A highly reliable two-to-two data communication board

Abstract

The present invention discloses a highly reliable two-out-of-two data communication board, comprising a power supply circuit, a backplane communication circuit, a two-out-of-two architecture circuit, an external communication channel circuit and a state input and output circuit, wherein the power supply circuit is used to power the communication board; the backplane communication circuit comprises two CAN bus modules, each of which comprises an electromagnetic protection module connected to the CAN bus, two CAN isolation transceivers, and is respectively connected to a safety CPU‑A and a safety CPU‑B; the two-out-of-two architecture circuit sets an isolation resistor between the safety CPU‑A and the safety CPU‑B; the external communication channel circuit comprises two optical communication channels; the state input and output circuit comprises a state CPU and a front panel LED indicator circuit, and the state CPU is respectively connected to the safety CPU‑A and the safety CPU‑B. The present invention can provide an ultra-long-distance, high-reliability data transmission channel based on CAN‑light‑CAN communication.

Description

Technical Field

[0001] The invention relates to the technical field of data communication boards and cards, and in particular to a two-out-of-two data communication board and card with extremely high reliability. Background Art

[0002] In the design process of rail transit communication systems, various communication interfaces are usually used, such as commonly used serial ports, CAN, and Ethernet, and each interface may be used in multiple ways at the same time. When multiple or multiple interfaces are used at the same time, the interfaces of a single board cannot meet the needs, and the number of communication boards needs to be increased in the equipment to meet the needs of the types and quantities of communication interfaces. Traditional communication boards usually use a single-access architecture. When encountering threats such as abnormal data and frame misalignment within the system, they cannot be effectively identified and corrected, and the communication reliability and security are not high. Based on the above problems, there is an urgent need to develop a highly secure and reliable data communication board. Summary of the invention

[0003] The object of the present invention is to provide a highly reliable two-to-two data communication board, which can provide an ultra-long-distance data transmission channel based on CAN-optical-CAN communication and provide highly reliable and secure data transmission.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] An extremely high reliability two-out-of-two data communication board card, comprising a power supply circuit, a backplane communication circuit, a two-out-of-two architecture circuit, an external communication channel circuit and a status input and output circuit, wherein the power supply circuit comprises a main power supply, a backup power supply, a power supply switching module, a safety power supply interface module and a non-safety power supply interface module, wherein the main power supply and the backup power supply are respectively connected to the power supply switching module, and the power supply switching module is connected to the safety power supply interface module and the non-safety power supply interface module;

[0006] The backplane communication circuit includes two CAN bus modules, namely a CAN-A bus module and a CAN-B bus module. The CAN-A bus module includes a first electromagnetic protection module connected to the CAN-A bus and two CAN isolation transceivers. The first electromagnetic protection module is connected to the safety CPU-A and the safety CPU-B respectively through the two CAN isolation transceivers; the CAN-B bus module includes a second electromagnetic protection module connected to the CAN-B bus and two CAN isolation transceivers. The second electromagnetic protection module is connected to the safety CPU-A and the safety CPU-B respectively through the two CAN isolation transceivers;

[0007] The two-out-of-two architecture circuit includes a safety CPU-A, a safety CPU-B, and an isolation resistor arranged between the safety CPU-A and the safety CPU-B;

[0008] The external communication channel circuit includes two optical communication channels, namely, an external optical communication-A channel and an external optical communication-B channel. The external optical communication-A channel includes a first serial port to isolated RS422 module, an optical communication converter-A and an external optical communication-A connected in sequence, and the first serial port to isolated RS422 module is connected to the safety CPU-A; the external optical communication-B channel includes a second serial port to isolated RS422 module, an optical communication converter-B and an external optical communication-B connected in sequence, and the second serial port to isolated RS422 module is connected to the safety CPU-B;

[0009] The state input and output circuit includes a state CPU and a front panel LED indicator circuit, the front panel LED indicator circuit is connected to the state CPU, and the state CPU is respectively connected to the safety CPU-A and the safety CPU-B;

[0010] The safety power interface module is connected to the backplane communication circuit, the two-out-of-two architecture circuit, and the external communication channel circuit, and is used to power the backplane communication circuit, the two-out-of-two architecture circuit, and the external communication channel circuit; the non-safety power interface module is connected to the status input and output circuit, and is used to connect the status input and output circuit.

