Vehicle-mounted secure digital input and output device and cooperative detection method

Abstract

The application discloses a kind of vehicle-mounted safety digital quantity input and output device and collaborative detection method, it is related to vehicle control technical field, the device includes: first MCU, second MCU, safety digital quantity input module, MCU interaction module and safety digital quantity output module;Cooperative input dynamic detection circuit is used to control the acquisition transmission of safety acquisition circuit to the input digital quantity of first group quantity path according to the first dynamic detection start control signal of first MCU;According to the second dynamic detection start control signal of second MCU, control safety acquisition circuit to the acquisition transmission of input digital quantity of second group quantity path is controlled;Visible, the application utilizes two MCUs of different architecture, by cooperative input dynamic detection circuit, the way of double channel collaborative detection is used to dynamically detect the input digital quantity, avoid the influence of common cause failure of two MCUs on detection accuracy, reduce the configuration cost and board size.

Description

Technical Field

[0001] This invention relates to the field of vehicle control technology, and in particular to an on-board safety digital input / output device and a collaborative detection method for on-board safety digital quantities. Background Technology

[0002] Currently, rail vehicles use dual-channel homogeneous MCUs (Microcontroller Units) to perform a binary comparison between the drive value output from the host computer and the value acquired by the device for onboard safety digital input / output devices. Only if the results match can the output be valid; otherwise, a fault is reported and the data is redirected to the safety side. However, homogeneous MCUs may experience common faults, causing the binary comparison to pass and affecting the detection accuracy of the onboard safety digital input / output devices. Furthermore, each channel is equipped with its own corresponding input dynamic detection circuit components, resulting in high configuration costs and preventing the device from being miniaturized.

[0003] Therefore, improving the detection accuracy of in-vehicle safety digital input / output devices and reducing configuration costs are urgent problems that need to be solved. Summary of the Invention

[0004] The purpose of this invention is to provide an in-vehicle safety digital input / output device and a collaborative detection method for in-vehicle safety digital quantities, so as to improve the detection accuracy of the in-vehicle safety digital input / output device and reduce the configuration cost.

[0005] To address the aforementioned technical problems, this invention provides an in-vehicle safety digital input / output device, comprising: a first MCU, a second MCU, a safety digital input module, an MCU interaction module, and a safety digital output module; wherein the safety digital input module includes a safety acquisition circuit and a collaborative input dynamic detection circuit; and wherein the first MCU and the second MCU employ different architectures.

[0006] The secure acquisition circuit is used to transmit the acquired preset number of input digital values ​​to the first MCU and the second MCU respectively;

[0007] The collaborative input dynamic detection circuit is used to control the acquisition and transmission of the input digital quantity of the first group number channel according to the first dynamic detection start control signal of the first MCU; and to control the acquisition and transmission of the input digital quantity of the second group number channel according to the second dynamic detection start control signal of the second MCU; wherein, the sum of the first group number and the second group number is the preset number;

[0008] The first MCU and the second MCU communicate through the synchronization signal channel of the MCU interaction module, and perform digital quantity detection on the input digital quantities of the first group quantity channel and the second group quantity channel respectively;

[0009] The safety digital output module is used to control the on and off of the safety output relay according to the control of the first MCU and the second MCU. The output digital quantities of the preset number of input digital quantities are converted to preset number of output digital quantities and output to the vehicle controller through the safety output relay.

[0010] In some embodiments, the safety digital output module includes a frequency-locked dynamic drive circuit for controlling the safety output relay to turn on according to the first PWM control signal of the first MCU and the second PWM control signal of the second MCU; wherein the first MCU and the second MCU communicate through the synchronous serial port channel of the MCU interaction module and output the first PWM control signal and the second PWM control signal with opposite phases.

[0011] In some embodiments, the secure digital output module includes a secure output two-stage sampling circuit for acquiring the front-end current and back-end voltage of the secure output relay and outputting them to the first MCU and the second MCU.

[0012] In some embodiments, the preset quantity is an integer multiple of 2, and the number of the first group and the number of the second group are both half of the preset quantity.

[0013] Furthermore, the present invention also provides a collaborative detection method for vehicle safety digital quantities, applied to the vehicle safety digital quantity input / output device as described above, comprising:

[0014] During the process of acquiring the input digital quantities of a preset number of channels, the current MCU determines the current system cycle and the current sampling cycle; wherein, the current MCU is either the first MCU or the second MCU, and the cycle time of the current system cycle is a preset integer multiple of the cycle time of the current sampling cycle;

[0015] Based on the current system cycle and the current sampling cycle, the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit are controlled to perform digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel to obtain the dynamic detection result; wherein, the dynamic detection start control signal is the first dynamic detection start control signal or the second dynamic detection start control signal.

[0016] In some embodiments, controlling the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit according to the current system cycle and the current sampling cycle, and performing digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel to obtain the dynamic detection result includes:

[0017] If the remainder when the current system period is divided by 3 is 0 and the current sampling period is less than or equal to 6, then the dynamic detection start control signal and the synchronization signal are turned on. When the current sampling period is a preset number of periods and the synchronization signal is detected to be in the on state, a preset number of input digital quantities are detected to obtain the dynamic detection result; wherein, the preset number of periods is less than or equal to 6.

[0018] If the remainder when the current system period is divided by 3 is 1 and the current sampling period is less than or equal to 6, then when the current MCU is the first MCU, the dynamic detection start control signal and the synchronization signal are turned on. When the current sampling period is a preset number of periods and the synchronization signal is detected to be on, the input digital quantity of the first group number is detected, and the dynamic detection result is obtained. When the current MCU is the second MCU, the dynamic detection start control signal and the synchronization signal are turned off. When the current sampling period is a preset number of periods and the synchronization signal is detected to be on, the input digital quantity of the first group number is detected, and the dynamic detection result is obtained. Wherein, when the first MCU and / or the second MCU turns on the synchronization signal, the synchronization signal is on; when the first MCU and the second MCU turn off the synchronization signal, the synchronization signal is off.

[0019] If the remainder when the current system period is divided by 3 is 2 and the current sampling period is less than or equal to 6, then when the current MCU is the first MCU, the dynamic detection start control signal and the synchronization signal are turned off. When the current sampling period is a preset number of periods and the synchronization signal is detected to be off, the input digital quantity of the second group number is detected to obtain the dynamic detection result. When the current MCU is the second MCU, the dynamic detection start control signal and the synchronization signal are turned on. When the current sampling period is a preset number of periods and the synchronization signal is detected to be on, the input digital quantity of the second group number is detected to obtain the dynamic detection result.

[0020] If the current sampling period is greater than 6, then the dynamic detection start control signal and the synchronization signal are turned off, and when the synchronization signal is off, the input digital quantity of the preset number of channels is acquired and recorded.

[0021] In some embodiments, after obtaining the dynamic detection result, the method further includes:

[0022] Determine whether the number of erroneous input digital values ​​in the dynamic detection result is greater than the detection threshold;

[0023] If so, the vehicle-mounted safety digital input / output device is set to a shutdown state.

[0024] In some embodiments, after controlling the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit according to the current system cycle and the current sampling cycle, and performing digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel to obtain the dynamic detection result, the method further includes:

[0025] After the current system cycle is completed, the acquisition results of the preset integer corresponding to the current system cycle, the dynamic detection results, and the acquisition results of the two-stage acquisition circuit of the safety output are obtained; wherein, the acquisition results include the front-end current acquisition results and the back-end voltage acquisition results;

[0026] The detection output result is obtained based on the acquisition results, the dynamic detection results, and the re-acquisition results;

[0027] When the detection output result is the same as the detection output result of another MCU of the vehicle safety digital input / output device, the detection output result is output to the vehicle controller.

