A two-out-of-two cross-type safety output method and system based on FPGA

Abstract

The present invention discloses a two-out-of-two crossover safety output method and system based on FPGAs. The output method includes the following steps: synchronizing and comparing the real-time states of the two FPGAs while they are receiving data; if the comparison results are consistent, the two FPGAs respectively generate drive signals and collect the generated drive signals to obtain recovery signals; each FPGA compares the generated drive signal with the corresponding recovery signal; if the signal comparison results are consistent, the two FPGAs perform a state transition; and the steps of synchronizing and comparing the real-time states of the two FPGAs and then transitioning to the state transition are repeated until data reception is confirmed. The present invention fully utilizes the advantages of FPGA multi-tasking parallel processing to monitor the synchronization state of the two FPGAs in real time, and simultaneously detects the state of the recovery signal in real time while outputting PWM waves, thus promptly guiding the system to a safe side in the event of a fault.

Description

Technical Field

[0001] The present invention belongs to the field of rail transportation, and in particular relates to a two-out-of-two crossover safety output method and system based on FPGA. Background Art

[0002] The rapid development of my country's high-speed railways has placed higher demands on the reliability and safety of railway control systems. Currently, the vast majority of safety control systems are computer-controlled. If a system fails to operate properly, it could output dangerous control signals to the controlled equipment, causing casualties and property damage. Therefore, the accuracy and reliability of safety outputs plays a decisive role in the entire control system.

[0003] Safety output boards are safety output boards capable of driving safety relays. Current designs typically utilize an ARM processor to implement a two-out-of-two architecture, coupled with external logic circuitry to implement the two-out-of-two path, output drive, and feedback. This involves numerous interactive links, complex circuitry, and significant system latency. Two identical yet independent processors receive data from the master control unit and compare the data from the two channels in real time. Only when the data from the two channels match will the comparator output information to the downstream output driver circuit. Otherwise, if the data from the two channels is inconsistent or the processor itself malfunctions, the processor cannot output to the downstream module. Furthermore, the output board also features an output driver feedback circuit to ensure output accuracy and safety. This feedback circuit transmits the feedback data to the processor, which then determines and controls the output circuit. The current circuit structure, due to its numerous interactive links, results in processing delays, preventing timely guidance to a safe side in the event of a fault. Summary of the Invention

[0004] In response to the above problems, the present invention adopts a technical solution: a two-out-of-two cross-type secure output method based on FPGA, the output method comprising the following steps:

[0005] Synchronizing and comparing the real-time states of the two FPGAs during the process of the two FPGAs receiving data;

[0006] If the comparison results are consistent, the two FPGAs respectively generate driving signals, and respectively collect the generated driving signals to obtain sampling signals;

[0007] Each of the FPGAs compares the generated drive signal with the corresponding recovery signal;

[0008] If the signal comparison results are consistent, the two FPGAs perform state jump;

[0009] Repeat the steps of synchronizing and comparing the real-time states of the two FPGAs to the step of state jump until the data is confirmed to be received.

[0010] Optionally, after the data reception is completed, the following steps are further included:

[0011] Synchronizing and comparing the states and data of the two FPGAs;

[0012] If the comparison results are consistent, the two FPGAs respectively generate driving signals, and respectively collect the generated driving signals to obtain sampling signals;

[0013] Comparing the driving signal generated by each FPGA with the corresponding recovery signal respectively;

[0014] If the signal comparison results are consistent, each of the FPGAs receives and outputs a driving signal generated by another FPGA.

[0015] Optionally, the output method further includes the following steps:

[0016] If the real-time state comparison results of the two FPGAs are inconsistent, or the real-time state comparison results are consistent but the sampling signal comparison results are inconsistent, the exception handling process is entered.

