A two-out-of-two system applied to the transponder transmission module

Abstract

The present invention relates to a two-out-of-two system applied to a transponder transmission module, which is characterized in that it includes an input data source for channel A, an input data source for channel B, a channel A module, and a channel B module. In the channel A module, there are an A comparison input terminal (IN), an A comparison output terminal (OUT), the series connection of channel A1 and channel A2, and an A comparison successful output terminal. In the channel B module, there are a B comparison input terminal (IN), a B comparison output terminal (OUT), the series connection of channel B1 and channel B2, and a B comparison successful output terminal. The present invention performs complete dual-channel independent verification and dual-channel joint confirmation, eliminates data errors caused by inconsistent cached data before communication, and increases the security protection for data processing and communication consistency in the modes of hardware status confirmation and software communication. It ensures the consistency of data reception and output in this system.

Description

Technical Field

[0001] The present invention relates to a two-out-of-two system applied to a transponder transmission module. Background Art

[0002] The transponder transmission module is a data processing system for transponder data acquisition, decoding, and transmission. Existing software technology methods mainly include the two-in-one-two mode and the two-in-two-two mode, which have problems in data processing, data verification, and the validity of communication buffer data. For example, Figure 1 and Figure 2 as shown.

[0003] (1) Two-in-one-two mode:

[0004] This mode adopts a two-channel data acquisition mode, one CPU for data processing, and a two-channel communication mode. This mode can achieve data acquisition, but data processing and calculation are all processed by one CPU, and physical redundancy of processing cannot be achieved. In the case of single CPU memory sharing, when the memory address bus is interfered or there is a software memory pointer error, a memory call error may occur, and a CPU failure mode where multiple data areas call the same data area. This situation will occur when data communication reporting processing is performed under insufficient verification, resulting in system errors. The model of this mode is as Figure 1 shown.

[0005] (2) Two-in-two-two mode:

[0006] This mode adopts a two-channel data acquisition, two CPU channels for data processing, and a two-channel output mode. During the processing, software communication mode is used for data exchange, and physical redundancy of data and processing is achieved. The data processing process completes the two-out-of-two process. However, dual-channel verification is not implemented after the data buffer processing process before dual-channel communication, resulting in inconsistent dual-channel data, and the synchronous security data is not output to the receiving party, thus causing system errors. The model of this mode is as Figure 2 shown. Summary of the Invention

[0007] The present invention designs a two-out-of-two system applied to a transponder transmission module, and the technical problems it solves are memory error verification, single CPU memory chaos, and the validity problems of data processing, data verification, and communication buffer data.

[0008] To solve the above-mentioned existing technical problems, the present invention adopts the following solutions:

[0009] A two-out-of-two system applied to a transponder transmission module, comprising an A-channel input data source, a B-channel input data source, an A-channel module, and a B-channel module. In the A-channel module, there are an A comparison input terminal (IN), an A comparison output terminal (OUT), the series connection of channel A1 and channel A2, and an A comparison successful output terminal. In the B-channel module, there are a B comparison input terminal (IN), a B comparison output terminal (OUT), the series connection of channel B1 and channel B2, and a B comparison successful output terminal;

[0010] The input terminal of channel A1 includes two types of data: the A-channel input data source and the result calculated by the B-channel module based on the B-channel input data source; channel A1 outputs the comparison result of the two types of data, and among them, the output result with consistent comparison is input to channel A2 and the A comparison output terminal (OUT), and the output result with inconsistent comparison is input to the A comparison output terminal (OUT);

[0011] The input terminal of channel B1 includes two types of data: the B-channel input data source and the result calculated by the A-channel module based on the A-channel input data source; channel B1 outputs the comparison result of the two types of data, and among them, the output result with consistent comparison is input to channel B2 and the B comparison output terminal (OUT), and the output result with inconsistent comparison is input to the B comparison output terminal (OUT);