[0011] Furthermore, a third electromagnetic protection module is provided between the first serial port to isolated RS422 module and the second serial port to isolated RS422 module.

[0012] Furthermore, an electromagnetic protection module A is provided between the main power supply and the power switching module, and an electromagnetic protection module B is provided between the backup power supply and the power switching module.

[0013] Furthermore, the first electromagnetic protection module, the second electromagnetic protection module, and the third electromagnetic protection module are all composed of filter capacitors and TVS tubes.

[0014] Furthermore, the first serial port to isolated RS422 module is also connected to the safety CPU-B, and the second serial port to isolated RS422 module is connected to the safety CPU-A.

[0015] Furthermore, the status CPU is also connected to a DIP switch circuit.

[0016] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects: the extremely high reliability two-out-of-two data communication board provided by the present invention adopts redundant power input for the power supply circuit, the power input is divided into main and standby, the power module automatically switches the main and standby power supplies according to the power supply conditions, when both the main and standby power supplies are available, the main power supply is adopted as the power supply circuit, when the main power supply fails, it automatically switches to the standby power supply for power supply; the backplane CAN is adopted as the internal communication link of the device, the backplane is provided with two CAN buses, each time data is sent and received, the two backplane CANs simultaneously send and receive the same data, the master and slave CPUs simultaneously send and receive data to the two CAN buses, the two CPUs merge the received or to-be-sent data, and compare them through the two-out-of-two part, and when the comparison confirms that the data is consistent, the sending and receiving operation is performed; the ultra-long-distance data transmission channel based on CAN-optical-CAN communication is provided with multiple electromagnetic protection modules to prevent data errors caused by the influence of outdoor electromagnetic environment; the state input and output circuit part is mainly responsible for displaying and collecting the system state; in summary, the present invention provides high-reliability safe data transmission, and when a fault occurs, data is inconsistent, or data logic is not satisfied, it ensures that the communication system is directed to the safe side, and ensures the continuity and reliability of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0018] Figure 1 It is a schematic diagram of the structure of the power supply circuit of the present invention;

[0019] Figure 2 It is a structural schematic diagram of the backplane communication circuit of the present invention;

[0020] Figure 3 It is a schematic diagram of the structure of the two-out-of-two architecture circuit of the present invention;

[0021] Figure 4 It is a structural schematic diagram of the external communication channel circuit of the present invention;

[0022] Figure 5 It is a structural diagram of the state input and output circuit of the present invention;

[0023] Figure 6 This is a flow chart of controlled task scheduling according to an embodiment of the present invention;

[0024] Figure 7 This is a two-out-of-two comparison logic flow chart of the present invention;

[0025] Figure 8 This is the security data interaction logic diagram of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] The object of the present invention is to provide a highly reliable two-to-two data communication board, which can provide an ultra-long-distance data transmission channel based on CAN-optical-CAN communication and provide highly reliable and secure data transmission.

[0028] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0029] like Figure 1 and Figure 5 As shown, the extremely high reliability two-out-of-two data communication board provided by the present invention includes a power supply circuit, a backplane communication circuit, a two-out-of-two architecture circuit, an external communication channel circuit and a status input and output circuit, wherein the power supply circuit includes a main power supply, a backup power supply, a power switching module, a safety power interface module and a non-safety power interface module, wherein the main power supply and the backup power supply are respectively connected to the power switching module, and the power switching module is connected to the safety power interface module and the non-safety power interface module; an electromagnetic protection module A is arranged between the main power supply and the power switching module, and an electromagnetic protection module B is arranged between the backup power supply and the power switching module; wherein the main power supply is Figure 1 The external power supply A in the embodiment, the backup power supply is the external power supply B;

[0030] The board divides electrical appliances into safety appliances and non-safety appliances. The two categories are powered by independent power supplies to prevent the failure of non-safety applications from affecting safety peripherals and improve system availability. System safety peripherals include: safety CPU (two master and slave), safety communication circuit (two channels 1 and 2). System non-safety peripherals include: status CPU, indicator light circuit, board ID setting circuit. The power supply circuit converts the external input power into the corresponding voltage according to the type of peripherals and power supply requirements. In terms of circuit connection, when connecting peripherals in different power partitions, optical couplers are used for physical isolation to prevent common cause failures caused by power failures. Two independent power supply channels are used to supply power between the master and slave safety CPUs to prevent the master and slave safety CPUs from failing at the same time due to power failure. The safety power interface module is connected to the backplane communication circuit, the two-out-of-two architecture circuit, and the external communication channel circuit to supply power to the backplane communication circuit, the two-out-of-two architecture circuit, and the external communication channel circuit; the non-safety power interface module is connected to the status input and output circuit to connect the status input and output circuit.