[0017] Optionally, the process of two FPGAs receiving data includes the following steps:

[0018] Resetting the SBP modules used for communication in the two FPGAs;

[0019] Enter the initialization state;

[0020] Check whether the SBP module has established a link with the IO control board;

[0021] If the SBP module is in the link establishment state, query the frame count in the SBP module receive buffer;

[0022] If the frame count is non-zero, the two FPGAs receive the data frame;

[0023] Comparing the data frames received in the two FPGAs;

[0024] If the data frame comparison results are consistent, the data frame is processed to generate a corresponding response data frame;

[0025] Comparing the response data frames of the two FPGAs;

[0026] If the comparison result of the response data frame is consistent, the response data frame is sent.

[0027] Optionally, after the response data frame is sent, the method further includes the following steps:

[0028] Return to query whether the SBP module has established a link.

[0029] Optionally, the step of querying whether the SBP module has established a link further includes the following steps:

[0030] If the SBP module fails to establish a link and the link time has not expired, it will re-establish the link;

[0031] If the SBP module fails to establish a link and the link time expires, the SBP module is reset.

[0032] Optionally, the step of querying the frame count in the SBP module receiving buffer area further includes the following steps:

[0033] If the frame count is 0, it returns to query whether the SBP module has established a link.

[0034] Optionally, after the step of querying the frame count in the SBP module receiving buffer, the method further includes the following steps:

[0035] Synchronizing states in the two FPGAs;

[0036] If the status is inconsistent, continue to query the frame count in the SBP module receive buffer and record the query times;

[0037] If the status is always inconsistent and the query times reach the upper limit, the exception handling process will be entered.

[0038] Optionally, the step of comparing the data frames further includes the following steps:

[0039] If the data frame comparison times out or the comparison results are inconsistent, the exception handling process will be entered.

[0040] Optionally, the step of comparing the response data frame further includes the following steps:

[0041] If the response data frame comparison times out or the comparison results are inconsistent, the exception handling process is entered.

[0042] Optionally, if the signal comparison result is inconsistent during the process of sending the response data frame, the exception handling process is entered.

[0043] Optionally, in the exception handling process steps, specifically:

[0044] Resetting a module in the FPGA for generating a driving signal and turning off a clock of the module;

[0045] The two FPGAs send error codes to each other and synchronize the error codes;

[0046] Send error status frames through the SBP module to report error information;

[0047] The SBP module is disconnected and down.

[0048] And, a 2-out-of-2 crossover safety output system based on FPGA, comprising two FPGAs disposed on an output mounting board, each of the FPGAs comprising:

[0049] A main control module, used for synchronizing and comparing the real-time states of the two FPGAs during the process of the two FPGAs receiving data;

[0050] a signal generating module, connected to the main control module, and configured to generate a driving signal;

[0051] a signal detection module, connected to the main control module and the signal generation module, and configured to compare the drive signal with the recovery signal;

[0052] A signal recovery module, connected to the signal detection module, for recovering the driving signal to obtain a recovery signal;

[0053] Among them, during the process of synchronizing and comparing the real-time states of the two FPGAs by the main control module; if the comparison results are consistent, the signal generation modules in the two FPGAs respectively generate drive signals, and the signal acquisition modules respectively acquire the generated drive signals to obtain acquisition signals; the signal detection module compares the drive signal generated by each FPGA with the corresponding acquisition signal respectively; if the signal comparison results are consistent, the two FPGAs perform state jump until data reception is completed.

[0054] Optionally, each of the FPGAs further includes a dual-machine synchronization module connected to the main control module, and the dual-machine synchronization modules in the two FPGAs are connected to each other, and the dual-machine synchronization modules synchronize the real-time states of the two FPGAs under the control of the main control module.

[0055] Optionally, each of the FPGAs further includes a signal output module, and the signal output module in each of the FPGAs is connected to the signal generation module in another FPGA; wherein,

[0056] After data reception is completed, the status and data of the two FPGAs are synchronized and compared; if the comparison results are consistent, the signal generation modules in the two FPGAs respectively generate drive signals, and the signal acquisition modules respectively acquire the generated drive signals to obtain acquisition signals; the signal detection module compares the drive signal generated by each FPGA with the corresponding acquisition signal; if the signal comparison results are consistent, the signal output module in each FPGA receives the drive signal generated by the other FPGA and outputs it.