[0028] In some embodiments, obtaining the detection output result based on the acquisition result, the dynamic detection result, and the re-acquisition result includes:

[0029] Based on the acquisition results and the acquisition results of the other MCU, the sampling detection results and synchronization determination results of the preset number of acquisition bits in the detection output results are obtained.

[0030] In some embodiments, obtaining the detection output result based on the acquisition result, the dynamic detection result, and the re-acquisition result includes:

[0031] If the required state of the relay drive bit corresponding to the current output digital quantity in the front-end current sampling result is continuously no output, then when any sampled value of the front-end current corresponding to the current output digital quantity in the front-end current sampling result is greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit in the detection output result is determined to be mixed-line; when all sampled values ​​of the front-end current corresponding to the current path are not greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; wherein, the current output digital quantity is the output digital quantity of any one of the preset number of output digital quantities of the safety output relay output;

[0032] If the required state of the relay drive bit corresponding to the current path changes from valid output to no output, then if any first target sample value of the front-end current corresponding to the current path is greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be mixed-line; if all the first target sample values ​​corresponding to the current path are not greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; wherein, the first target sample value is the sample value corresponding to no output;

[0033] If the required state of the relay drive bit corresponding to the current path is to continuously output valid, then when all sampled values ​​of the front-end current corresponding to the current path are not all sampled values ​​of the minimum current threshold and there is a sampled value of the minimum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be an abnormal current value; when all sampled values ​​of the front-end current corresponding to the current path are not greater than the minimum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be a short circuit.

[0034] If the required state of the relay drive bit corresponding to the current path changes from "no output" to "output valid", then when any second target sample value of the front-end current corresponding to the current path is greater than the short-circuit protection current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be short-circuit; when all second target sample values ​​of the front-end current corresponding to the current path are not greater than the short-circuit protection current threshold, and any second target sample value is greater than the maximum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be current value abnormal; when all second target sample values ​​of the front-end current corresponding to the current path are not greater than the maximum current value threshold and are all greater than the minimum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; when any second target sample value of the front-end current corresponding to the current path is not greater than the minimum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be current value abnormal; wherein, the second target sample value is the sample value corresponding to the output valid, and the short-circuit protection current threshold is greater than the maximum current value threshold.

[0035] The present invention provides an in-vehicle safety digital input / output device, comprising: a first MCU, a second MCU, a safety digital input module, an MCU interaction module, and a safety digital output module; wherein the safety digital input module includes a safety acquisition circuit and a collaborative input dynamic detection circuit; wherein the first MCU and the second MCU adopt different architectures; the safety acquisition circuit is used to transmit the acquired input digital quantities of a preset number of channels to the first MCU and the second MCU respectively; the collaborative input dynamic detection circuit is used to control the safety acquisition circuit to control the acquisition and transmission of the input digital quantities of a first group of channels according to a first dynamic detection start control signal of the first MCU; according to the second The second dynamic detection start control signal of the MCU controls the safety acquisition circuit to control the acquisition and transmission of the input digital quantities of the second group quantity channel; wherein, the sum of the first group quantity and the second group quantity is a preset quantity; the first MCU and the second MCU communicate through the synchronization signal channel of the MCU interaction module to perform digital quantity detection on the input digital quantities of the first group quantity channel and the second group quantity channel respectively; the safety digital quantity output module is used to control the conduction and disconnection of the safety output relay according to the control of the first MCU and the second MCU, and the output digital quantity of the preset output quantity channel after the input digital quantity of the preset quantity channel is converted is output to the vehicle controller through the safety output relay;

[0036] As can be seen, this invention utilizes a first MCU and a second MCU with different architectures, and employs a dual-channel collaborative detection circuit to dynamically detect the input digital quantity, avoiding the problem of common-cause failures of the first MCU and the second MCU affecting detection accuracy. Furthermore, the collaborative input dynamic detection circuit reduces the consumption of dynamic detection circuit components, lowering configuration costs and board size. In addition, this invention also provides a collaborative detection method for vehicle safety digital quantities, which also possesses the aforementioned beneficial effects. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0038] Figure 1 This is a structural block diagram of an in-vehicle safety digital input / output device provided in an embodiment of the present invention;

[0039] Figure 2 This is a schematic diagram of another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0040] Figure 3 A circuit diagram of a safety acquisition circuit for another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0041] Figure 4 A circuit diagram of a collaborative input dynamic detection circuit for another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0042] Figure 5 A circuit diagram of a safety output relay for another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0043] Figure 6 A circuit diagram of the front-end current sampling circuit of another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0044] Figure 7 A circuit diagram of the front-end current sampling circuit of another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0045] Figure 8 A circuit diagram of the back-end voltage sampling circuit of another vehicle-mounted safety digital input / output device provided in an embodiment of the present invention;

[0046] Figure 9 A flowchart illustrating a collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0047] Figure 10 This is a schematic diagram of a partial collaborative detection process of another collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0048] Figure 11 This is a schematic diagram of a partial collaborative detection process of another collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0049] Figure 12 This is a schematic diagram of a partial collaborative detection process of another collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0050] Figure 13 This is a schematic diagram of a partial collaborative detection process of another collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0051] Figure 14 This is a schematic diagram of the heterogeneous frequency locking principle of another collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0052] Figure 15 This is a schematic diagram of the output digital quantity retrieval process of another collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention;

[0053] Figure 16 This is a structural block diagram of a collaborative detection device for vehicle safety digital quantities provided in an embodiment of the present invention;

[0054] Figure 17 This is a schematic diagram of the structure of a computer-readable storage medium provided in an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Please refer to Figure 1 , Figure 1This is a structural block diagram of an in-vehicle safety digital input / output device provided in an embodiment of the present invention. The device may include: a first MCU 10, a second MCU 20, a safety digital input module 30, an MCU interaction module 40, and a safety digital output module 50; wherein the safety digital input module 30 includes a safety acquisition circuit 31 and a collaborative input dynamic detection circuit 32; and wherein the first MCU 10 and the second MCU 20 employ different architectures.

[0057] The security acquisition circuit 31 is used to transmit the acquired preset number of input digital values ​​to the first MCU10 and the second MCU20 respectively.

[0058] The collaborative input dynamic detection circuit 32 is used to control the security acquisition circuit 31 to control the acquisition and transmission of the input digital quantity of the first group number channel according to the first dynamic detection start control signal of the first MCU 10; and to control the security acquisition circuit 31 to control the acquisition and transmission of the input digital quantity of the second group number channel according to the second dynamic detection start control signal of the second MCU 20; wherein, the sum of the first group number and the second group number is a preset number;

[0059] The first MCU10 and the second MCU20 communicate through the synchronization signal channel of the MCU interaction module 40 to perform digital quantity detection on the input digital quantities of the first group quantity channel and the second group quantity channel respectively.

[0060] The safety digital output module 50 is used to control the on and off of the safety output relay according to the control of the first MCU10 and the second MCU20. The output digital quantities of the preset number of input digital quantities are converted to preset number of output digital quantities and output to the vehicle controller through the safety output relay.

[0061] It is understood that the first MCU10 and the second MCU20 in this embodiment can adopt different architectures to avoid the problem of common cause failures of the first MCU10 and the second MCU20 affecting the detection accuracy, such as... Figure 2As shown, the first MCU10 (MCU_A) can be a TMS (a type of MCU) series MCU chip, and the first MCU10 (MCU_B) can be an SPC (a type of MCU) series MCU chip. The secure digital input module 30 in this embodiment may include a secure acquisition circuit 31 and a collaborative input dynamic detection circuit 32; the secure acquisition circuit 31 is connected to two heterogeneous MCUs (i.e., the first MCU10 and the second MCU20) through dual channels, and each MCU's channel interface acquires a preset number of secure acquisition results, i.e., the preset number of input digital quantities; the collaborative input dynamic detection circuit 32 can provide dynamic detection interfaces for the first and second grouped number of channels for each of the two MCUs, allowing the two MCUs to communicate through the synchronization signal channel of the MCU interaction module 40 (e.g., ...). Figure 2 The synchronous IO semaphore channel negotiates with software to collaboratively complete the dynamic detection function of a preset number of safe acquisition channels.

