FPGA-based safe computer redundancy synchronous drive design method

Abstract

The application discloses a kind of based on FPGA's safe computer redundancy synchronous drive design method, comprising the following steps: FPGA1, FPGA2 receive the data information issued by first central processor and second central processor of host computer and decode, constitute redundant communication architecture;System synchronizes first central processor and second central processor, and first central processor transmits to FPGA1 by TSN communication protocol after encoding drive information.This application is responsible for synchronous drive by two circuit devices, for any FPGA1, FPGA2, when in τ1 Time period has not received pre-drive signal factor signal, it indicates that FPGA1, FPGA2 has not received synchronous drive command, then enter alarm state, give up this drive command;When in τ1 Time period receives pre-drive signal factor, then enter drive state, and in drive state then output drive action, this scheme solves the problem of synchronous drive under non-isogenic clock, also ingeniously monitors whether the drive command issued by two central processors is synchronous.

Description

Technical Field

[0001] This invention relates to the field of dual-select safety computers in the rail transit industry, specifically to a FPGA-based safety computer redundancy synchronization drive design method. Background Technology

[0002] FPGA stands for Field-Programmable Gate Array, and includes FPGA1 and FPGA2. Compared to traditional ASICs (Application Specific Integrated Circuits), FPGAs offer advantages such as programmability, flexibility, and reconfigurability. An FPGA contains a large number of programmable logic units and memory units, which can be programmed to implement specific digital logic functions. The working principle of an FPGA is to configure the required logic circuits into the FPGA chip through programming, forming a specific digital circuit system. Compared to ASICs, FPGAs offer greater flexibility and reconfigurability because they can be reused; different functions can be implemented simply by changing the programming code. Furthermore, the design flow for FPGAs is relatively simple, with shorter design time and lower cost. FPGAs are widely used in digital signal processing, computer vision, communications, embedded systems, aerospace, and other fields because they can quickly process large amounts of data and complex algorithms, and feature low power consumption and high reliability. In safety-related fields such as safety information and safety control, 2-out-of-2 or 3-out-of-2 safety computer platforms are frequently used. Rail transit safety computer platforms typically have three basic board units: MPU, DOU, and DIU. The MPU primarily utilizes two core computing units to handle the board's logic processing, data exchange, comparison and voting, safety self-shutdown, and self-diagnosis, and provides the system application programming interface (API) to the application layer; the DOU is responsible for executing driver instructions; and the DIU is responsible for collecting status information.

[0003] Problems with existing technology: Currently, in the secure computer market, the 2-out-of-2 approach is gradually replacing the 3-out-of-2 approach. Taking a 2-out-of-2 secure computer as an example, the DOU driver board votes on two redundant sets of data (synchronous monitoring: also known as time consistency voting; driver instruction voting: also known as driver instruction consistency voting). After the vote passes, the two driver units jointly send drive pulses to drive the hardware relay circuit. While driving, the driver circuit sets up two levels of feedback nodes to determine whether the drive is correct and whether there is a misdrive operation. However, the problem of synchronous drive under non-same-source clocks is not solved, resulting in poor practicality. Therefore, there is an urgent need for an FPGA-based redundant synchronous drive design method for secure computers to solve the above problems.

[0004] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a secure computer redundancy synchronous driver design method based on FPGA to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a secure computer redundancy synchronization driver design method based on FPGA, comprising the following steps: Step 1: FPGA1 and FPGA2 receive and decode data information sent by the first and second central processing units of the host computer, forming a redundant communication architecture. The system synchronizes the first and second central processing units. The first central processing unit encodes the drive information and transmits it to FPGA1 through the TSN communication protocol. Similarly, the second central processing unit encodes the drive information and transmits it to FPGA2 through the TSN communication protocol. Step 2: FPGA1 and FPGA2 interact to drive data and perform synchronization detection and two-out-of-two voting; Step 3: Synchronize the driving state machines of FPGA1 and FPGA2; Step four: Detection of the driving state machine; Step 5: Drive the output.