[0057] Optionally, each of the FPGAs further includes an SBP module for communication, the SBP module being connected to the corresponding main control module, the main control module including a state machine; wherein the state machine is configured to perform the following steps:

[0058] Resetting the SBP modules in the two FPGAs;

[0059] Enter the initialization state;

[0060] Check whether the SBP module is linked to the IO control board;

[0061] If the SBP module is in the link establishment state, the SBP module receives the frame count in the buffer area;

[0062] If the frame count is non-zero, the two FPGAs receive the data frame;

[0063] Comparing the data frames received in the two FPGAs;

[0064] If the data frame comparison results are consistent, the data frame is processed to generate a corresponding response data frame;

[0065] Comparing the response data frames of the two FPGAs;

[0066] If the comparison result of the response data frame is consistent, the response data frame is sent.

[0067] Optionally, the state machine is further configured to:

[0068] After the response data frame is sent, it returns to query whether the SBP module has established a link.

[0069] Optionally, the state machine is further configured to enter an exception handling process when the real-time state comparison result of the FPGA is inconsistent or the signal comparison result is inconsistent; wherein the exception handling process includes:

[0070] Resetting the signal generating module and turning off the clock of the signal generating module;

[0071] The two FPGAs send error codes to each other and synchronize the error codes;

[0072] Sending an error status frame to report error information through the SBP module;

[0073] The SBP module is disconnected and shuts down.

[0074] By adopting the above-mentioned technical solution, the present invention has the following beneficial effects: the two FPGAs ensure synchronous software operation through real-time control state synchronization, perform a two-out operation on the received and transmitted data during operation, and only drive the output when the contents are consistent. At the same time, the output drive signal is retrieved in real time. If the two-out operation fails or the retrieved signal is inconsistent, the exception handling process is entered, and the output is directed to the safe side, that is, the output is shut down. Since the two-out-of-two function and the output drive retrieval circuit are both implemented by FPGA, the advantages of FPGA multi-task parallel processing can be fully utilized to monitor the synchronization status of the two FPGAs in real time. At the same time, the status of the retrieval signal is detected in real time while the PWM wave is output, and timely guidance to the safe side is made in the event of a fault. The advantages of FPGA parallel processing and reconfigurability can be fully utilized to improve the real-time performance and flexibility of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0076] Figure 1 Shows the connection relationship and internal module division and connection diagram of two FPGAs according to an embodiment of the present invention;

[0077] Figure 2 A flowchart showing the operation of a state machine according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0078] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0079] The FPGA-based two-out-of-two cross-type safety output system of the embodiment of the present invention includes two FPGAs (Field Programmable Gate Arrays, field programmable logic gate arrays), such as Figure 1 The connection relationship and internal module division and connection diagram of the two FPGAs shown in the figure, each FPGA includes a main control module, a signal generation module, a signal detection module, a signal acquisition module, a dual-machine synchronization module and a signal output module; among them, the main control module is connected to the signal detection module, the signal generation module and the dual-machine synchronization module respectively, the signal acquisition module is connected to the signal detection module, the dual-machine synchronization modules in the two FPGAs are connected to each other, and the signal output module in each FPGA is connected to the signal generation module in the other FPGA.

[0080] Furthermore, each FPGA also includes an SBP module connected to the main control module. The SBP module is logically connected to the SBP module of the IO control board to complete point-to-point reliable full-duplex serial communication.