[0062] Correspondingly, the specific values ​​of the preset quantity, the first group quantity, and the second group quantity in this embodiment can be set by the designer according to the practical scenario and user needs. For example, the preset quantity is a positive integer greater than or equal to 2, the first group quantity and the second group quantity are both positive integers greater than or equal to 1, and the sum of the first group quantity and the second group quantity is the preset quantity. That is, in this embodiment, the input digital quantity of the preset quantity channel is divided into two groups, A and B. The dynamic detection of the A and B groups is controlled by the first MCU10 and the second MCU20 respectively. The acquisition-related pins in the corresponding circuit are set into two groups, A and B, so that the pins within the group are not adjacent, while the pins between the groups can be adjacent. This can prevent the problem of false acquisition caused by pin short circuit by acquiring the A and B groups in a timed manner.

[0063] Correspondingly, when the preset quantity is a multiple of 2, the quantity of the first group and the quantity of the second group are both half of the preset quantity; for example, when the preset quantity is 12, the quantity of the first group and the quantity of the second group can both be 6, such as... Figure 2 As shown, the collaborative input dynamic detection circuit 32 can provide 6 dynamic detection interfaces for each of the two MCUs (MCU_A and MCU_B), enabling the two MCUs to negotiate in software through synchronous IO semaphores and collaboratively complete the dynamic detection function of 12-channel safe acquisition.

[0064] It should be noted that the specific circuit structures of the security acquisition circuit 31 and the collaborative input dynamic detection circuit 32 in this embodiment can be customized by the designer according to the practical scenario and user requirements, such as... Figure 3 As shown, the security acquisition circuit 31 may include a filtering circuit, such as a solid-state relay back-end filtering circuit and a solid-state relay front-end filtering circuit; the solid-state relay back-end filtering circuit may be a low-pass filtering circuit composed of resistors and capacitors, such as... Figure 3 The resistor R24 ​​and capacitor C1 form a low-pass filter circuit with a cutoff frequency of 338Hz; the front-end filter circuit of the solid-state relay can also be a low-pass filter circuit composed of resistors and capacitors, such as... Figure 3 The medium resistor R436 and capacitor C285 form a low-pass filter circuit with a cutoff frequency of 34Hz; for example... Figure 3 As shown, GIO_EXT_A (GIO_EXT_A1 or GIO_EXT_A2) is connected to a 24V signal. When GIO_GND_A is enabled, the solid-state relay (U1) closes, and GIO_IN_A (GIO_IN_A1 or GIO_IN_A2) is pulled up to 24V, which enters the IO board. GIO_IN_A1 forms a low-pass filter circuit (i.e., the front-end filter circuit of the solid-state relay) through R436 and C285, with a cutoff frequency of 34Hz. It forms a voltage divider through R436 and R438 with a gain factor of 10 / 57. After passing through the solid-state relay (U41), it is divided to within 3.3V through R439 and R443, resulting in one input digital quantity (GIO_IN_A1_A and GIO_IN_A1_B) to the two MCUs, realizing safe acquisition by the two MCUs. The safe acquisition circuit 31 can also include a reverse connection protection circuit composed of a transient suppression diode (TVS) and a varistor (RV), such as... Figure 3 As shown, when reversed, the transient suppression diode D9 and the varistor RV1 form a circuit, the resistance of RV1 increases, and the input circuit is cut off, thereby protecting the internal components of the solid-state relay (such as the light-emitting diode LED) from being burned out.

[0065] Correspondingly, such as Figure 4 As shown, DPIN_EN_H (i.e., the first dynamic detection start control signal) and DPIN_EN_L (i.e., the second dynamic detection start control signal) are the enable signals for the dynamic detection start control of groups A and B. When the enable signal is high, the corresponding signals (DPIN_EN_H_A and DPIN_EN_H_B) are pulled low, causing the solid-state relay (U8) to close, which in turn connects the negative terminals of the two acquisition signals (GIO_GND_A and GIO_GND_B) of groups A and B to ground, connecting the acquisition circuit and enabling the acquisition of input digital quantities. When the enable signal is low, the acquisition circuit is disconnected, and the input detection function is enabled.

[0066] Furthermore, the secure digital output module 50 in this embodiment may include a frequency-locked dynamic drive circuit, used to control the safety output relay to conduct according to the first PWM control signal of the first MCU 10 and the second PWM control signal of the second MCU 20, thereby enhancing the security of the digital logic output; wherein, the first MCU 10 and the second MCU 20 communicate through the synchronous serial port channel of the MCU interaction module 40, outputting first PWM control signals and second PWM control signals with opposite phases. That is, the first MCU 10 and the second MCU 20 can interact through the synchronous serial port channel to generate first PWM control signals and second PWM control signals with opposite phases, such as a 500Hz PWM wave, to drive the safety output relay and generate an output digital quantity. Figure 5 and Figure 6 As shown, when PL_PWM1_A (the first PWM control signal) of MCU_A and PL_PWM1_B (the second PWM control signal) of MCU_B are 500Hz PWM control signals with opposite phase, MOSFETs Q11 and Q13 boost the PWM pulses of the two MCUs from 3.5V to 24V. Resistors R319 and R321 can limit the current of the LED driver inside relay U26, and the final output signal RL_COIL_N is -24V. When RL_COIL_N is -24V, RL_EXT_IN1 and RL_EXT_OUT1 of the safety output relay RL1 are turned on to generate a safety output, which is the output digital quantity of the vehicle controller.

[0067] Furthermore, the secure digital output module 50 in this embodiment may also include a two-stage secure output sampling circuit for acquiring the front-end current and back-end voltage of the secure output relay and outputting them to the first MCU10 and the second MCU20. For example, the two-stage secure output sampling circuit may include a front-end current sampling circuit for acquiring the front-end current (i.e., drive current) of the secure output relay and outputting it to the first MCU10 and the second MCU20, and a back-end voltage sampling circuit for acquiring the back-end voltage of the secure output relay and outputting it to the first MCU10 and the second MCU20.

[0068] Correspondingly, such as Figure 7 As shown, the front-end current sampling circuit can be connected with... Figure 5The RL_COIL_1P connection in the middle is the current detection section with amplifier U33 as the core. Resistor R359 converts the current into voltage, U33 amplifies the voltage by 100 times, and resistors R375 and R381 reduce the voltage to within 3.5V before outputting it to two MCUs for AD sampling. RL_AD1_A and RL_AD1_B are connected to MCU_A (i.e., the first MCU10) and MCU_B (i.e., the second MCU20) respectively, so that both channels can obtain the front-end current sampling results.

[0069] like Figure 8 As shown, the back-end voltage feedback circuit can be connected with... Figure 5 The RL_VIN_1 connection in the circuit triggers the voltage sampling circuit centered on the buffer U31. It samples the contact status of the safety output relay. The sampled voltage is 24V, which is reduced to less than 5V by resistors R361 and R363 before entering U31. Then, after being reduced to less than 3.5V by resistors R364 and R365, it is output to two MCUs for status acquisition. RL_IN1_A and RL_IN1_B are connected to MCU_A (i.e., the first MCU10) and MCU_B (i.e., the second MCU20) respectively, so that both channels can obtain the back-end voltage sampling results.

[0070] Correspondingly, the dynamic detection result MCU interaction module 40 may also include a data interaction channel, such as... Figure 2 The SPI (Serial Peripheral Interface) data interaction channel is used to enable the first MCU10 and the second MCU20 to transmit data through the data interaction channel, such as transmitting the detection output result.