[0012] The input terminal of channel A2 further includes the comparison result output from the B comparison output terminal (OUT). The comparison result output from the B comparison output terminal (OUT) enters the input terminal of channel A2 through the A comparison input terminal (IN). Channel A2 compares the comparison result output from the B comparison output terminal (OUT) with the comparison result with consistent output from A1 again. If the comparison is consistent, the final output will be made;

[0013] The input terminal of channel B2 further includes the comparison result output from the A comparison output terminal (OUT). The comparison result output from the A comparison output terminal (OUT) enters the input terminal of channel B2 through the B comparison input terminal (IN). Channel B2 compares the comparison result output from the A comparison output terminal (OUT) with the comparison result with consistent output from B1 again. If the comparison is consistent, the final output will be made.

[0014] Preferably, the result calculated by the B-channel module based on the B-channel input data source includes time mileage information, the second half of the message, and the CRC information of channel A1.

[0015] Preferably, the result calculated by the A-channel module based on the A-channel input data source includes time mileage information, the second half of the message, and the CRC information of channel B1.

[0016] Preferably, channel A2 re - compares the comparison result output from the B comparison output terminal (OUT) with the comparison - consistent result output from A1. If the comparison is inconsistent, the invalid data will be discarded.

[0017] Preferably, channel B2 re - compares the comparison result output from the A comparison output terminal (OUT) with the comparison - consistent result output from B1. If the comparison is inconsistent, the invalid data will be discarded.

[0018] Preferably, the two - out - of - two platform system adopts a dual - channel mode composed of dual CPUs and dual FPGAs, and the platform - layer software is jointly implemented by the CPU and the FPGA.

[0019] Preferably, the platform - layer software can implement one or more of the functions of system self - check, status monitoring, data acquisition, control output, control verification, data verification, channel interaction, and communication management.

[0020] The two - out - of - two system applied to the transponder transmission module has the following beneficial effects:

[0021] (1) The present invention completely checks the two channels separately and jointly confirms the two channels, eliminating the data error of inconsistent cached numbers before communication, and adding security protection for data processing and communication consistency in the mode of hardware status confirmation and software communication. It ensures the consistency of data reception and output in this system.

[0022] (2) The hardware status confirmation of the present invention is a status instruction, without software serial communication, with fast speed reading. After actual measurement, the notification and confirmation between both parties are less than 2 us, without increasing the system operation burden and system delay, and is suitable for reactive systems at the microsecond level and above. Description of the Drawings

[0023] Figure 1 : Schematic diagram of data acquisition in the 2 - 1 - 2 mode of the prior art;

[0024] Figure 2 : Schematic diagram of data acquisition in the 2 - 2 - 2 mode of the prior art;

[0025] Figure 3 : Process block diagram of the two - out - of - two system applied to the transponder transmission module of the present invention;

[0026] Figure 4 : Functional block diagram of the data - processing parallel structure in the present invention;

[0027] Figure 5 : Model block diagram of the series structure in the present invention;

[0028] Figure 6 : Two - out - of - two software architecture diagram of the present invention;

[0029] Figure 7:Flowchart of the single-channel processing process in the present invention;

[0030] Figure 8 :Block diagram of the software platform of the present invention;

[0031] Figure 9 :Internal processing block diagram of the interactive channel in the present invention;

[0032] Figure 10 :Platform control and data flow diagram of the present invention;

[0033] Figure 11 :Flowchart of the system self-check process of the present invention;

[0034] Figure 12 :Flowchart of the window watchdog process of the present invention;

[0035] Figure 13 :Flowchart of the external voltage and clock monitoring process of the present invention;

[0036] Figure 14 :Flowchart of the data acquisition process of the present invention;

[0037] Figure 15 :Flowchart of the output control process of the present invention;

[0038] Figure 16 :Flowchart of the control verification process of the present invention;

[0039] Figure 17 :Flowchart of the CRC32 check process of the present invention;

[0040] Figure 18 :Flowchart of the channel data interaction process of the present invention;