[0081] The main control module is the core processing module of the FPGA control output circuit. It establishes a local read-write control interface with the SBP module, implementing functions such as initializing the SBP module, querying its status, reading data from the SBP module's receive FIFO, and writing data to the SBP module's transmit FIFO. These functions enable communication with the IO control board. The main control module synchronizes and compares the status of the two FPGAs, received data frames, and reply data frames in real time, achieving a two-out-of-two approach. It also controls the signal generation module to generate drive signals and obtains the signal detection module's retrieved signal, comparing the two and controlling output.

[0082] Specifically, the functions of each module are as follows:

[0083] The dual-machine synchronization module is controlled by the main control module and is used to achieve information exchange with the opposite FPGA to achieve state synchronization. The information that needs to be exchanged includes the operating status of the main control module, received data frames, and sent data frames;

[0084] The signal generation module is used to output the driving signal according to the instructions of the main control module. After the driving signal is generated, it is not output directly, but interlocked between the two FPGAs. The FPGA outputs the driving signal generated by itself to the signal output module of the corresponding FPGA for output;

[0085] The signal acquisition module is used to collect the acquisition signal of the driving signal, wherein the driving signal is a PWM wave signal. The signal acquisition module filters the acquisition signal and outputs it to the signal detection module;

[0086] The signal detection module compares the current drive signal and the sampling signal in real time, and controls whether to shut down the output according to the comparison result;

[0087] The signal output module is used to receive the drive signal from the corresponding FPGA. After the data is received, it decides whether to output the drive signal according to the instructions of the main control module. After the data is received, if the data comparison results are consistent and the comparison results of the acquisition signal and the drive signal are consistent, the drive signal is output to the signal output module of the other FPGA. Through this interactive output method, when an unpredictable error occurs in one FPGA (for example, a clock failure causes it to be unable to shut down the output), the output of the drive signal can be shut down by the other FPGA, thereby achieving safe output.

[0088] In this embodiment, the main control module of the FPGA uses a state machine to implement two-out-of-two. The state machine receives data from the SBP module. After each jump, the state machine must first synchronize the state to ensure the synchronization of the two FPGAs. After receiving the data, it synchronously receives the data and replies to the data, and then checks the current recovery result. It decides whether to crash based on the consistency of the recovery signal and the drive signal.

[0089] The FPGA-based two-out-of-two cross-type safety output method according to an embodiment of the present invention includes the following steps:

[0090] During the process of two FPGAs receiving data, the real-time states of the two FPGAs are synchronized and compared with the received data; if the comparison results are consistent, the two FPGAs respectively generate drive signals according to the received output instruction data, and respectively collect the generated drive signals to obtain sampling signals; each FPGA compares the generated drive signal with the corresponding sampling signal before state jump; if the signal comparison results are consistent, the two FPGAs perform state jump; repeat the above steps until the data is confirmed to be received (confirmation of reception completion includes the completion of data frame sending and confirmation of reception completion replying with a response data frame). The specific steps are as follows: S101 to S109:

[0091] S101: Synchronizing and comparing the real-time states of the two FPGAs during the process of the two FPGAs receiving data;

[0092] S102: If the comparison results are consistent, the two FPGAs respectively generate drive signals according to the output instruction data received from the IO control board, and respectively collect the generated drive signals to obtain sampling signals;

[0093] S103: Each of the FPGAs compares the generated driving signal with the corresponding sampling signal;

[0094] S104: If the signal comparison results are consistent, the two FPGAs perform state jump;

[0095] S105: Repeat steps S101-S104 until the data is confirmed to be received;

[0096] S106: Synchronize and compare the states and data of the two FPGAs;

[0097] S107: If the comparison results are consistent, the two FPGAs respectively generate drive signals according to the output instruction data sent by the IO control board, and respectively collect the generated drive signals to obtain sampling signals;

[0098] S108: Compare the driving signal generated by each FPGA with the corresponding sampling signal respectively;

[0099] S109: If the signal comparison results are consistent, each of the FPGAs receives and outputs a driving signal generated by another FPGA.

