Safe twinborn core collaboration method and platform

Abstract

The invention relates to a secure twinning core collaboration method and platform, the collaboration method carries out collaboration on two processors through a collaboration state machine, the secure twinning core collaboration platform is used for realizing the secure twinning core method, the secure twinning core collaboration platform comprises the two processors, and the two processors run the same software. The two processors are in communication connection, and synchronous operation and cross mutual inspection are carried out between the two processors through communication. According to the safe twinning core cooperation method and platform, synchronous operation is carried out between two processors, it is ensured that the two processors can be kept in a consistent running state at any time, and the reliability of a system is effectively improved; through synchronization and cross mutual detection, the abnormal condition between the two processors is detected in time, and the safety of the system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of processor collaboration, and in particular to a secure twin core collaboration method and platform. Background Art

[0002] Currently, processors are often required to coordinate processing in complex computing situations, especially for situations with high reliability and safety requirements. For example, the platform door control system of rail transit; the reliability and performance of the platform door control system directly affect the normal operation of the platform door and the safety and punctuality of the train.

[0003] Traditional platform door control systems have problems with low system reliability and fault tolerance, which can easily lead to misjudgment due to interference, affecting the normal operation of the platform door; the control logic is not perfect, and there is a lack of effective redundancy and fault tolerance mechanisms. These problems further limit the ability of platform door control systems to meet higher safety integrity levels. It is a challenge to achieve reliability and fault tolerance of platform door control systems in both hardware and software.

[0004] When implementing redundancy and fault-tolerant mechanisms, how to safely and reliably achieve collaboration between processors and improve safety and reliability has become a technical problem that urgently needs to be solved. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a secure twin core collaboration method and platform to effectively improve the reliability of the system and ensure the security of the system.

[0006] The objective of the present invention is achieved through the following technical solutions:

[0007] A secure twin core collaboration method, wherein the collaboration method collaborates two processors through a collaboration state machine, wherein the states of the collaboration state machine include a start state, an execution state, an end state, and a security state.

[0008] When the state of the cooperative state machine is the start state, the cooperative method performs synchronous operation on the two processors and sets the state of the cooperative state machine to the execution state if no failure occurs;

[0009] When the state of the collaborative state machine is the execution state, the collaborative method first executes the safety task and synchronizes the safety task data, then performs synchronization operation and cross-check on the two processors, and sets the state of the collaborative state machine to the end state if no fault occurs;

[0010] When the state of the cooperative state machine is the end state, the cooperative method performs synchronous operation on the two processors and sets the state of the cooperative state machine to the start state if no failure occurs;

[0011] The collaborative method sets the state of the collaborative state machine to a safe state in the event of a failure;

[0012] When the state of the cooperative state machine is a safe state, the cooperative method executes the task in the safe state.

[0013] Further, the state of the collaborative state machine also includes a ready state;

[0014] When the state of the collaborative state machine is a safe state, the collaborative method further sets the state of the collaborative state machine to a ready state;

[0015] When the state of the collaborative state machine is in the preparation state, the collaborative method performs a preparation operation and sets the state of the collaborative state machine to the start state if no failure occurs;

[0016] The state of the collaborative state machine also includes an initialization state;

[0017] When the state of the collaborative state machine is the initialization state, the collaborative method performs an initialization operation.

[0018] Further, the collaborative method comprises the following steps:

[0019] S1: When the collaborative state machine is in the initialization state, the initialization operation is performed;

[0020] S2: When the state of the collaborative state machine is in the ready state, the preparation operation is performed and fault detection and corresponding collaborative state machine state setting are performed;

[0021] S3: When the state of the cooperative state machine is the start state, the two processors are operated synchronously, and fault detection and corresponding cooperative state machine state setting are performed;

[0022] S4: When the state of the collaborative state machine is the execution state, the safety task is executed first and the safety task data is synchronized. Then, the two processors are synchronized and cross-checked, and fault detection and corresponding collaborative state machine state settings are performed.

[0023] S5: When the state of the cooperative state machine is the end state, the two processors are operated synchronously, and fault detection and corresponding cooperative state machine state setting are performed;

[0024] S6: When the state of the collaborative state machine is a safe state, the task in the safe state is executed and the state of the collaborative state machine is set to a ready state.