[0071] It should be noted that, Figures 3 to 8 The circuit shown is the circuit corresponding to the input safety quantity and output safety quantity of some paths. For the circuits in the safety digital quantity input module 30 and safety digital quantity output module 50 corresponding to the input safety quantity and output safety quantity of other paths, they can be implemented in the same or similar way as the circuit structure described above. This embodiment does not impose any restrictions on this.

[0072] Similarly, the vehicle-mounted safety digital input / output device provided in this embodiment may also include a safety output relay (such as...). Figure 5 The safety output relay circuit shown) and / or the conversion circuit for converting the input digital values ​​of a preset number of channels into the output digital values ​​of a preset number of channels, are not limited in this embodiment.

[0073] In this embodiment, the present invention utilizes a first MCU10 and a second MCU20 with different architectures. Through the collaborative input dynamic detection circuit 32, the input digital quantity is dynamically detected using a dual-channel collaborative detection method. This avoids the problem of the first MCU10 and the second MCU20 experiencing a common cause failure that affects the detection accuracy. Furthermore, the setting of the collaborative input dynamic detection circuit 32 reduces the consumption of dynamic detection circuit components, thereby reducing configuration costs and board size.

[0074] Based on the above embodiments, this invention also provides a collaborative detection method for vehicle-mounted safety digital quantities, enabling dual-channel collaborative detection of input digital quantities. For details, please refer to... Figure 9 , Figure 9 This is a flowchart illustrating a collaborative detection method for vehicle safety digital quantities provided in an embodiment of the present invention. The method is applied to the vehicle safety digital input / output device provided in the above embodiment and may include:

[0075] Step 101: During the process of acquiring the input digital quantities of the preset number of channels, the current MCU determines the current system cycle and the current sampling cycle; wherein, the current MCU is the first MCU or the second MCU, and the cycle time of the current system cycle is a preset integer multiple of the cycle time of the current sampling cycle.

[0076] It is understood that the current MCU in this embodiment can be the first MCU or the second MCU in the above-mentioned vehicle safety digital input / output device. That is, this embodiment is a demonstration of the detection process of one of the MCUs in the dual-channel collaborative detection of the input digital quantity by two MCUs. For the detection process of the other MCU, it can be implemented in the same or similar way as the method provided in this embodiment. This embodiment does not impose any restrictions on this.

[0077] In this embodiment, the current MCU can collect input digital quantities from a preset number of channels according to a preset sampling period, and obtain the corresponding collection results. During the process of collecting input digital quantities from a preset number of channels according to the preset sampling period, it achieves dual-channel collaborative detection of input digital quantities by controlling the synchronization signal in the synchronization signal channel of the MCU interaction module with another MCU. Accordingly, the current MCU can detect the collection results, dynamic detection results, and output digital quantity retrieval results (such as the front-end current retrieval results and back-end voltage retrieval results transmitted by the above-mentioned two-stage retrieval circuit for safe output) according to a preset system cycle (such as anti-jitter and MCU synchronization detection, etc.), and obtain the detection output results that need to be output to the vehicle control.

[0078] Correspondingly, the current system cycle time (i.e., the preset system cycle, such as 100ms) can be a preset integer (e.g., 20) multiple of the current sampling cycle time (i.e., the preset sampling cycle, such as 5ms). For example, the current MCU can use the main task process (executed once every 100ms, low priority) to acquire the detection output results, and use the real-time acquisition process (executed once every 5ms, high priority) to acquire the input digital quantity and perform collaborative dynamic detection. The acquisition results and dynamic detection results acquired by the real-time acquisition process (such as input digital quantity acquisition data and output feedback data) can be stored in the memory area shared with the main task process for use by the main task process. According to the cycle multiple relationship between the two processes, only the latest 20 sets of acquisition results can be saved, and the acquisition data can be analyzed and detected in the main task process (such as anti-shake and MCU synchronization detection) to obtain the detection output results. The data frame format of the input digital quantity acquisition data in the acquisition data is shown in Table 1.

[0079] Table 1 Input Digital Input Data Frame Format

[0080]

[0081]

[0082] Accordingly, in this embodiment, the two MCUs can perform dynamic detection on the input digital quantities of the first group quantity path and the second group quantity path together or separately according to the coordination of the system cycle and the sampling cycle; in this step, the current MCU can determine the detection content of the dynamic detection by determining the cycle number of the current system cycle and the sampling cycle number of the current sampling cycle.

[0083] Step 102: Based on the current system cycle and the current sampling cycle, control the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit to perform digital quantity detection on the input digital quantity of the first group quantity channel and / or the second group quantity channel to obtain the dynamic detection result; wherein, the dynamic detection start control signal is the first dynamic detection start control signal or the second dynamic detection start control signal.

[0084] Understandably, in this step, the current MCU can determine the detection content of dynamic detection based on the determined period number of the current system cycle and the sampling period number of the current sampling cycle. This allows it to control the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit. This enables digital quantity detection of the input digital quantities in the first and / or second group quantity channels, obtaining the dynamic detection results. For example, if the preset quantity is 12, and both the first and second group quantities are 6, the current MCU's acquisition and dynamic detection of the input digital quantities can include four scenarios, as shown in Table 2.

[0085] Table 2.2 Input Digital Acquisition and Collaborative Detection Scenarios, Conditions, and Actions

[0086]

[0087]

[0088] In Table 2, the system cycle is the cycle number of the main task process (i.e., the current system cycle), which increases by 1 every 100ms; the acquisition cycle is the sampling cycle number of the real-time driving acquisition process (i.e., the current sampling cycle), which increases by 1 every 5ms and is cleared to 0 and counted again after the system cycle changes.

[0089] In other words, in this step, the current MCU can activate the dynamic detection start control signal and synchronization signal when the remainder of the current system cycle divided by 3 is 0 (i.e., system cycle % 3 == 0) and the current sampling cycle is less than or equal to 6 (i.e., sampling cycle <= 6). When the current sampling cycle is a preset number of cycles and the synchronization signal is detected as being on, it detects a preset number of input digital quantities to obtain the dynamic detection result; where the preset number of cycles is less than or equal to 6. For example... Figure 11 As shown, the current MCU can enable dynamic detection (i.e., both the first and second MCUs enable dynamic detection) and enable the detection synchronization signal (i.e., the synchronization signal) when the sampling period number of the system cycle is 3 (i.e., the preset number of cycles) and the current input signal is acquired (i.e., 3 <= sampling period <= 4) and the detection synchronization signal is detected to be in the enabled state, and then control the dynamic detection start control signal to be in the enabled state (e.g., high level). That is, both the first dynamic detection start control signal and the second dynamic detection start control signal are in the enabled state, thus enabling dynamic detection of 12 acquisition results.

[0090] Accordingly, when the remainder when the current system cycle is divided by 3 is 1 and the current sampling cycle is less than or equal to 6, if the current MCU is the first MCU, it can turn on the dynamic detection start control signal and the synchronization signal, and when the current sampling cycle is a preset number of cycles and the synchronization signal is detected as being on, it can detect the input digital quantity of the first group number to obtain the dynamic detection result; if the current MCU is the second MCU, it can turn off the dynamic detection start control signal and the synchronization signal, and when the current sampling cycle is a preset number of cycles and the synchronization signal is detected as being on, it can detect the input digital quantity of the first group number to obtain the dynamic detection result; wherein, when the first MCU and / or the second MCU turns on the synchronization signal, the synchronization signal is on; when the first MCU and the second MCU turn off the synchronization signal, the synchronization signal is off. Figure 12 As shown, when the current MCU is MCU_A (i.e., the first MCU), it can enable dynamic detection (i.e., the first MCU enables dynamic detection, and the second MCU disables dynamic detection) and enable the detection synchronization signal when the current MCU is MCU_A (i.e., the first MCU). When 3 <= sampling period <= 4 and the detection synchronization signal is detected as enabled, it controls the first dynamic detection start control signal to be enabled, i.e., the first dynamic detection start control signal is enabled, and the second dynamic detection start control signal is disabled (e.g., low level), thus enabling dynamic detection of the first 6 acquisition results controlled by MCU_A. When the current MCU is MCU_B (i.e., the second MCU), it disables dynamic detection (i.e., the first MCU enables dynamic detection, and the second MCU disables dynamic detection) and disables the detection synchronization signal. When 3 <= sampling period <= 4 and the detection synchronization signal is detected as enabled, it controls the second dynamic detection start control signal to be disabled, i.e., the first dynamic detection start control signal is enabled, and the second dynamic detection start control signal is disabled, thus enabling dynamic detection of the first 6 acquisition results controlled by MCU_A.