[0100] Based on the above embodiment of the safety output system, the main control module of FPGA uses a state machine to implement two-out-of-two, and combines Figure 2 The state machine operation flow chart shown in FIG. 1 shows that in steps S101 to S105 of the safety output method according to the embodiment of the present invention, the operation of the state machine is specifically as follows:

[0101] S201: Reset the SBP module state and enter the initialization state after the reset signal is released;

[0102] S202: Initialization state. Before initialization, the states of the two FPGAs are synchronized. If the states are inconsistent or the states are consistent but the comparison results of the retrieved signals are inconsistent, the exception handling process is entered. Otherwise, step S203 is executed.

[0103] S203: Query whether the SBP module is connected to the SBP module in the IO control board and establishes a link; if the SBP module is in the established link state, execute step S204; if the SBP module is not in the established link, determine whether the connection has timed out (in this embodiment, a query of more than 10 seconds is considered a timeout). If not, continue to query the SBP status. If it has timed out, return to step S201 and try to re-establish the link;

[0104] Before querying, the states of the two FPGAs are first synchronized. If the states are inconsistent or the signal comparison results are inconsistent, the exception handling process is entered. Otherwise, step S203 is executed;

[0105] S204: query the frame count in the SBP module receiving buffer. If the frame count is non-zero, execute step S205; if the frame count is zero, return to execute step S203;

[0106] After the query is completed, the state is synchronized with the other FPGA. If the states are inconsistent, the frame count in the SBP module receive buffer area is continuously queried and the query count is recorded until the frame count states in the two SBP module receive buffer areas are consistent or the query count reaches the upper limit. If the count reaches the upper limit, the exception handling process is entered; if the states are consistent and the retrieved signal comparison is consistent, step S205 or S203 is executed according to the frame count; if the states are consistent but the retrieved signal comparison is inconsistent, the exception handling process is entered;

[0107] S205: Read the data frame in the buffer, read the SBP data register, receive the data frame, and read the end-of-frame flag to determine that one frame has been read;

[0108] S206: Compare data with the corresponding FPGA. If the comparison times out or fails, the exception handling process is entered; if the comparison passes, step S207 is executed.

[0109] S207: Process the data frame status, compose a corresponding response data frame according to the command type of the data frame, and execute step S208; if there is no response data frame, determine whether the recovery signal is consistent with the drive signal. If they are consistent, return to step S203; if they are inconsistent, enter the exception handling process;

[0110] S208: Compare the response data frame and compare the data with the corresponding FPGA. If the comparison times out or the data is inconsistent, the exception handling process is entered. If the comparison results are consistent, but the acquisition results are inconsistent, the exception handling process is entered. Otherwise, the response data frame is sent. If an error occurs in the acquisition during this process, the exception handling process is entered at any time.

[0111] S209: Write the sending buffer of the SBP module and send a response data frame; after writing is completed, detect the comparison result of the retrieved signal. If the retrieved signals are inconsistent, enter the exception handling process; otherwise, enter the query whether the SBP link state is established, and the state machine enters the next cycle.

[0112] The above exception handling process includes the following steps:

[0113] S301: Reset the signal generation module to turn off the clock of the signal generation module of the other FPGA;

[0114] S302: The two FPGAs send error codes to each other and synchronize the error codes;

[0115] S303: Sending an error status frame to report error information to the IO control board through the SBP module;

[0116] S304: The SBP module disconnects the link and performs shutdown processing.

[0117] In this embodiment, the safety output board uses FPGA instead of ARM processor to complete the two-out-of-two operation of data and instructions. At the same time, the output drive control circuit and the output drive recovery circuit are all implemented by FPGA, which simplifies the structure of the board and saves the interactive links of the intermediate circuit. When the recovery results are inconsistent or the operating status of the FPGA fails, the output can be shut down in time, shortening the system's response time and achieving safe output.