[0007] Preferably, in step one, the decoding process is divided into two steps. The decoding process of FPGA1 is as follows: The first step is for FPGA1 to combine the local board ID information, local time information, and received data information together, calculate the local 32-bit CRC'm value according to the 32-bit CRC encoding rule, and compare it with the 32-bit CRC'M value in the received data information register. The second step is to replace the local board ID information from the first step with a mask, regenerate a 32-bit CRC'n, and compare it with the 32-bit CRC'M value in the received data information register.

[0008] Preferably, the decoding process of FPGA2 is as follows: The first step is for FPGA2 to combine the local board ID information, local time information, and received data information together, calculate the local 32-bit CRC'm value according to the 32-bit CRC encoding rules, and compare it with the 32-bit CRC'M value in the received data information register.

[0009] The second step is to replace the local board ID information from the first step with a mask, regenerate a 32-bit CRC'n, and compare it with the 32-bit CRC'M value in the received data information register.

[0010] Preferably, in step two, FPGA1 puts the decoded driver data into the internal RAM and assigns 3 system cycles as the lifespan of the driver data. When the next cycle of data arrives, if the unpacking passes, the synchronization detection passes, and the voting passes, the driver data in the internal RAM is updated. If the synchronization detection fails or the voting fails, the lifespan of the driver data in RAM is decremented by "1" and the old value is used to drive the output. When the lifespan of the data in RAM is exhausted, the driver data in RAM will be forcibly flushed with a safety value of "0" so that the driver module does not perform driver output.

[0011] Preferably, the unpacked data is identified as new driving data based on the increasing characteristic of the period sequence number. When either FPGA1 or FPGA2 receives new data, a time window is opened. If the new data from the second FPGA is received within a 5ms time window, the time consistency judgment is passed, and the driver instruction voting is initiated. If the voting passes, the driver will enter the driving phase; if the voting fails, the driver will have an old value with a lifecycle, and if there is no lifecycle, the driver will not drive.

[0012] Preferably, FPGA1 performs a two-out-of-two voting and executes the drive command. When the drive command is "0", the drive state machine of FPGA1 is in an idle state, and the drive module is in a non-driven state. When the drive command is "1", the drive state machines of FPGA1 and FPGA2 enter a pre-drive state. In this state, the pre-drive signal factor is released to inform the remote end of the state machine's current state, and a time window is opened. To receive the pre-drive signal factor from the remote FPGA, for either FPGA1 or FPGA2, when in If no pre-drive signal factor is received within the specified time period, it indicates a communication failure between FPGA1 and FPGA2, or a mismatch in the state transitions of the drive state machines of FPGA1 and FPGA2. In this case, an alarm state is entered, and the drive command is abandoned. If a pre-drive signal factor is received within a certain time period, the system enters the drive state and outputs a drive action while in the drive state.

[0013] Preferably, in the idle state, the drive module is in a non-drive state, that is, the 110V relay is not driven, the drive pulse is sent at 0Hz, and it is determined whether the collected feedback pulse is 0Hz and the 110V relay feedback is 0. State transitions can occur in the following ways: When the determination is: the driver command is 0; the driver feedback is 0, the state machine does not jump; When it is determined that the driver command is 1 and the driver feedback is 0, the state jumps to the pre-drive state. When the determination is: the driver command is 0; the driver feedback is 1, the status jumps to the waiting state; In the pre-drive state, the drive module is in a non-drive state, opening a time window of up to 5ms to wait for the pre-drive signal from the remote end. State transitions can occur in the following ways: If it is determined that no pre-drive signal is received within 5ms, the state machine will not transition; When it is determined that no pre-drive signal is received within 5ms and the drive command is 0, the state machine jumps to the alarm state; When it is determined that no pre-drive signal is received within 5ms, the state machine jumps to the alarm state. When it is determined that feedback indicating the device is already driven is detected within 5ms, the state machine transitions to an error state. When it is determined that a pre-drive signal is detected within 5ms, the state machine jumps to the drive state; In the driving state, the driving module is in the driving state, that is, the 110V relay is driven, the driving pulse is sent at 333KHz, and it is determined whether the collected feedback pulse is 333KHz and the 110V relay feedback is 1. State transitions can occur in the following ways: When the judgment is: the driver instruction is 1, the driver feedback is 1, the state machine does not jump; When the judgment is: the drive instruction is 1 and the drive feedback is 0, the state machine jumps to the alarm state. When the determination is: the driving instruction is 0, the state machine jumps to the idle state; When in the waiting state, the driver module is in a non-driven state. When the driver feedback is detected as 1 for 20ms, the state machine jumps to the error state. When the driver feedback is detected as 1 for less than 20ms (0), the state machine jumps to the idle state. In the alarm state, the drive module is in a non-drive state, which is a level 2 fault. When the timer reaches 20ms, the state machine jumps to the idle state. In an error state, the drive module is in a non-driven state, which is a level 2 fault. When a reset signal is detected, the state machine jumps to the idle state.