[0041] Figure 19 :Flowchart of the communication management sending process of the present invention;

[0042] Figure 20 :Flowchart of the communication management receiving process of the present invention. Detailed implementation manners

[0043] The following is a further description of the present invention in conjunction with Figures 3 to 20 :

[0044] The platform of the present invention applied to the transponder transmission module adopts a two-out-of-two mode, which can solve the problems of verification memory errors and single-CPU memory chaos. It performs complete dual-channel independent verification and dual-channel joint confirmation, eliminating data errors caused by inconsistent pre-communication cache numbers, and adding security protection for data processing and communication consistency in the hardware status confirmation and software communication mode. It ensures the consistency of data reception and output in the present invention.

[0045] The hardware status confirmation is a status instruction that does not require software serial communication. It has a fast reading speed. After actual measurement, the notification and confirmation between both parties are less than 2 μs, which does not increase the system operation burden or system delay, and is suitable for reactive systems at the microsecond level and above.

[0046] The present invention uses an algorithm mode of jointly verifying software serial communication and hardware status to implement the above functions. Its process block diagram is as Figure 3 shown.

[0047] The two-out-of-two safety platform software architecture ensures the system security through a two-out-of-two design. The system requires fail-safe operation, and in the event of system failure, the system should be in a safe state. The software adopts a two-channel two-out-of-two method: data processing uses a series mode of dual-channel comparison and confirmation, and safety output uses a parallel mode of dual-channel effectiveness to achieve the two-out-of-two safety function.

[0048] As Figure 4 shown in the functional block diagram of the parallel structure, Channel A and Channel B are in parallel, and Channel A and Channel B communicate with each other.

[0049] As Figure 5 shown in the model block diagram of the series structure, it is a series mode with one output and the other in reverse. Channel A and Channel B are in series, and Channel B has two outputs, one of which is in reverse and connected to Channel A.

[0050] Definition of channels: Channel A, Channel B: Independent data acquisition and processing channels. The channels have the following processes: (1) Data acquisition and calculation; (2) Receive the calculation results of the other channel and compare; (3) Communication.

[0051] As Figure 6 shown, the framework definition of the two-out-of-two software architecture diagram:

[0052] (1) Data Source A: The input data source of Channel A.

[0053] (2) Data Source B: The input data source of Channel B.

[0054] (3) A-Data: The result calculated by Channel A based on Data Source A. It includes time mileage information, the second half of the message information, and the CRC information of Channel B.

[0055] (4) B-Data: The result calculated by Channel B based on Data Source B. It includes time mileage information, the second half of the message information, and the CRC information of Channel A.

[0056] (5) A-Result: The result of comparing A-Data and B-Data in Channel A, output in the form of a status.

[0057] (6)B-Result: The result of comparing the A-Data and B-Data in the B channel, output in the form of status.

[0058] (6)OUT: Output of the comparison result status of this channel.

[0059] (7)IN: Output of the comparison result status of the other channel.

[0060] (8)TRUE: The comparison is consistent.

[0061] (9)FALSE: The comparison is inconsistent.

[0062] (10)ResetData: Discard invalid data.

[0063] (11)A-OUT: Output of successful calculation and comparison in the A channel.

[0064] (12)B-OUT: Output of successful calculation and comparison in the B channel.

[0065] The present invention is applied to a two-out-of-two system of a transponder transmission module, including an A-channel input data source, a B-channel input data source, an A-channel module, and a B-channel module. In the A-channel module, there are an A comparison input end IN, an A comparison output end OUT, the series connection of channels A1 and A2, and an A comparison successful output end. In the B-channel module, there are a B comparison input end IN, a B comparison output end OUT, the series connection of channels B1 and B2, and a B comparison successful output end;

[0066] The input end of channel A1 includes two kinds of data: the A-channel input data source and the result calculated by the B-channel module according to the B-channel input data source; channel A1 outputs the comparison result of the two kinds of data, among which the output result of consistent comparison is input to channel A2 and the A comparison output end OUT, and the output result of inconsistent comparison is input to the A comparison output end OUT;