[0091] Accordingly, when the current system cycle divided by 3 leaves a remainder of 2 and the current sampling cycle is less than or equal to 6, if the current MCU is the first MCU, it can disable the dynamic detection start control signal and the synchronization signal, and when the current sampling cycle is a preset number of cycles and the synchronization signal is detected as off, it can detect the input digital quantity of the second group and obtain the dynamic detection result; if the current MCU is the second MCU, it can enable the dynamic detection start control signal and the synchronization signal, and when the current sampling cycle is a preset number of cycles and the synchronization signal is detected as on, it can detect the input digital quantity of the second group and obtain the dynamic detection result. For example... Figure 13As shown, when the current MCU is MCU_A, it can disable dynamic detection (i.e., the first MCU disables dynamic detection, and the second MCU enables dynamic detection) and disable the detection synchronization signal when the current MCU is MCU_A and the sampling period number is 3 <= 4 and the detection synchronization signal is detected to be on. Then, it controls the first dynamic detection start control signal to be off, meaning the first dynamic detection start control signal is off and the second dynamic detection start control signal is on, enabling dynamic detection of the last 6 acquisition results controlled by MCU_B. When the current MCU is MCU_B, it disables dynamic detection (i.e., the first MCU disables dynamic detection, and the second MCU enables dynamic detection) and enables the detection synchronization signal. When the current MCU is MCU_B, it controls the second dynamic detection start control signal to be on, meaning both the first and second dynamic detection start control signals are off, enabling dynamic detection of the last 6 acquisition results controlled by MCU_B.

[0092] Correspondingly, when the current sampling period is greater than 6, the dynamic detection start control signal and synchronization signal are turned off, and when the synchronization signal is off, the preset number of input digital values ​​are acquired and recorded. For example... Figure 10 As shown, when the sampling period number of the acquisition cycle is >6, dynamic detection is turned off (i.e., both the first MCU and the second MCU turn off dynamic detection) and the detection synchronization signal is turned off. When the detection synchronization signal is detected to be in the off state, the dynamic detection start control signal is controlled to be in the off state, that is, both the first dynamic detection start control signal and the second dynamic detection start control signal are in the off state, and the 12 acquisition results are recorded.

[0093] Furthermore, in this embodiment, after acquiring the dynamic detection results, the current MCU can also determine whether the number of erroneous input digital quantities in the dynamic detection results exceeds the detection threshold; if so, the on-board safety digital input / output device is set to a shutdown state. Figures 10 to 13 As shown, the current MCU can, after acquiring the dynamic detection results of 12 channels, the first 6 channels, or the last 6 channels, count the number of channels with incorrect input digital values, obtain the corresponding check count, and thus be able to... Figure 10 When the number of checks exceeds 2 (i.e., the detection threshold), the on-board safety digital input / output device (board) is set to a shutdown state, and the corresponding error code is recorded and output to the vehicle controller.

[0094] Furthermore, in this embodiment, when the vehicle-mounted safety digital input / output device includes a frequency-locked dynamic drive circuit, the current MCU can also collaborate with another MCU at the drive layer to drive the dynamic output of digital quantities (i.e., output digital quantities). For example, the current MCU can utilize the aforementioned real-time drive acquisition process to complete the dynamic output drive of digital quantities. For instance, after the host computer (such as the vehicle controller) generates a drive command packet, the current MCU can compare the received drive command packet with another MCU. After the comparison passes, the underlying drive uses the synchronous serial port channel of the MCU interaction module to perform... Figure 14 The command interaction shown is as follows: MCU_A starts a 500Hz timer and sends command "0" to MCU_B via the synchronous serial port channel during an interrupt; after receiving command "0" in the serial port interrupt of MCU_B, it pulls the level low and sends command "1" to MCU_A; after receiving command "1" in the serial port interrupt of MCU_A, it generates a high level, and upon entering the timer interrupt again, it pulls the level low and sends command "2" to MCU_B; after receiving command "2" in the serial port interrupt of MCU_B, it generates a high level and sends command "3" to MCU_A. MCU_A detects the receipt of command "3," indicating that the dual MCU synchronization is normal; otherwise, synchronization fails, and fault handling is initiated. This causes the MCU to output a 500Hz frequency-locked PWM pulse, achieving safe digital output.

[0095] Furthermore, in this embodiment, when the vehicle-mounted safety digital input / output device includes a two-stage safety output sampling circuit, the current MCU can also collect the front-end current and back-end voltage of the safety output relay to obtain the front-end current sampling result and the back-end voltage sampling result. For example... Figure 15 As shown, the current MCU can use the above real-time sampling process to collect the front-end current and back-end voltage of the safety output relay at a preset sampling period (5ms) (i.e., safety digital output feedback). The feedback results (i.e., front-end current feedback results and back-end voltage feedback results) in the acquired data are stored in the memory area shared with the main task process for use by the main task process. According to the cycle multiple relationship between the two processes, only the latest 20 sets of feedback results can be saved. The main task process performs analysis and detection of the acquired data (such as feedback result analysis and fault handling) to obtain the detection output results. The data frame format of the feedback results in the acquired data is shown in Table 3.

[0096] Table 3 Data Frame Format of Data Recovery Results

[0097]

[0098] Furthermore, in this embodiment, after the current system cycle is completed, the current MCU can acquire the acquisition results, dynamic detection results, and the retrieval results of the two-stage retrieval circuit for the current system cycle, which are a preset integer (e.g., 20). The retrieval results include front-end current retrieval results and back-end voltage retrieval results, and the number of retrieval results can also be a preset integer. Based on the acquisition results, dynamic detection results, and retrieval results, a detection output result is obtained. When the detection output result is the same as the detection output result of another MCU in the vehicle safety digital input / output device, the detection output result is output to the vehicle controller. For example, the current MCU can use the above-mentioned main task to analyze and detect the acquisition results, dynamic detection results, and retrieval results acquired within the preset system cycle, obtain the detection output result, and output the detection output result to the vehicle controller when the detection output result is the same as the detection output result of another MCU.

[0099] Correspondingly, the specific method for obtaining the detection output result based on the acquisition results, dynamic detection results, and retrieval results can be set by the designer. For example, if the detection output result includes the acquisition circuit cross-connection monitoring result, the current MCU can obtain the acquisition circuit cross-connection monitoring result in the detection output result based on the dynamic detection result. In other words, the current MCU can use the dynamic detection result to determine whether there is a cross-connection in the digital acquisition circuit or a dynamic detection error. As shown in Table 4, if the dynamic detection results of the first group of quantity channels (channel A) and / or the second group of quantity channels (channel B) are both normal, the current MCU determines that the acquisition circuit cross-connection monitoring result is normal; otherwise, it determines that the acquisition circuit cross-connection monitoring result is faulty.