[0031] like Figure 2 As shown, the backplane communication circuit includes two CAN bus modules, namely a CAN-A bus module and a CAN-B bus module. The CAN-A bus module includes a first electromagnetic protection module connected to the CAN-A bus and two CAN isolation transceivers. The first electromagnetic protection module is connected to the safety CPU-A and the safety CPU-B through two CAN isolation transceivers; the CAN-B bus module includes a second electromagnetic protection module connected to the CAN-B bus and two CAN isolation transceivers. The second electromagnetic protection module is connected to the safety CPU-A and the safety CPU-B through two CAN isolation transceivers; the board uses the backplane CAN as the internal communication link of the device, and the backplane is provided with two CAN buses. Each time data is sent and received, the two backplane CANs send and receive the same data at the same time. The master and slave CPUs send and receive data to the two CAN buses at the same time. After the two CPUs merge the data received or to be sent, they compare the two parts by taking two out of two. If the comparison confirms that the data is consistent, the sending and receiving operation is performed. The backplane communication circuit module isolates and receives the backplane CAN bus to prevent the safety work of the board from being affected by the external CAN bus failure. The backplane communication circuit module provides electromagnetic protection such as filter capacitors and TVS tubes to prevent electromagnetic interference such as external surges from affecting the safe operation of the board.

[0032] like Figure 3As shown, the two-out-of-two architecture circuit includes a safety CPU-A, a safety CPU-B, and an isolation resistor arranged between the safety CPU-A and the safety CPU-B; the board adopts a two-out-of-two architecture, and the two safety CPUs perform two-out-of-two verification on the received backplane CAN messages, the sent backplane CAN messages, the received inter-station safety messages, and the sent inter-station safety messages. Only when the two-out-of-two verification passes, the corresponding message enters the operation logic. When the two-out-of-two verification fails for multiple times in a row, the system enters the safety-oriented state, stops sending and receiving messages, the board goes down, and reports the board fault. Safety CPU-A and safety CPU-B use resistors to isolate the circuit between the master and slave safety CPUs to prevent the normal operation of the other side from being affected by the power failure on one side.

[0033] like Figure 4 As shown, the external communication channel circuit includes two optical communication channels, namely, external optical communication-A channel and external optical communication-B channel. The external optical communication-A channel includes a first serial port to isolated RS422 module, an optical communication converter-A and an external optical communication-A connected in sequence, and the first serial port to isolated RS422 module is connected to the safety CPU-A; the external optical communication-B channel includes a second serial port to isolated RS422 module, an optical communication converter-B and an external optical communication-B connected in sequence, and the second serial port to isolated RS422 module is connected to the safety CPU-B; a third electromagnetic protection module is arranged between the first serial port to isolated RS422 module and the second serial port to isolated RS422 module. The first serial port to isolated RS422 module is also connected to the safety CPU-B, and the second serial port to isolated RS422 module is connected to the safety CPU-A.

[0034] The external communication channel of the board uses optical communication, and the board processes data from two optical channels at the same time. When sending data, the communication channel circuit converts the serial communication data sent by the safety CPU into the form of an isolated RS422 bus, and transmits it to the photoelectric conversion unit for sending. When receiving data, the photoelectric conversion unit converts the optical signal into isolated RS422 bus data, and the communication channel circuit converts the isolated 422 bus data into serial data and sends it to the safety CPU for processing. The external communication channel circuit isolates the CPU part and the communication transceiver part by isolating RS422 to prevent faults from affecting each other. At the same time, the circuit provides filter capacitors and TVS protection circuits for the optical communication module to prevent electromagnetic interference such as surges or static electricity from affecting system safety. When processing data, the master and slave CPUs simultaneously send and receive data for comparison and processing.