[0067] The input end of channel B1 includes two kinds of data: the B-channel input data source and the result calculated by the A-channel module according to the A-channel input data source; channel B1 outputs the comparison result of the two kinds of data, among which the output result of consistent comparison is input to channel B2 and the B comparison output end OUT, and the output result of inconsistent comparison is input to the B comparison output end OUT;

[0068] The input end of channel A2 further includes the comparison result output from the B comparison output end OUT. The comparison result output from the B comparison output end OUT enters the input end of channel A2 through the A comparison input end IN. Channel A2 compares the comparison result output from the B comparison output end OUT with the result of consistent comparison output by A1 again. If the comparison is consistent, the final output will be made;

[0069] The input end of Channel B2 also includes the comparison result output from the OUT of the A comparison output end. The comparison result output from the OUT of the A comparison output end enters the input end of Channel B2 through the IN of the B comparison input end. Channel B2 compares the comparison result output from the OUT of the A comparison output end with the comparison result that is consistent with the output of B1 again. If the comparison is consistent, the final output will be performed.

[0070] As Figure 7 shown, the software function process description: collect and calculate data information, package and send the data to another channel, and at the same time receive the same information calculated by another channel, receive and verify the success of comparing the message with the time mileage information. After consistency, send the comparison success status to another channel, and wait for the comparison status information sent by another channel. The consistency of the sent and received status proves that the data of another CPU is also compared successfully, and finally confirm the validity.

[0071] As Figure 8 shown, the schematic diagram of software platform module division, the module division of the single-channel CPU function, the module is divided into the platform layer level and the application layer level. The platform layer includes modules such as data reception, system self-check, status monitoring, data verification, and data communication management, which are used to complete functions such as data collection, verification, communication, and self-protection, and can be used to establish standardized modules; the application layer level includes modules such as data processing, logic analysis, channel interaction, and data communication preparation, which are special modules of this system and are used to implement functions such as data collection, processing, logic analysis related to functions, and communication data preparation. The modules at the platform layer level and the application layer level jointly realize the data processing security of this system.

[0072] As Figure 9 shown, the schematic diagram of dual-channel isolated data interaction. To achieve dual-CPU channel isolation, dual-channel dual-FPGA assisted communication processing is adopted. Data (including control) is transmitted through the FPGA in a dual-channel manner at the initiating CPU end. The FPGA feeds back whether the information is completed, and the initiating CPU reads back and verifies whether the FPGA has completely received the data. The transmission process is divided into four functional and data blocks: status control, main buffer, buffer 1, and buffer 2, which are used to complete dual-channel data interaction.

[0073] The two-out-of-two platform system adopts a dual-channel mode composed of dual-CPU and dual-FPGA. The platform layer software is jointly implemented by the CPU and the FPGA, as Figure 10 shown in the control and data flow.

[0074] The software function management is as follows:

[0075] (1) The CPU is responsible for data operation and security management:

[0076] a. Control output: Control the external hardware status according to the timing requirements;

[0077] b. Control verification: Mining verification to identify the effectiveness of the control channel;

[0078] c. Channel interaction: Through the interaction channel established by FPGA, implement the data interaction verification of the dual channels;

[0079] d. Data verification: Establish verification data for various data uses and verify the provided data;

[0080] e. Status monitoring: Identify and respond to the status of the system:

[0081] f. System self-check: During reset and operation, conduct self-checks on the system as needed to identify system errors;

[0082] g. Communication management: Receive data and perform CRC checks on the integrity of the received data: Send data

[0083] (2) FPGA is defined as the external data storage area of the CPU, the data acquisition and identification function, and the input / output status execution component. FPGA is not responsible for application layer software processing and is responsible for the following functions at the platform layer:

[0084] a. Data acquisition: Include the identification and temporary storage of data validity, mark the update flag, add the verification result, and notify the CPU of the data arrival;

[0085] b. Control output: Interface expansion of some output control functions to establish a control channel;

[0086] c. Control verification: Provide the mining of the control output for the CPU to identify the effectiveness of the output channel status and establish a mining channel;

[0087] d. System self-check: After reset, complete the self-check of FPGA itself and the effectiveness check of the data acquisition channel (such as: the decoding effectiveness of the decoding channel).