[0100] Table 4. Criteria and Truth Table for Judging Circuit Misconnections or Dynamic Errors in Data Acquisition Circuits

[0101]

[0102] Correspondingly, when the detection output includes jitter detection results, the current MCU can obtain the jitter detection results from the detection output based on the preset integer acquisition results. In other words, the current MCU can use the acquisition results to determine whether a jitter fault has occurred. As shown in Table 5, when the acquisition result undergoes a 0 to 1 (0->1) flip change, if the number of times the acquisition result becomes 1 after the change is less than the specified threshold, the current MCU determines the jitter detection result as jitter and performs jitter protection. When the acquisition result undergoes a 1 to 0 (1->0) flip change, if the number of times the acquisition result becomes 0 after the change is less than the specified threshold, the current MCU determines the jitter detection result as jitter and performs jitter protection. The current MCU accumulates and counts the number of jitter events that occur in the corresponding acquisition result of each channel since power-on (0->1 jitter and 1->0 jitter are counted together). When the jitter count reaches the specified cumulative count threshold, the current MCU determines the jitter detection result as jitter blocking and performs jitter blocking.

[0103] Table 5 Truth Table of Anti-Shake Principle

[0104]

[0105]

[0106] Correspondingly, when the detection output includes the synchronization judgment result of dual-channel synchronous detection, the current MCU can obtain the sampling detection result and synchronization judgment result of each of the preset number of sampling bits in the detection output result based on its own preset integer acquisition result and the preset integer acquisition result of the other MCU. In other words, the current MCU can use the preset integer acquisition results of the two MCUs to determine whether there is a fault of asynchronous acquisition results. As shown in Table 5, the current MCU can determine the synchronization judgment result and sampling detection result (1 or 0) of the current sampling bit based on the judgment result corresponding to its own current sampling bit acquisition result (such as 0->1 toggle, 1->0 toggle, 0 state and 1 state) and the judgment result corresponding to the current sampling bit acquisition result of the other MCU.

[0107] Table 6. Truth Table for Synchronous Detection

[0108]

[0109]

[0110] Correspondingly, in this embodiment, when the vehicle-mounted safety digital input / output device includes a two-stage safety output sampling circuit, the detection output result can include the front-end current sampling detection result. The current MCU can obtain the drive current monitoring result in the detection output result based on the drive current monitoring result in the sampling result. As shown in Table 7, the current MCU can obtain the drive current monitoring result based on the drive bit status (i.e., required status) of the preset number of drive bits (i.e., relay drive bits) of the safety output relay and the front-end current sampling result of the preset number of output paths, so as to detect fault states such as short circuit, open circuit, cross-connection, and abnormal current value of the drive circuit.

[0111] Table 7 Truth Table of Front-End Current Monitoring

[0112]

[0113]

[0114]

[0115] In other words, if the required state of the relay drive bit corresponding to the current output digital quantity of the current channel in the current front-end current sampling results is continuously no output, and any sampled value of the front-end current corresponding to the current output digital quantity of the current channel in the current front-end current sampling results is greater than the cross-connection alarm current threshold, then the drive current monitoring result of the relay drive bit in the detection output results is determined to be a cross-connection; if all sampled values ​​of the front-end current corresponding to the current channel are not greater than the cross-connection alarm current threshold, then the drive current monitoring result of the relay drive bit corresponding to the current channel is determined to be normal; where the current output digital quantity is any output digital quantity from any of the preset number of output digital quantities of the safety output relay.

[0116] When the required state of the relay drive bit corresponding to the current path changes from output valid to no output, if any first target sample value of the front-end current corresponding to the current path is greater than the line mixing alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be line mixing; if all first target sample values ​​corresponding to the current path are not greater than the line mixing alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; where the first target sample value is the sample value corresponding to no output;

[0117] If the required state of the relay drive bit corresponding to the current path is continuous output valid, and if all sampled values ​​of the front-end current corresponding to the current path are not all sampled values ​​of the minimum current threshold and there is a sampled value of the minimum current threshold, then the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be an abnormal current value; if all sampled values ​​of the front-end current corresponding to the current path are not greater than the minimum current threshold, then the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be a short circuit.

[0118] When the required state of the relay drive bit corresponding to the current path changes from no output to output active, if any second target sampled value of the front-end current corresponding to the current path is greater than the short-circuit protection current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be short-circuit; if all second target sampled values ​​of the front-end current corresponding to the current path are not greater than the short-circuit protection current threshold, and any second target sampled value is greater than the maximum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be current value abnormal; if all second target sampled values ​​of the front-end current corresponding to the current path are not greater than the maximum current threshold and are all greater than the minimum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; if any second target sampled value of the front-end current corresponding to the current path is not greater than the minimum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be current value abnormal; where the second target sampled value is the sampled value corresponding to the output active, and the short-circuit protection current threshold is greater than the maximum current threshold.

[0119] Correspondingly, in this embodiment, when the vehicle-mounted safety digital input / output device includes a two-stage safety output feedback circuit, the detection output result can include the back-end voltage feedback detection result. The current MCU can obtain the back-end voltage feedback detection result in the detection output result based on the back-end voltage feedback result in the feedback result. As shown in Table 8, the current MCU can obtain the back-end voltage feedback detection result based on the drive bit status of the preset number of drive bits of the safety output relay and the back-end voltage feedback result of the preset number of output paths, so as to detect fault states such as incorrect activation or incorrect deactivation of the safety output relay contacts.

[0120] Table 8 Truth Table for Relay Action Monitoring

[0121]

[0122] Understandably, the current MCU can use the main task process to interactively compare the dynamic detection results (i.e., output data packets) it acquires with the detection output results of another MCU, such as through the data interaction channel of the MCU interaction module (e.g., Figure 2The system (SPI data interaction channel) receives the detection output result from another MCU. When the data frames of the two detection output results are completely consistent, it outputs the detection output result to the vehicle controller. The data frame structure of the dynamic detection result can be shown in Table 9.

[0123] Table 9. Description of the data frame structure of the output data packet

[0124]

[0125]

[0126]

[0127] In this embodiment, the present invention utilizes a first MCU and a second MCU with different architectures. Through a collaborative input dynamic detection circuit, the input digital quantity is dynamically detected using a dual-channel collaborative detection method. This avoids the problem of the first MCU and the second MCU having common cause failures affecting the detection accuracy. Furthermore, by setting up a collaborative input dynamic detection circuit, the consumption of dynamic detection circuit components is reduced, thereby lowering the configuration cost and board size.

[0128] Corresponding to the above method embodiments, this invention also provides a collaborative detection device for vehicle safety digital quantities. The collaborative detection device for vehicle safety digital quantities described below and the collaborative detection method for vehicle safety digital quantities described above can be referred to each other.

[0129] Please refer to Figure 16 , Figure 16 This is a structural block diagram of a collaborative detection device for vehicle safety digital quantities provided in an embodiment of the present invention. This collaborative detection device for vehicle safety digital quantities is applied to the current MCU in the vehicle safety digital input / output device provided in the above embodiment, and may include:

[0130] The determination module 100 is used to determine the current system cycle and the current sampling cycle during the process of acquiring the input digital quantities of a preset number of channels; wherein, the current MCU is the first MCU or the second MCU, and the cycle time of the current system cycle is a preset integer multiple of the cycle time of the current sampling cycle;

[0131] The dynamic detection module 200 is used to control the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit according to the current system cycle and the current sampling cycle, to perform digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel, and obtain the dynamic detection result; wherein, the dynamic detection start control signal is the first dynamic detection start control signal or the second dynamic detection start control signal.

[0132] In some embodiments, the dynamic detection module 200 may include:

[0133] The first detection submodule is used to activate the dynamic detection start control signal and synchronization signal if the remainder when the current system period is divided by 3 is 0 and the current sampling period is less than or equal to 6. When the current sampling period is a preset number of periods and the synchronization signal is detected to be in the open state, the module detects the input digital quantity of a preset number of channels and obtains the dynamic detection result. The preset number of periods is less than or equal to 6.