[0035] like Figure 5As shown, the state input and output circuit includes a state CPU and a front panel LED indicator circuit. The front panel LED indicator circuit is connected to the state CPU, and the state CPU is respectively connected to the safety CPU-A and the safety CPU-B; the state CPU is also connected to a dial switch circuit. The state input and output circuit part is mainly responsible for displaying and collecting the system status. The circuit exchanges data with the master and slave safety CPUs through the CAN communication within the board. The state input circuit includes: board ID, board fault status, and the state output circuit includes: front panel LED indicator circuit. The state input and output circuit is used to process the non-safety functions of the system (that is, the fault does not affect the business logic itself).

[0036] Among them, the first electromagnetic protection module, the second electromagnetic protection module, and the third electromagnetic protection module are all composed of filter capacitors and TVS tubes.

[0037] The hardware and software design of the data communication board mainly includes: controllable task scheduling system, information verification between secure communication stations, secure communication verification, two-out-of-two comparison system and status input and output system.

[0038] The software uses a controlled task scheduling system. The core tasks of the system include intra-board communication tasks, inter-board communication tasks, inter-station communication tasks, and system status monitoring tasks. Tasks are registered when they are created. The task scheduling system schedules tasks according to task parameters. Tasks are mainly divided into data tasks and timed tasks. Timed tasks are triggered at regular intervals, and data tasks are triggered when new data arrives. The task scheduling system can freely set the scheduling cycle based on the system granularity. The specific scheduling process Figure 6 Through the controllable task scheduling system, task execution can be effectively controlled to ensure that all safety tasks can be completed within the scheduling cycle. In the event of a timeout caused by exceeding the computing power, the abnormal state of the system can be effectively collected, and the control board can perform protective output without generating any non-safety side output.

[0039] The software performs security information verification on inter-board communication and inter-station communication.

[0040] Communication protocol protection: The system adds the world time information of message sending at the communication protocol layer to protect against message timeout failures and prevent unsafe actions caused by communication channel failures. The system adds the message sending sequence number at the communication protocol layer to protect against message duplication, disorder, insertion and other failures and prevent unsafe actions caused by transceiver failures.

[0041] Inter-station information protection: Since there is coupling logic in inter-station information, for example, the conditions for event A to occur are condition B and condition C. After receiving all the inter-station information, the board will parse and logically judge the inter-station information. If the event and condition cannot match, the inter-station message data abnormality will be reported to the superior, and possible non-safe message output will be eliminated within the board.

[0042] For example: safety condition A + safety condition B = safety action C, then the judgment logic is shown in Table 1.

[0043] Table 1

[0044] Received security condition A Received security condition B Received safety action C Issue safety action C output conform to conform to conform to Output conform to conform to Not Compliant No output conform to Not Compliant conform to No output Not Compliant conform to conform to No output

[0045] The system communication protocol adopts a high-reliability communication protocol. The communication is divided into three stages: handshake initiation, handshake response, and secure communication.

[0046] The communication protocol is a point-to-point mode. The receiver enters the handshake initiation phase and sends a handshake instruction to the sender. After receiving the handshake instruction, the sender replies with a handshake response instruction to confirm the handshake status. Then the sender enters the secure communication state and continues secure communication for a fixed period.

[0047] The secure communication protocol contains data such as frame sequence number, timestamp, source ID, destination ID, frame type, etc. After receiving the data, the receiver will check all fields. If any field is abnormal, the secure communication will fail and re-enter the handshake state.

[0048] The secure communication protocol uses dual redundant CRC32 and two heterogeneous CRC32 checks to form a CRC64 check of the frame to ensure the integrity of the data within the frame.

[0049] The message structure and function are shown in Table 2.

[0050] Table 2

[0051]

[0052] The system compares the data received by the master and slave CPUs to ensure that the data used by the master and slave CPUs is correct. The master and slave CPUs use the SPI channel as the physical link.

[0053] The data involved in the comparison is divided into two categories: status data and message data. The system divides the status data into independent storage areas and performs periodic cyclic comparisons on the data. Since the data area is large, only a part is compared each time, and the comparison of all status data is completed in a cycle to determine whether the status data held by the current system is consistent. For message data, when the system receives a new message, it will immediately initiate a master-slave comparison to compare whether the messages received by the two are consistent. If the messages are consistent, the message is valid, and if the messages are inconsistent, the message is invalid.