[0014] Preferably, in step four, the state machine is checked to see if it follows the one-hot encoding rule. The state register is added bit by bit. If the result is not equal to 1, then the one-hot encoding rule is not followed. Check whether the current state of the driving state machine corresponds to the logic of the current input condition; Judgment method: When DRIVE_CUR and DRIVE_NEXT are in the same state, the current condition is required to only satisfy the condition of staying in the current state. Any other conditions are judged as wrong, indicating that the state machine has not jumped according to the design purpose. If the detection is correct, the secondary drive latch is opened.

[0015] Preferably, in step five, when FPGA1 and FPGA2 both output pulses of the same frequency, the driving circuit will drive the load relay, and FPGA1 and FPGA2 will achieve dual synchronous driving. The hardware will convert the pulses into corresponding voltage values ​​to drive the load relay. During the drive, the drive circuit is equipped with two levels of feedback nodes to determine whether the drive is correct and whether there is a false drive operation. The first level of feedback is a pulse signal to detect whether the pulse sent out by the drive is consistent with the expectation. The second level of feedback is the engagement state of the drive relay.

[0016] The technical effects and advantages provided by the present invention in the above technical solution are as follows: The driver board of this invention uses two word circuit devices for synchronous driving. Each word circuit device has a corresponding MPU board's central processing unit (CPU) that communicates with it. The CPUs of the two MPUs synchronize with each other. FPGA1 and FPGA2 receive synchronization data packets and drive data packets from the CPUs and perform verification and decoding. After successful decoding, the two word circuit devices, under the conditions of meeting synchronization requirements and not timeout, perform a two-out-of-two vote. If the vote passes, the drive command is executed. For either FPGA1 or FPGA2, when... If no pre-drive signal factor is received within the specified time period, it indicates that FPGA1 and FPGA2 have not received the synchronous drive command, and thus enter an alarm state, abandoning the drive command for that period; when in If a pre-drive signal factor is received within a certain time period, the system enters the drive state and outputs a drive action. This solution solves the problem of synchronous drive under non-same-source clocks and also cleverly monitors whether the drive commands issued by the two central processing units are synchronized. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a system block diagram of the present invention.

[0019] Figure 2This is a schematic diagram of the synchronous detection and two-out-of-two voting framework of the present invention.

[0020] Figure 3 This is a timing diagram for the synchronous detection and two-out-of-two voting of the present invention.

[0021] Figure 4 This is the state transition diagram of the driving state machine of the present invention.

[0022] Figure 5 This is a schematic diagram illustrating the normal operation of the driving state machine of the present invention.

[0023] Figure 6 This is a schematic diagram of the fault detection function of the driving state machine of the present invention.

[0024] Figure 7 This is a schematic diagram of the gate bolt of the pulse-driven generator of the present invention.

[0025] Figure 8 This is a schematic diagram of the dual-drive circuit of FPGA1 and FPGA2 of the present invention. Detailed Implementation