[0134] The second detection submodule is used to, if the remainder when the current system period is divided by 3 is 1 and the current sampling period is less than or equal to 6, then when the current MCU is the first MCU, it turns on the dynamic detection start control signal and the synchronization signal, and when the current sampling period is a preset number of periods and the synchronization signal is detected to be on, it detects the input digital quantity of the first group number and obtains the dynamic detection result; when the current MCU is the second MCU, it turns off the dynamic detection start control signal and the synchronization signal, and when the current sampling period is a preset number of periods and the synchronization signal is detected to be on, it detects the input digital quantity of the first group number and obtains the dynamic detection result; wherein, when the first MCU and / or the second MCU turns on the synchronization signal, the synchronization signal is on; when the first MCU and the second MCU turn off the synchronization signal, the synchronization signal is off.

[0135] The third detection submodule is used to: if the remainder when the current system period is divided by 3 is 2 and the current sampling period is less than or equal to 6, then when the current MCU is the first MCU, disable the dynamic detection start control signal and the synchronization signal, and when the current sampling period is a preset number of periods and the synchronization signal is detected to be off, detect the input digital quantity of the second group number to obtain the dynamic detection result; when the current MCU is the second MCU, enable the dynamic detection start control signal and the synchronization signal, and when the current sampling period is a preset number of periods and the synchronization signal is detected to be on, detect the input digital quantity of the second group number to obtain the dynamic detection result.

[0136] The acquisition submodule is used to disable the dynamic detection start control signal and the synchronization signal if the current sampling period is greater than 6, and to acquire and record the preset number of input digital values ​​when the synchronization signal is off.

[0137] In some embodiments, the dynamic detection module 200 may further include:

[0138] The judgment submodule is used to determine whether the number of erroneous input digital values ​​in the dynamic detection results is greater than the detection threshold;

[0139] The configuration submodule is used to set the vehicle safety digital input / output device to a shutdown state if the value exceeds the detection threshold.

[0140] In some embodiments, the device may further include:

[0141] The sampling and acquisition module is used to acquire the acquisition results of the preset integer corresponding to the current system cycle, the dynamic detection results, and the sampling results of the two-stage sampling circuit of the safety output after the current system cycle is completed; among which, the sampling results include the front-end current sampling results and the back-end voltage sampling results.

[0142] The sampling and detection module is used to obtain detection output results based on the acquisition results, dynamic detection results, and re-acquisition results;

[0143] The comparison output module is used to output the detection output result to the vehicle controller when the detection output result is the same as the detection output result of another MCU of the vehicle safety digital input / output device.

[0144] In some embodiments, the sampling and detection module may include:

[0145] The synchronous detection submodule is used to obtain the sampling detection results and synchronization judgment results of a preset number of sampling bits in the detection output result based on the acquisition results and the acquisition results of another MCU.

[0146] In some embodiments, the sampling and detection module may include:

[0147] The first sampling and detection submodule is used to determine the drive current monitoring result of the relay drive bit in the detection output result as a line mixing if the required state of the relay drive bit corresponding to the current output digital quantity in the back-end voltage sampling result is continuously no output, and if any sampled value of the front-end current corresponding to the current output digital quantity in the back-end voltage sampling result is greater than the line mixing alarm current threshold; and if all sampled values ​​of the front-end current corresponding to the current path are not greater than the line mixing alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined as normal; wherein, the current output digital quantity is any output digital quantity of any path among the preset number of output digital quantities of the safety output relay output;

[0148] The second sampling and detection submodule is used to determine the driving current monitoring result of the relay driving bit corresponding to the current path as a mixed line if the required state of the relay driving bit corresponding to the current path changes from output valid to no output, and any first target sampling value of the front-end current corresponding to the current path is greater than the mixed line alarm current threshold; and to determine the driving current monitoring result of the relay driving bit corresponding to the current path as normal if all first target sampling values ​​corresponding to the current path are not greater than the mixed line alarm current threshold; wherein, the first target sampling value is the sampling value corresponding to no output;

[0149] The third sampling and detection submodule is used to determine the drive current monitoring result of the relay drive bit corresponding to the current path as abnormal if the required state of the relay drive bit corresponding to the current path is continuous output valid, and if all the sampled values ​​of the front-end current corresponding to the current path are not all sampled values ​​of the minimum current threshold and there is a sampled value of the minimum current threshold; and to determine the drive current monitoring result of the relay drive bit corresponding to the current path as short circuit if all the sampled values ​​of the front-end current corresponding to the current path are not greater than the minimum current threshold.

[0150] The fourth sampling and detection submodule is used to determine the drive current monitoring result of the relay drive bit corresponding to the current path as short-circuit if the required state of the relay drive bit corresponding to the current path changes from no output to output valid, and any second target sampled value of the front-end current corresponding to the current path is greater than the short-circuit protection current threshold; if all second target sampled values ​​of the front-end current corresponding to the current path are not greater than the short-circuit protection current threshold, and any second target sampled value is greater than the maximum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be abnormal; if all second target sampled values ​​of the front-end current corresponding to the current path are not greater than the maximum current value threshold and are all greater than the minimum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; if any second target sampled value of the front-end current corresponding to the current path is not greater than the minimum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be abnormal; wherein, the second target sampled value is the sampled value corresponding to the output valid, and the short-circuit protection current threshold is greater than the maximum current value threshold.

[0151] Corresponding to the above method embodiments, this invention also provides a computer-readable storage medium. The computer-readable storage medium described below and the collaborative detection method for vehicle safety digital quantities described above can be referred to in correspondence.

[0152] Please refer to Figure 17 , Figure 17 This is a schematic diagram of a computer-readable storage medium provided in an embodiment of the present invention. The computer-readable storage medium 300 stores a computer program 310, which, when executed by a processor, implements the steps of the collaborative detection method for vehicle safety digital quantities provided in the above-described method embodiment.

[0153] The computer-readable storage medium 300 can specifically be a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other storage medium capable of storing program code.

[0154] In addition, this invention also provides a rail vehicle, including: the on-board safety digital input / output device provided in the above embodiments.

[0155] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the collaborative detection device, computer-readable storage medium, and rail vehicle disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to in the method section.

[0156] The foregoing has provided a detailed description of the in-vehicle safety digital input / output device and the collaborative detection method for in-vehicle safety digital quantities provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims

1. A vehicle-mounted safety digital input / output device, characterized in that, include: The system comprises a first MCU, a second MCU, a secure digital input module, an MCU interaction module, and a secure digital output module; wherein the secure digital input module includes a secure acquisition circuit and a collaborative input dynamic detection circuit; and wherein the first MCU and the second MCU adopt different architectures. The secure acquisition circuit is used to transmit the acquired preset number of input digital values ​​to the first MCU and the second MCU respectively; The collaborative input dynamic detection circuit is used to control the acquisition and transmission of the input digital quantity of the first group number channel according to the first dynamic detection start control signal of the first MCU; and to control the acquisition and transmission of the input digital quantity of the second group number channel according to the second dynamic detection start control signal of the second MCU; wherein, the sum of the first group number and the second group number is the preset number; The first MCU and the second MCU communicate through the synchronization signal channel of the MCU interaction module, and perform digital quantity detection on the input digital quantities of the first group quantity channel and the second group quantity channel respectively; The safety digital output module is used to control the on and off of the safety output relay according to the control of the first MCU and the second MCU. The output digital quantities of the preset number of input digital quantities are converted to preset number of output digital quantities and then output to the vehicle controller through the safety output relay. The digital quantity detection process includes: Using the first MCU and the second MCU, the input digital quantities of the first group quantity channel and the second group quantity channel are dynamically detected together or separately according to the coordination of the current system cycle and the current sampling cycle; wherein, the first MCU or the second MCU determines the detection content of the dynamic detection by determining the cycle number of the current system cycle and the sampling cycle number of the current sampling cycle, and the cycle time of the current system cycle is a preset integer multiple of the cycle time of the current sampling cycle.