[0054] like Figure 7 As shown, the two-out-of-two comparison logic is controlled by the main CPU, that is, the main CPU controls the start of the two-out-of-two comparison and the judgment of the two-out-of-two comparison result.

[0055] The system needs to collect and control the status data in the board. The collected status includes the board ID status, and the controlled data includes the front panel LED status and the system fault SD card record. The safety CPU is connected to the status input and output system through the CAN bus in the board. The master and slave CPUs can directly access the status input and output system, control it, and complete the function.

[0056] With the joint cooperation of the above systems, the data processing flow of the system is as follows.

[0057] After the system is started, all external data are sent to the data area to be compared. The system will regularly perform master-slave comparison on the data in the area to be compared. After the master-slave comparison, the external data to be compared is converted into safe external data and stored in the safe data area.

[0058] After the system is started, all operation conditions come from the safe data area. After the operation results are generated, they are first sent to the data area to be compared and wait for the master-slave operation result comparison. The system will regularly perform master-slave comparison on the data in the area to be compared. After the master-slave comparison, the operation results to be compared are converted into safe operation results and stored in the safe data area.

[0059] The logic diagram of secure data interaction is as follows: Figure 8 After the system obtains the safety output data from the safety data area, it sends the data to the target object (other boards or status display modules). The system sending process is completely managed and does not involve safety information processing, so no safety dialectic is performed.

[0060] The communication board can provide a variety of security measures to protect the safe and complete operation of the system.

[0061] Memory verification: The system periodically verifies the integrity of memory data. Each time the memory data is operated, the corresponding verification code is modified accordingly. When performing memory verification, the system reads all memory data, generates the corresponding verification word, and compares it with the verification code generated by the operation. If the verification fails, the system memory is judged to be abnormal, the system enters a downtime state, and reports a system failure.

[0062] System operation status monitoring: The system uses task scheduling to perform multi-task parallel processing. During task scheduling, the system synchronously monitors the task completion status. Within a unit of time, if it is found that the system operation time exceeds expectations, that is, the system task has timed out, then the system operation is judged to be abnormal, the system enters a downtime state, and the system failure is reported.

[0063] System clock status monitoring: The system performs clock status verification through dual CPUs. The dual CPUs work at the same clock frequency and trigger each other's external interrupts with the same period. At the same time, they detect their own external interrupt triggering conditions. If their own output is abnormal or the other party's external interrupt triggering is abnormal, the system clock status is determined to be abnormal, the system enters a downtime state, and reports a system fault.

[0064] Inter-station communication timing security check: The threats faced in the field of secure communication include but are not limited to repetition (repeated reception of the same message), packet loss (loss of message), insertion (messages do not arrive in the order in which they are sent), misorder (messages do not arrive in the order in which they are sent), error code (message content jumps), delay (the time process from the message being sent to the arrival), etc. During the operation of the board, in addition to facing threats caused by system problems and environmental problems, it also faces system threats caused by active intrusion. The degree of harm caused by this external threat is far greater than the threat caused by internal failure. Therefore, when the system uses the general hash chain (or LSFR) algorithm for protection, it also adopts a new obfuscation algorithm. The obfuscation process includes: position transformation (row and column displacement), byte substitution, and numerical operation. Board users can modify the order, type, and rounds of the obfuscation process according to their own needs. The check word involved in encryption is up to 16 bytes, or 64 bits, and the current check word is related to the timing, that is, this check word only has meaning at this moment and is invalid at other moments. Therefore, the probability of cracking the check word is 1 / 2 64 , as long as the sender and receiver maintain opposite encryption and decryption processes, the board data can be protected from external intrusion and the board security performance can be improved.

[0065] Backplane communication security verification: The system backplane uses CAN communication. For CAN messages, the system uses source ID + target ID + message type to locate data flow and message functions. When CAN messages are sent, they also face threats such as message duplication and packet loss. However, the payload of CAN messages is small (8 bytes), so the message sequence number (1 byte) and timestamp (1 byte) are introduced as the backplane security protection mechanism. The message sequence number automatically increases each time it is sent, and the timestamp automatically increases every 500ms. When receiving a message, it is necessary to check whether the sequence number and time of the corresponding message meet the corresponding rules.