[0026] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0027] This invention provides, for example Figures 1 to 8 The illustrated method for designing a secure computer redundancy synchronization driver based on FPGA includes the following steps: Step 1: FPGA1 and FPGA2 receive and decode data information sent by the first and second central processing units of the host computer, forming a redundant communication architecture. The system synchronizes the first and second central processing units. The first central processing unit encodes the drive information and transmits it to FPGA1 through the TSN communication protocol. Similarly, the second central processing unit encodes the drive information and transmits it to FPGA2 through the TSN communication protocol. The decoding process consists of two steps. The decoding process for FPGA1 is as follows: The first step is for FPGA1 to combine the local board ID information, local time information, and received data information together, calculate the local 32-bit CRC'm value according to the 32-bit CRC encoding rule, and compare it with the 32-bit CRC'M value in the received data information register. The second step is to replace the local board ID information from the first step with a mask (FFFF), regenerate a 32-bit CRC'n, and compare it with the 32-bit CRC'M value in the received data information register. The decoding process of FPGA2 is as follows: The first step is for FPGA2 to combine the local board ID information, local time information, and received data information together, calculate the local 32-bit CRC'm value according to the 32-bit CRC encoding rules, and compare it with the 32-bit CRC'M value in the received data information register.

[0028] The second step is to replace the local board ID information from the first step with a mask (FFFF), regenerate a 32-bit CRC'n, and compare it with the 32-bit CRC'M value in the received data information register. Based on the two comparisons above, the decoding results are shown in the table below: Truth table of unpacking and self-test results

[0029] In conclusion, only when the first comparison shows equality and the second comparison shows inequality can it be proven that the comparator is functioning correctly and decoding is successful. Step 2: FPGA1 and FPGA2 interact to drive data and perform synchronization detection and two-out-of-two voting; FPGA1 places the decoded driver data into its internal RAM (Random Access Memory, a type of computer memory used to temporarily store running programs and data) and assigns a driver data lifetime of 3 system cycles (T=3). When the next cycle of data arrives, if unpacking, synchronization detection, and voting pass, the driver data in the internal RAM is updated. If the synchronization detection fails or the voting fails, the lifetime (T) of the driver data in RAM is decremented by "1" and the old value is used to drive the output. When the lifetime of the data in RAM is exhausted, the driver data in RAM is forcibly flushed with a safety value of "0" to prevent the driver module from outputting anything. The unpacked data is identified as new driving data based on the increasing cycle sequence number. When either of the two FPGAs receives new data, a time window is opened. If the new data from the second FPGA is received within a 5ms time window, the time consistency judgment is passed, and the driver instruction voting is initiated. If the voting passes, the driver will enter the driving phase; if the voting fails, the driver will have an old value with a lifecycle, and if there is no lifecycle, the driver will not drive. Step 3: Synchronize the driving state machines of FPGA1 and FPGA2; FPGA1 performs a two-out-of-two voting process and executes the drive command. When the drive command is "0", FPGA1's drive state machine is in the idle state (IDLE), and the drive module is in a non-driven state. When the drive command is "1", the drive state machines of FPGA1 and FPGA2 enter the pre-drive state (PRE). In this state, the pre-drive signal factor (local_drive_pre) is released to inform the remote end of the state machine's current state, and a time window is opened. To receive the pre-drive signal factor (remote_drive_pre) from the remote FPGA, FPGA2 is the remote end for FPGA1; similarly, FPGA1 is the remote end for FPGA2. For either FPGA1 or FPGA2, when... If no pre-drive signal factor (remote_drive_pre) is received within the specified time period, it indicates a potential communication failure between FPGA1 and FPGA2, or a mismatch in the state transitions of the drive state machines of FPGA1 and FPGA2. In this case, an alarm state (WARN) is entered, and the drive command is abandoned. If