2. The vehicle-mounted safety digital input / output device according to claim 1, characterized in that, The safety digital output module includes a frequency-locked dynamic drive circuit, used to control the safety output relay to turn on according to the first PWM control signal of the first MCU and the second PWM control signal of the second MCU; wherein the first MCU and the second MCU communicate through the synchronous serial port channel of the MCU interaction module, and output the first PWM control signal and the second PWM control signal with opposite phases.

3. The vehicle-mounted safety digital input / output device according to claim 1, characterized in that, The secure digital output module includes a two-stage secure output sampling circuit, used to collect the front-end current and back-end voltage of the secure output relay and output them to the first MCU and the second MCU.

4. The vehicle-mounted safety digital input / output device according to claim 1, characterized in that, The preset quantity is an integer multiple of 2, and the number of the first group and the number of the second group are both half of the preset quantity.

5. A collaborative detection method for vehicle-mounted safety digital quantities, characterized in that, The device is applied to the vehicle-mounted safety digital input / output device as described in any one of claims 1 to 4, comprising: During the process of acquiring the input digital quantities of a preset number of channels, the current MCU determines the current system cycle and the current sampling cycle; wherein, the current MCU is either the first MCU or the second MCU, and the cycle time of the current system cycle is a preset integer multiple of the cycle time of the current sampling cycle; Based on the current system cycle and the current sampling cycle, the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit are controlled to perform digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel to obtain the dynamic detection result; wherein, the dynamic detection start control signal is the first dynamic detection start control signal or the second dynamic detection start control signal; The step of performing digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel includes: Using the first MCU and the second MCU, the input digital quantities of the first group number path and the second group number path are dynamically detected together or separately according to the coordination of the current system cycle and the current sampling cycle; wherein, the current MCU determines the detection content of the dynamic detection by determining the cycle number of the current system cycle and the sampling cycle number of the current sampling cycle.

6. The collaborative detection method for vehicle-mounted safety digital quantities according to claim 5, characterized in that, The process involves controlling the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit based on the current system cycle and the current sampling cycle. This process performs digital quantity detection on the input digital quantities of the first and / or second group quantity channels to obtain dynamic detection results, including: If the remainder when the current system period is divided by 3 is 0 and the current sampling period is less than or equal to 6, then the dynamic detection start control signal and the synchronization signal are turned on. When the current sampling period is a preset number of periods and the synchronization signal is detected to be in the on state, a preset number of input digital quantities are detected to obtain the dynamic detection result; wherein, the preset number of periods is less than or equal to 6. If the remainder when the current system period is divided by 3 is 1 and the current sampling period is less than or equal to 6, then when the current MCU is the first MCU, the dynamic detection start control signal and the synchronization signal are turned on. When the current sampling period is a preset number of periods and the synchronization signal is detected to be on, the input digital quantity of the first group number is detected, and the dynamic detection result is obtained. When the current MCU is the second MCU, the dynamic detection start control signal and the synchronization signal are turned off. When the current sampling period is a preset number of periods and the synchronization signal is detected to be on, the input digital quantity of the first group number is detected, and the dynamic detection result is obtained. Wherein, when the first MCU and / or the second MCU turns on the synchronization signal, the synchronization signal is on; when the first MCU and the second MCU turn off the synchronization signal, the synchronization signal is off. If the remainder when the current system period is divided by 3 is 2 and the current sampling period is less than or equal to 6, then when the current MCU is the first MCU, the dynamic detection start control signal and the synchronization signal are turned off. When the current sampling period is a preset number of periods and the synchronization signal is detected to be off, the input digital quantity of the second group number is detected to obtain the dynamic detection result. When the current MCU is the second MCU, the dynamic detection start control signal and the synchronization signal are turned on. When the current sampling period is a preset number of periods and the synchronization signal is detected to be on, the input digital quantity of the second group number is detected to obtain the dynamic detection result. If the current sampling period is greater than 6, then the dynamic detection start control signal and the synchronization signal are turned off, and when the synchronization signal is off, the input digital quantity of the preset number of channels is acquired and recorded.

7. The collaborative detection method for vehicle-mounted safety digital quantities according to claim 6, characterized in that, After obtaining the dynamic detection result, the process further includes: Determine whether the number of erroneous input digital values ​​in the dynamic detection result is greater than the detection threshold; If so, the vehicle-mounted safety digital input / output device is set to a shutdown state.

8. The collaborative detection method for vehicle-mounted safety digital quantities according to claim 5, characterized in that, The process of controlling the synchronization signal in the synchronization signal channel of the MCU interaction module and the dynamic detection start control signal output to the cooperative input dynamic detection circuit according to the current system cycle and the current sampling cycle, performing digital quantity detection on the input digital quantities of the first group quantity channel and / or the second group quantity channel, and obtaining the dynamic detection result, further includes: After the current system cycle is completed, the acquisition results of the preset integer corresponding to the current system cycle, the dynamic detection results, and the acquisition results of the two-stage acquisition circuit of the safety output are obtained; wherein, the acquisition results include the front-end current acquisition results and the back-end voltage acquisition results; Based on the acquisition results, the dynamic detection results, and the re-acquisition results, obtain the detection output results; When the detection output result is the same as the detection output result of another MCU of the vehicle safety digital input / output device, the detection output result is output to the vehicle controller.

9. The collaborative detection method for vehicle-mounted safety digital quantities according to claim 8, characterized in that, The step of obtaining the detection output result based on the acquisition result, the dynamic detection result, and the re-acquisition result includes: Based on the acquisition results and the acquisition results of the other MCU, the sampling detection results and synchronization determination results of the preset number of acquisition bits in the detection output results are obtained.

10. The collaborative detection method for vehicle-mounted safety digital quantities according to claim 8, characterized in that, The step of obtaining the detection output result based on the acquisition result, the dynamic detection result, and the re-acquisition result includes: If the required state of the relay drive bit corresponding to the current output digital quantity in the front-end current sampling result is continuously no output, then when any sampled value of the front-end current corresponding to the current output digital quantity in the front-end current sampling result is greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit in the detection output result is determined to be mixed-line; when all sampled values ​​of the front-end current corresponding to the current path are not greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; wherein, the current output digital quantity is the output digital quantity of any one of the preset number of output digital quantities of the safety output relay output; If the required state of the relay drive bit corresponding to the current path changes from valid output to no output, then if any first target sample value of the front-end current corresponding to the current path is greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be mixed-line; if all the first target sample values ​​corresponding to the current path are not greater than the mixed-line alarm current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; wherein, the first target sample value is the sample value corresponding to no output; If the required state of the relay drive bit corresponding to the current path is to continuously output valid, then when all sampled values ​​of the front-end current corresponding to the current path are not all sampled values ​​of the minimum current threshold and there is a sampled value of the minimum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be an abnormal current value; when all sampled values ​​of the front-end current corresponding to the current path are not greater than the minimum current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be a short circuit. If the required state of the relay drive bit corresponding to the current path changes from "no output" to "output valid", then when any second target sample value of the front-end current corresponding to the current path is greater than the short-circuit protection current threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be short-circuit; when all second target sample values ​​of the front-end current corresponding to the current path are not greater than the short-circuit protection current threshold, and any second target sample value is greater than the maximum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be current value abnormal; when all second target sample values ​​of the front-end current corresponding to the current path are not greater than the maximum current value threshold and are all greater than the minimum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be normal; when any second target sample value of the front-end current corresponding to the current path is not greater than the minimum current value threshold, the drive current monitoring result of the relay drive bit corresponding to the current path is determined to be current value abnormal; wherein, the second target sample value is the sample value corresponding to the output valid, and the short-circuit protection current threshold is greater than the maximum current value threshold.

Images