[0118] The two FPGAs ensure software synchronization through reset signal handshaking (where each FPGA sends its own reset signal to the other, and each FPGA begins operating after releasing both its own and the other's reset signals simultaneously, ensuring simultaneous operation) and state machine synchronization. During runtime, a two-out operation is performed on the received and transmitted data. Only when the data matches does the output drive proceed. Simultaneously, the output drive signal is retrieved in real time. If the two-out operation fails or the retrieved signals are inconsistent, the system enters the exception handling process and redirects the output to a safe location. Because both the two-out-of-two function and the output drive retrieval circuit are implemented within the FPGA, the advantages of FPGA multitasking and parallel processing are fully utilized to monitor the synchronization status of the two FPGAs in real time. The status of the retrieved signal is also monitored in real time during PWM output, allowing for timely redirection to a safe location in the event of a fault. This leverages the advantages of FPGA parallel processing and reconfigurability, improving the system's real-time performance and flexibility.

[0119] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed as a preferred embodiment as above, it is not intended to limit the present invention. Any technician familiar with this profession can make some changes or modifications to equivalent embodiments of the technical contents disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A two-out-of-two cross-type safety output method based on FPGA, characterized in that: The output method comprises the following steps: Synchronizing and comparing the real-time states of the two FPGAs during the process of the two FPGAs receiving data; If the comparison results are consistent, the two FPGAs respectively generate driving signals, and respectively collect the generated driving signals to obtain sampling signals; Each of the FPGAs compares the generated drive signal with the corresponding recovery signal; If the signal comparison results are consistent, the two FPGAs perform state jump; Repeating the steps of synchronizing and comparing the real-time states of the two FPGAs to the step of state jump until data reception is confirmed to be complete; The process of two FPGAs receiving data includes the following steps: Resetting the SBP modules used for communication in the two FPGAs; Enter the initialization state; Check whether the SBP module has established a link with the IO control board; If the SBP module is in the link establishment state, query the frame count in the SBP module receive buffer; If the frame count is non-zero, the two FPGAs receive the data frame; Comparing the data frames received in the two FPGAs; If the data frame comparison results are consistent, the data frame is processed to generate a corresponding response data frame; Comparing the response data frames of the two FPGAs; If the comparison result of the response data frame is consistent, the response data frame is sent.

2. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, characterized in that: After the data is received, the following steps are also included: Synchronizing and comparing the states and data of the two FPGAs; If the comparison results are consistent, the two FPGAs respectively generate driving signals, and respectively collect the generated driving signals to obtain sampling signals; Comparing the driving signal generated by each FPGA with the corresponding recovery signal respectively; If the signal comparison results are consistent, each of the FPGAs receives and outputs a driving signal generated by another FPGA.

3. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, characterized in that: The output method further comprises the following steps: If the real-time state comparison results of the two FPGAs are inconsistent, or the real-time state comparison results are consistent but the sampling signal comparison results are inconsistent, the exception handling process is entered.

4. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, wherein: After the response data frame is sent, the method further comprises the following steps: Return to query whether the SBP module has established a link.

5. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, characterized in that: The step of querying whether the SBP module has established a link further includes the following steps: If the SBP module fails to establish a link and the link time has not expired, it will re-establish the link; If the SBP module fails to establish a link and the link time expires, the SBP module is reset.

6. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, characterized in that: The step of querying the frame count in the SBP module receiving buffer area further includes the following steps: If the frame count is 0, it returns to query whether the SBP module has established a link.

7. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, wherein: After the step of querying the frame count in the SBP module receiving buffer, the following steps are also included: Synchronizing states in the two FPGAs; If the status is inconsistent, continue to query the frame count in the SBP module receive buffer and record the query times; If the status is always inconsistent and the query times reach the upper limit, the exception handling process will be entered.

8. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, wherein: In the step of comparing the data frames, the following steps are also included: If the data frame comparison times out or the comparison results are inconsistent, the exception handling process will be entered.

9. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, wherein: In the step of comparing the response data frame, the following steps are also included: If the response data frame comparison times out or the comparison results are inconsistent, the exception handling process is entered.