a pre-drive signal factor (remote_drive_pre) is received within a time period, the system enters the drive state (DRIVE). In the drive state, the drive action is output. This scheme solves the problem of synchronous drive under non-same-source clocks and also cleverly monitors whether the drive commands issued by the two central processing units are synchronized. In the idle state (IDLE), the drive module is in a non-drive state, that is, the 110V relay is not driven, the drive pulse is sent at 0Hz, and it is determined whether the collected feedback pulse is 0Hz and the 110V relay feedback is 0. State transitions can occur in the following ways: When the determination is: the driver command is 0; the driver feedback is 0, the state machine does not jump; When the determination is: the driver command is 1 and the driver feedback is 0, the state jumps to the pre-drive state (PRE); when the determination is: the driver command is 0 and the driver feedback is 1, the state jumps to the waiting state (WAIT). In the pre-drive state (PRE), the drive module is in a non-drive state, opening a time window of up to 5ms to wait for the remote pre-drive signal (remote_pre_drive). State transitions can occur in the following ways: If it is determined that no pre-drive signal (remote_pre_drive) is received within 5ms, the state machine will not transition; When it is determined that no pre-drive signal (remote_pre_drive) is received within 5ms and the drive command is 0, the state machine jumps to the alarm state (WARN). When it is determined that no pre-drive signal (remote_pre_drive) is received within 5ms, the state machine jumps to the alarm state (WARN). When it is determined that the feedback is detected as driven within 5ms, the state machine jumps to the error state (ERROR). When a pre-drive signal is detected within 5ms, the state machine transitions to the drive state. In DRIVE mode, the drive module is in drive mode, which means the 110V relay is driven. The drive pulse is sent at 333KHz, and it is determined whether the collected feedback pulse is 333KHz and the 110V relay feedback is 1. State transitions can occur in the following ways: When the judgment is: the driver instruction is 1, the driver feedback is 1, the state machine does not jump; When the determination is: the drive instruction is 1 and the drive feedback is 0, the state machine jumps to the alarm state (WARN); when the determination is: the drive instruction is 0, the state machine jumps to the idle state (IDLE). In the WAIT state, the driver module is in a non-driven state. When the driver feedback is detected as 1 for 20ms, the state machine jumps to the error state. When the driver feedback is detected as 1 for less than 20ms (0), the state machine jumps to the idle state. In the WARN state, the drive module is in a non-drive state, which is a level 2 fault. When the timer reaches 20ms, the state machine jumps to the idle state. In an error state (ERROR), the drive module is in a non-drive state, which is a level 2 fault. When a reset signal is detected, the state machine jumps to the idle state (IDLE). Step four: The detection mechanism that drives the state machine; Because the driver board requires high security and stability, a monitoring system for the driver state machine was designed. This monitoring system detects the driver state machine and consists of two parts: To check whether the driving state machine follows the one-hot encoding rule, add the bits of the state register. If the sum is not equal to 1, then the one-hot encoding rule is not followed. Check whether the current state (DRIVE_CUR) of the driving state machine corresponds to the logic of the current input condition; Judgment method: When DRIVE_CUR and DRIVE_NEXT (DRIVE_CUR: the current state of the driving state machine; DRIVE_NEXT: the next state of the driving state machine) are both in the same state, the current condition must only satisfy the condition of remaining in the current state. Any other condition is considered incorrect, indicating that the state machine has not transitioned according to its design purpose. If the detection is correct, the secondary driving gate is opened. Figure 4 and Figure 5 As shown; Step 5, drive the output; The drive circuit will drive the load relay only when both FPGA1 and FPGA2 output pulses of the same frequency. FPGA1 and FPGA2 achieve dual synchronous drive. The hardware converts the pulses into corresponding voltage values ​​to drive the load relay. This design uses dynamic pulses to drive the relay, which prevents erroneous operation caused by FPGA1 and FPGA2 having fixed outputs that are constantly high or low, and greatly enhances the safety of the drive system.