[0066] The present invention provides an extremely high reliability two-out-of-two data communication board, in which a power supply circuit adopts redundant power supply input, and the power supply input is divided into main and standby, and the power supply module automatically switches between the main and standby power supplies according to the power supply situation. When both the main and standby power supplies are available, the main power supply is adopted as the power supply circuit, and when the main power supply fails, it automatically switches to the standby power supply for power supply; a backplane CAN is adopted as an internal communication link of the device, and two CAN buses are arranged on the backplane. Each time data is sent and received, the two backplane CANs simultaneously send and receive the same data, and the master and slave CPUs simultaneously send and receive data to the two CAN buses, and the two CPUs merge the received or to-be-sent data and compare them through the two-out-of-two part, and perform the sending and receiving operation when the comparison confirms that the data is consistent; an ultra-long-distance data transmission channel based on CAN-optical-CAN communication is provided, and multiple electromagnetic protection modules are provided to prevent data errors caused by the influence of outdoor electromagnetic environment; the state input and output circuit part is mainly responsible for displaying and collecting the system state; in summary, the present invention provides high-reliability safe data transmission, and when a fault occurs, data is inconsistent, or data logic is not satisfied, it ensures that the communication system is directed to the safety side, and ensures the continuity and reliability of communication.

[0067] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A highly reliable two-out-of-two data communication board, characterized in that: include: A power supply circuit, a backplane communication circuit, a two-out-of-two architecture circuit, an external communication channel circuit, and a status input and output circuit, wherein the power supply circuit includes a main power supply, a backup power supply, a power supply switching module, a safety power supply interface module, and a non-safety power supply interface module, wherein the main power supply and the backup power supply are respectively connected to the power supply switching module, and the power supply switching module is connected to the safety power supply interface module and the non-safety power supply interface module; The backplane communication circuit includes two CAN bus modules, namely a CAN-A bus module and a CAN-B bus module. The CAN-A bus module includes a first electromagnetic protection module connected to the CAN-A bus and two CAN isolation transceivers. The first electromagnetic protection module is connected to the safety CPU-A and the safety CPU-B respectively through the two CAN isolation transceivers; the CAN-B bus module includes a second electromagnetic protection module connected to the CAN-B bus and two CAN isolation transceivers. The second electromagnetic protection module is connected to the safety CPU-A and the safety CPU-B respectively through the two CAN isolation transceivers; The two-out-of-two architecture circuit includes a safety CPU-A, a safety CPU-B, and an isolation resistor arranged between the safety CPU-A and the safety CPU-B; The external communication channel circuit includes two optical communication channels, namely, an external optical communication-A channel and an external optical communication-B channel. The external optical communication-A channel includes a first serial port to isolated RS422 module, an optical communication converter-A and an external optical communication-A connected in sequence, and the first serial port to isolated RS422 module is connected to the safety CPU-A; the external optical communication-B channel includes a second serial port to isolated RS422 module, an optical communication converter-B and an external optical communication-B connected in sequence, and the second serial port to isolated RS422 module is connected to the safety CPU-B; The state input and output circuit includes a state CPU and a front panel LED indicator circuit, the front panel LED indicator circuit is connected to the state CPU, and the state CPU is respectively connected to the safety CPU-A and the safety CPU-B; The safety power interface module is connected to the backplane communication circuit, the two-out-of-two architecture circuit, and the external communication channel circuit respectively, and is used to supply power to the backplane communication circuit, the two-out-of-two architecture circuit, and the external communication channel circuit; the non-safety power interface module is connected to the state input and output circuit, and is used to connect to the state input and output circuit; A third electromagnetic protection module is provided between the first serial port to isolated RS422 module and the second serial port to isolated RS422 module; An electromagnetic protection module A is provided between the main power supply and the power switching module, and an electromagnetic protection module B is provided between the backup power supply and the power switching module.

2. The extremely high reliability two-out-of-two data communication board according to claim 1, characterized in that: The first electromagnetic protection module, the second electromagnetic protection module and the third electromagnetic protection module are all composed of filter capacitors and TVS tubes.

3. The extremely high reliability two-out-of-two data communication board according to claim 1, characterized in that: The first serial port to isolated RS422 module is also connected to the safety CPU-B, and the second serial port to isolated RS422 module is connected to the safety CPU-A.

4. The extremely high reliability two-out-of-two data communication board according to claim 1, characterized in that: The state CPU is also connected to a DIP switch circuit.

Images