10. The FPGA-based two-out-of-two cross-type safety output method according to claim 1, wherein: If the signal comparison results are inconsistent during the process of sending the response data frame, the exception handling process will be entered.

11. The FPGA-based two-out-of-two crossover safety output method according to any one of claims 4, 7-10, wherein: In the exception handling process steps, specifically: Resetting a module in the FPGA for generating a driving signal and turning off a clock of the module; The two FPGAs send error codes to each other and synchronize the error codes; Send error status frames through the SBP module to report error information; The SBP module is disconnected and down.

12. A two-out-of-two cross-type safety output system based on FPGA, characterized in that: The invention comprises two FPGAs provided on a mounting output board, each of the FPGAs comprising: A main control module, used for synchronizing and comparing the real-time states of the two FPGAs during the process of the two FPGAs receiving data; a signal generating module, connected to the main control module, and configured to generate a driving signal; A signal detection module, connected to the main control module and the signal generation module, for comparing the drive signal and the recovery signal; A signal recovery module, connected to the signal detection module, for recovering the driving signal to obtain a recovery signal; Wherein, during the process of synchronizing and comparing the real-time states of the two FPGAs by the main control module; if the comparison results are consistent, the signal generation modules in the two FPGAs respectively generate drive signals, and the signal collection modules respectively collect the generated drive signals to obtain collection signals; the signal detection module respectively compares the drive signal generated by each FPGA with the corresponding collection signal; if the signal comparison results are consistent, the two FPGAs perform state jump until data reception is completed; Each of the FPGAs further includes an SBP module for communication, the SBP module being connected to the corresponding main control module, the main control module including a state machine; wherein the state machine is configured to perform the following steps: Resetting the SBP modules in the two FPGAs; Enter the initialization state; Check whether the SBP module is linked to the IO control board; If the SBP module is in the link establishment state, the SBP module receives the frame count in the buffer area; If the frame count is non-zero, the two FPGAs receive the data frame; Comparing the data frames received in the two FPGAs; If the data frame comparison results are consistent, the data frame is processed to generate a corresponding response data frame; Comparing the response data frames of the two FPGAs; If the comparison result of the response data frame is consistent, the response data frame is sent.

13. The FPGA-based two-out-of-two crossover safety output system according to claim 12, wherein: Each FPGA further includes a dual-machine synchronization module connected to the main control module, and the dual-machine synchronization modules in the two FPGAs are connected to each other. The dual-machine synchronization modules synchronize the real-time states of the two FPGAs under the control of the main control module.

14. The FPGA-based two-out-of-two crossover safety output system according to claim 12, wherein: Each of the FPGAs further includes a signal output module, and the signal output module in each of the FPGAs is connected to the signal generation module in another FPGA; wherein, After data reception is completed, the status and data of the two FPGAs are synchronized and compared; if the comparison results are consistent, the signal generation modules in the two FPGAs respectively generate drive signals, and the signal acquisition modules respectively acquire the generated drive signals to obtain acquisition signals; the signal detection module compares the drive signal generated by each FPGA with the corresponding acquisition signal; if the signal comparison results are consistent, the signal output module in each FPGA receives the drive signal generated by the other FPGA and outputs it.

15. The FPGA-based two-out-of-two crossover safety output system according to claim 12, wherein: The state machine is also used to: After the response data frame is sent, it returns to query whether the SBP module has established a link.

16. The FPGA-based two-out-of-two crossover safety output system according to claim 12 or 15, characterized in that: The state machine is further configured to enter an exception handling process when the real-time state comparison result of the FPGA is inconsistent or the signal comparison result is inconsistent; wherein the exception handling process includes: Resetting the signal generating module and turning off the clock of the signal generating module; The two FPGAs send error codes to each other and synchronize the error codes; Sending an error status frame to report error information through the SBP module; The SBP module is disconnected and shuts down.

Images