[0030] During the drive, the drive circuit is equipped with two levels of feedback nodes to determine whether the drive is correct and whether there is any erroneous drive operation. The first level of feedback is a pulse signal, which detects whether the pulse sent by the drive is consistent with the expectation, because different pulse frequencies and duty cycles affect the power conversion of the drive circuit. The second level of feedback is the engagement state of the drive relay. The engagement state of the second level feedback is a judgment condition that directly reflects whether the drive command has been executed, but the drive relay has an action delay on the order of 10 milliseconds. The pulse feedback of the first level feedback can detect the operating status of the drive generator much faster (on the order of 10 microseconds).

[0031] The driver board of this invention uses two word circuit devices for synchronous driving. Each word circuit device has a corresponding MPU board's central processing unit (CPU) that communicates with it. The CPUs of the two MPUs synchronize with each other. FPGA1 and FPGA2 receive synchronization data packets and drive data packets from the CPUs and perform verification and decoding. After successful decoding, the two word circuit devices, under the conditions of meeting synchronization requirements and not timeout, perform a two-out-of-two vote. If the vote passes, the drive command is executed. For either FPGA1 or FPGA2, when... If no pre-drive signal factor is received within the specified time period, it indicates that FPGA1 and FPGA2 have not received the synchronous drive command, and thus enter an alarm state, abandoning the drive command for that period; when in If a pre-drive signal factor is received within a certain time period, the system enters the drive state and outputs a drive action. This solution solves the problem of synchronous drive under non-same-source clocks and also cleverly monitors whether the drive commands issued by the two central processing units are synchronized. An MPU board is a development board that integrates a microprocessor unit (MPU). It typically includes components such as a CPU, memory, I / O interfaces, and clock. It can be used for the development and testing of embedded systems. MPU boards are often used to develop embedded systems in fields such as industrial control, communication equipment, smart homes, and automotive electronics. Because embedded systems usually require high performance, low power consumption, and high stability, MPU boards typically use microprocessors specifically designed for embedded systems, such as ARM, MIPS, and PowerPC processor architectures, which have high performance and stability.

[0032] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A secure computer redundancy synchronous driver design method based on FPGA, characterized in that, Includes the following steps: Step 1: FPGA1 and FPGA2 receive and decode data information sent by the first and second central processing units of the host computer, forming a redundant communication architecture. The system synchronizes the first and second central processing units. The first central processing unit encodes the drive information and transmits it to FPGA1 through the TSN communication protocol. Similarly, the second central processing unit encodes the drive information and transmits it to FPGA2 through the TSN communication protocol. Step 2: FPGA1 and FPGA2 interact to drive data and perform synchronization detection and two-out-of-two voting; Step 3: Synchronize the driving state machines of FPGA1 and FPGA2; FPGA1 performs a two-out-of-two voting and executes the drive command. When the drive command is "0", the drive state machine of FPGA1 is in an idle state, and the drive module is in a non-driven state. When the drive command is "1", the drive state machines of FPGA1 and FPGA2 enter the pre-drive state. In this state, the pre-drive signal factor is released to inform the remote end of the state machine's current state, and a time window is opened to receive the pre-drive signal factor from the remote FPGA. For either FPGA1 or FPGA2, if the pre-drive signal factor is not received within the time window, it indicates that there is a communication failure between FPGA1 and FPGA2 or that the state transitions of the drive state machines of FPGA1 and FPGA2 are not coordinated. In this case, an alarm state is entered, and the drive command is abandoned. When a pre-drive signal factor is received within the time period, the system enters the drive state and outputs a drive action in the drive state. Step four: Detection of the driving state machine; Step 5: Drive the output.

2. The FPGA-based secure computer redundancy synchronous drive design method according to claim 1, characterized in that, In step one, the decoding process is divided into two steps. The decoding process of FPGA1 is as follows: The first step is for FPGA1 to combine the local board ID information, local time information, and received data information together, calculate the local 32-bit CRC'm value according to the 32-bit CRC encoding rule, and compare it with the 32-bit CRC'M value in the received data information register. The second step is to replace the local board ID information from the first step with a mask, regenerate a 32-bit CRC'n, and compare it with the 32-bit CRC'M value in the received data information register.

3. The FPGA-based secure computer redundancy synchronous drive design method according to claim 2, characterized in that, The decoding process of FPGA2 is as follows: The first step is for FPGA2 to combine the local board ID information, local time information, and received data information together, calculate the local 32-bit CRC'm value according to the 32-bit CRC encoding rule, and compare it with the 32-bit CRC'M value in the received data information register. The second step is to replace the local board ID information from the first step with a mask, regenerate a 32-bit CRC'n, and compare it with the 32-bit CRC'M value in the received data information register.

4. The FPGA-based secure computer redundancy synchronous drive design method according to claim 1, characterized in that, In step two, FPGA1 puts the decoded driver data into its internal RAM and assigns three system cycles as the lifespan of the driver data. When the next cycle of data arrives, if the unpacking, synchronization detection, and voting pass, the driver data in the internal RAM is updated. If the synchronization detection fails or the voting fails, the lifespan of the driver data in RAM is decremented by "1" and the old value is used to drive the output. When the lifespan of the data in RAM is exhausted, the driver data in RAM will be forcibly flushed with a safety value of "0" so that the driver module does not drive the output.