[0088] e. Channel exchange: Establish a channel for dual-channel data exchange according to the CPU command. The channel adopts the full-duplex mode, and the one-way adopts the synchronous data exchange mode to prevent the asynchronous acquisition deviation during the data exchange process.

[0089] The processing process of the software platform layer is as follows:

[0090] The software platform layer manages the data of the software and hardware interaction and realizes:

[0091] (1) System self-check: Conduct system self-checks when the system starts and regularly. The self-check results are interacted through dual channels. If a single channel fails, the system fails.

[0092] As Figure 11 shown, the self-check description:

[0093] a. After the system starts or resets, self-check the channels and interactively verify the results.

[0094] b. During operation, do not perform self-check on the channels.

[0095] c. Rewrite and read-check the memory, checking each bit.

[0096] d. During operation, perform cyclic redundancy check on the memory data.

[0097] e. The CPU has a function to prevent rewriting of static configuration. During self-check, perform anti-rewrite self-check. In software design, static configuration is defined as software, not data, and use the program process to check for incorrect rewriting in the data area.

[0098] f. When the system starts or resets, perform a flashing self-check on the display lights. Since there is no feedback processing for the display function, use multiple flashes for the check and observe with the naked eye.

[0099] (2) Status monitoring: Use an external module to monitor the system, including the watchdog, voltage, and clock. The external watchdog and power chip complete this function.

[0100] As Figure 12 shown, the watchdog is divided into two modules: interrupt and watchdog management. The interrupt module is responsible for sending trigger pulses, and the management module is responsible for resetting the pulse module. The main program and the interrupt program together complete the external window watchdog function to prevent the program from locking up in the interrupt and the main program.

[0101] Interrupt part: After entering the interrupt function, determine whether the output level is 0. If it is 0, generate a pulse rising edge externally to achieve the output of the watchdog pulse rising edge. No complete watchdog feeding pulse is generated in the interrupt function to prevent the program from locking up within the interrupt function.

[0102] Main program part: After entering the function, determine whether the output level is 1. If it is 1, generate a pulse falling edge externally to achieve the output of the watchdog pulse falling edge. No complete watchdog feeding pulse is generated in the main program part. Use the external watchdog to monitor the implementation of the interrupt function. If it cannot enter the interrupt function, the external watchdog will reset the CPU.

[0103] As Figure 13 shown, the external power chip monitors the output voltage. If the voltage is abnormal, it resets the CPU. The external watchdog monitors the CPU clock. If the watchdog cannot recognize the watchdog pulse, it determines that the CPU has a fault, including clock deviation faults.

[0104] As Figure 14 shown, data acquisition: Collect the input data and put it into a specific buffer for processing.

[0105] As Figure 15As shown, the control output: externally adopts status or pulse control according to requirements.

[0106] As Figure 16 shown, the control verification: resets / regularly identifies the status switching of the status control line to prevent status locking.

[0107] (1) The control verification process performs two status switches to restore the control status to the status before verification; (2) Ensure that both high and low levels have been switched to prevent the status from not being able to be restored and recognized; (3) The external control hardware should be able to filter short-time status switches without changing the output status.

[0108] As Figure 17 shown, the data verification: the dual channels adopt CRC32 verification, and the two channels adopt different verification polynomials. Make the verification result reach the tolerable range. The verification includes data integrity data such as channel-swapped data, acquired data, and communication data.

[0109] As Figure 18 shown, the channel interaction: interact data between the dual channels to make the system data of the dual channels consistent.

