1 and MPU2 are deployed in different orders, and partitions with the same functions use different CPU cores and memory segments in the upper and lower modules.

4. A rail transit safety computer platform according to claim 1, characterized in that: Each of the computing units MPU uses a multi-core processor as a core computing unit and optimizes the communication and collaboration mechanism between processors.

5. A rail transit safety computer platform according to claim 1, characterized in that: Each of the computing units MPU abstracts the physical hardware resources into multiple independent virtual environments, each of which is called a virtual machine instance VM, and implements secure isolation of resources between virtual machine instances VM.

6. A rail transit safety computer platform according to claim 5, characterized in that: The virtual machine instance VM uses a real-time operating system RTOS as the underlying operating environment.

7. A rail transit safety computer platform according to claim 1, characterized in that: The A series and the B series are powered by different power supplies. The two computing units A-MPU1 and A-MPU2 in the A series are powered by one power supply, and the two computing units B-MPU1 and B-MPU2 in the B series are powered by another power supply.

8. A rail transit safety computer platform according to claim 7, characterized in that: The two computing units A-MPU1, A-MPU2 and the two computing units B-MPU1, B-MPU2 all adopt a 2-out-of-2 structure.

9. A rail transit safety computer platform according to claim 1, characterized in that: The communication gateway adopts a redundant structure, including a gateway R and a gateway B, wherein the gateway R is powered by a separate power supply, and the power supply also supplies power to the switching unit; the gateway B is powered by another separate power supply, and the power supply also supplies power to the switching unit.

10. A control method for the rail transit safety computer platform according to claim 2, characterized in that: The method comprises the following steps: Step S1, communication gateways R and B receive external system data; Step S2, the communication gateways R and B forward the external data to the non-secure communication function partitions of MPU1 and MPU2; Step S3, the non-secure communication function partition of MPU1 or MPU2 processes the data and sends it to the secure platform middleware partition VM3; Step S4, after the security platform middleware partition VM3 processes the data securely, it sends it to the security application management and application partition VM2; Step S5, the application management and application partition VM2 transmits the data to the application through the application interface; Step S6, the application management and application partition VM2 calls the application for processing; Step S7, the application management and application partition VM2 obtains the data processed by the application and forwards it to the security platform middleware partition VM3; Step S8: After the secure platform middleware partition VM3 processes the application data securely, it sends it to the non-secure communication function partition of MPU1 and the non-secure communication function partition of MPU2 for output consistency comparison. Step S9, if they are consistent, the non-safe communication function partitions of MPU1 and MPU2 send the data to the communication gateways R and B respectively, otherwise they shut down; Step S10: Communication gateways R and B forward the data to an external communication system.

11. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to claim 10 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 10 is implemented.

Images