5. The FPGA-based secure computer redundancy synchronous drive design method according to claim 4, characterized in that, Data that passes unpacking is identified as new driver data based on the increasing characteristic of the period sequence number. When either FPGA1 or FPGA2 receives new data, a time window of 5ms is opened. If the new data from the second FPGA is received within the 5ms time window, the time consistency judgment is passed, and the driver instruction voting is initiated. If the voting passes, the driver process begins; if the voting fails, the driver has an old value with a lifecycle, and if there is no lifecycle, the driver is not driven.

6. The FPGA-based secure computer redundancy synchronous drive design method according to claim 1, characterized in that, In the idle state, the drive module is in a non-drive state, that is, the 110V relay is not driven, the drive pulse is sent at 0Hz, and it is determined whether the collected feedback pulse is 0Hz and the 110V relay feedback is 0. State transitions can occur in the following ways: When the determination is: the driver command is 0; the driver feedback is 0, the state machine does not jump; When it is determined that the driver command is 1 and the driver feedback is 0, the state jumps to the pre-drive state. When the determination is: the driver command is 0; When the driver feedback is 1, the state transitions to the waiting state; In the pre-drive state, the drive module is in a non-drive state, opening a time window of up to 5ms to wait for the pre-drive signal from the remote end. State transitions can occur in the following ways: If it is determined that no pre-drive signal is received within 5ms, the state machine will not transition; When it is determined that no pre-drive signal is received within 5ms and the drive command is 0, the state machine jumps to the alarm state; When it is determined that no pre-drive signal is received within 5ms, the state machine jumps to the alarm state. When it is determined that feedback indicating the device is already driven is detected within 5ms, the state machine transitions to an error state. When it is determined that a pre-drive signal is detected within 5ms, the state machine jumps to the drive state; In the driving state, the driving module is in the driving state, that is, the 110V relay is driven, the driving pulse is sent at 333KHz, and it is determined whether the collected feedback pulse is 333KHz and the 110V relay feedback is 1. State transitions can occur in the following ways: When the judgment is: the driver instruction is 1, the driver feedback is 1, the state machine does not jump; When the judgment is: the drive instruction is 1 and the drive feedback is 0, the state machine jumps to the alarm state. When the determination is: the driving instruction is 0, the state machine jumps to the idle state; When in the waiting state, the driver module is in a non-driven state. When the driver feedback is detected as 1 for 20ms, the state machine jumps to the error state. When the driver feedback is detected as 1 for less than 20ms (0), the state machine jumps to the idle state. In the alarm state, the drive module is in a non-drive state, which is a level 2 fault. When the timer reaches 20ms, the state machine jumps to the idle state. In an error state, the drive module is in a non-driven state, which is a level 2 fault. When a reset signal is detected, the state machine jumps to the idle state.

7. The FPGA-based secure computer redundancy synchronous drive design method according to claim 1, characterized in that, In step four, it is checked whether the driving state machine follows the one-hot encoding rule. The state register is added bit by bit. If it is not equal to 1, then it does not follow the one-hot encoding rule. Check whether the current state of the driving state machine corresponds to the logic of the current input condition; Judgment method: When DRIVE_CUR and DRIVE_NEXT are in the same state, the current condition is required to only satisfy the condition of staying in the current state. Any other conditions are judged as wrong, indicating that the state machine has not jumped according to the design purpose. If the detection is correct, the secondary drive latch is opened.

8. The FPGA-based secure computer redundancy synchronous drive design method according to claim 1, characterized in that, In step five, when FPGA1 and FPGA2 both output pulses of the same frequency, the driving circuit will drive the load relay. FPGA1 and FPGA2 achieve dual synchronous driving, and the hardware converts the pulses into corresponding voltage values ​​to drive the load relay. During the driving process, the driving circuit is equipped with two levels of feedback nodes, which are used to determine whether the driving is correct and whether there is any erroneous driving operation. The first-level feedback is a pulse signal, which detects whether the pulse driven out is consistent with the expectation; The secondary feedback indicates the engagement status of the drive relay.

Images