[0110] As Figure 19 shown, the communication management: conducts data communication with the outside, the two channels receive interactively, and the dual channels verify the data.

[0111] (1) Sending function: Sends communication data to an external device, triggered by the main program, in interrupt processing mode.

[0112] (2) Receiving function: Receives data from the external device interface, triggered by the main program, in interrupt processing mode, as Figure 20 shown.

[0113] The present invention has been described exemplarily above in conjunction with the accompanying drawings. Obviously, the implementation of the present invention is not limited by the above-mentioned manner. As long as various improvements are made by adopting the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A two-out-of-two system applied to a transponder transmission module, characterized in that: It includes an A-channel input data source, a B-channel input data source, an A-channel module, and a B-channel module. In the A-channel module, there are an A comparison input terminal (IN), an A comparison output terminal (OUT), the series connection of channel A1 and channel A2, and an A comparison successful output terminal. In the B-channel module, there are a B comparison input terminal (IN), a B comparison output terminal (OUT), the series connection of channel B1 and channel B2, and a B comparison successful output terminal; The input terminal of channel A1 includes two types of data: the A-channel input data source and the result calculated by the B-channel module based on the B-channel input data source. Channel A1 outputs the comparison result of the two types of data, where the output result with consistent comparison is input to channel A2 and the A comparison output terminal (OUT), and the output result with inconsistent comparison is input to the A comparison output terminal (OUT); The input terminal of channel B1 includes two types of data: the B-channel input data source and the result calculated by the A-channel module based on the A-channel input data source; Channel B1 outputs the comparison result of the two types of data, where the output result with consistent comparison is input to channel B2 and the B comparison output terminal (OUT), and the output result with inconsistent comparison is input to the B comparison output terminal (OUT); The input terminal of channel A2 also includes the comparison result output from the B comparison output terminal (OUT). The comparison result output from the B comparison output terminal (OUT) enters the input terminal of channel A2 through the A comparison input terminal (IN). Channel A2 compares the comparison result output from the B comparison output terminal (OUT) with the comparison result with consistent output from A1 again. If the comparison is consistent, the final output will be performed; The input terminal of channel B2 also includes the comparison result output from the A comparison output terminal (OUT). The comparison result output from the A comparison output terminal (OUT) enters the input terminal of channel B2 through the B comparison input terminal (IN). Channel B2 compares the comparison result output from the A comparison output terminal (OUT) with the comparison result with consistent output from B1 again. If the comparison is consistent, the final output will be performed.

2. The two-out-of-two system applied to the transponder transmission module according to claim 1, wherein: The result calculated by the B-channel module based on the B-channel input data source includes time mileage information, the second half of the message, and the CRC information of channel A1.

3. The two-out-of-two system applied to the transponder transmission module according to claim 1, wherein: The result calculated by the A-channel module based on the A-channel input data source includes time mileage information, the second half of the message, and the CRC information of channel B1.

4. The two-out-of-two system applied to the transponder transmission module according to claim 1, characterized in that: Channel A2 compares the comparison result output from the B comparison output terminal (OUT) with the comparison result with consistent output from A1 again. If the comparison is inconsistent, the invalid data will be discarded.

5. The two-out-of-two system applied to the transponder transmission module according to claim 1, wherein: Channel B2 compares the comparison result output from the A comparison output terminal (OUT) with the comparison result with consistent output from B1 again. If the comparison is inconsistent, the invalid data will be discarded.

6. The two-out-of-two system applied to the transponder transmission module according to any one of claims 1-5, characterized in that: The two-out-of-two platform system adopts a dual-channel mode composed of dual CPUs and dual FPGAs, and the platform layer software is jointly implemented by the CPU and the FPGA.

7. The two-out-of-two system applied to the transponder transmission module according to claim 6, characterized in that: The platform layer software can implement one or more of multiple functions such as system self-check, status monitoring, data acquisition, control output, control verification, data verification, channel interaction, and communication management.

Images