[0025] Further, when the result of the fault detection in step S2 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S2 is that no fault occurs, the state of the collaborative state machine is set to a start state;

[0026] When the result of the fault detection in step S3 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S3 is that no fault occurs, the state of the collaborative state machine is set to an execution state;

[0027] The fault detection in step S4 is performed twice, the first fault detection is performed after the safety task is executed, and the second fault detection is performed after the cross-check;

[0028] When the result of the first fault detection in step S4 is that a fault occurs, the state of the collaborative state machine is set to a safe state, and the next step is directly performed;

[0029] When the result of the second fault detection in step S4 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the second fault detection in step S4 is that no fault occurs, the state of the collaborative state machine is set to an end state;

[0030] When the result of the fault detection in step S5 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S5 is that no fault occurs, the state of the collaborative state machine is set to a starting state.

[0031] Further, before setting the state of the collaborative state machine to the ready state in step S6, a state setting judgment is performed first. If the result of the state setting judgment is to enter the ready state, the state of the collaborative state machine is set to the ready state, otherwise the state of the collaborative state machine is set to the safe state;

[0032] The basis for the state setting judgment is whether the user turns on the self-recovery mode. If the user turns on the self-recovery mode, the state of the collaborative state machine is set from the safe state to the ready state, otherwise the state of the collaborative state machine is set to the safe state unchanged.

[0033] Further, the preparation operation includes the following sub-steps:

[0034] (1) Reset the error code;

[0035] (2) Synchronize the two processors;

[0036] Further, the synchronization operation includes the following synchronization steps:

[0037] A. Construct synchronization message;

[0038] B. Send a message;

[0039] C. Determine whether a message sending failure or receiving failure occurs. If a failure occurs, terminate the synchronization operation;

[0040] D. The message transmission success flag is set;

[0041] E. Check the message.

[0042] Further, the sending failure in the synchronization step C is a message sending timeout; the receiving failure in the synchronization step C is a message receiving timeout;

[0043] Before the synchronization step B, it is determined whether the last message was successfully transmitted. If it was not successfully transmitted, a message sequence error occurs and the synchronization operation is terminated.

[0044] A secure twin core collaborative platform is used to implement a secure twin core method, including two processors, the two processors running the same software, the two processors being communicatively connected, and the two processors performing synchronous operations and cross-checking through communication.

[0045] Furthermore, the two processors are respectively a first control chip and a second control chip;

[0046] An input end of the first control chip is electrically connected to a first input circuit, and an output end of the first control chip is electrically connected to a first output circuit;

[0047] The input end of the second control chip is electrically connected to a second input circuit, and the output end of the second control chip is electrically connected to a second output circuit;

[0048] The first input circuit is electrically connected to an input signal terminal, and the input signal terminal is also electrically connected to a second input circuit;

[0049] The first output circuit is electrically connected to an output signal terminal, the output signal terminal is also electrically connected to the second output circuit, and the output signal terminal is electrically connected to an actuator;

[0050] The first control chip controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the second control chip controls whether the second output circuit is turned on according to the signal input by the second input circuit;

[0051] The first control chip sends the signal input by the first input circuit to the second control chip through a synchronous operation;

[0052] The second control chip sends the signal input by the second input circuit to the first control chip through a synchronous operation;

[0053] The first control chip performs a cross-check on a signal input from the first input circuit and a signal sent by the second control chip through synchronous operation to determine whether a fault occurs in the first input circuit and the second input circuit;

[0054] The second control chip performs a cross check on the signal input by the second input circuit and the signal sent by the first control chip through synchronous operation to determine whether the first input circuit and the second input circuit are faulty.

[0055] The beneficial effects of the present invention are:

[0056] By performing synchronization operations between the two processors, it is ensured that the two processors can maintain a consistent operating state at any time, effectively improving the reliability of the system; through synchronization and cross-checking, abnormal situations between the two processors can be detected in time to ensure the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A flowchart of a secure twin core collaboration method;

[0058] Figure 2 A flowchart for synchronous operation;

[0059] Figure 3 Schematic diagram of the mechanism for automatically aligning time points;

[0060] Figure 4 It is a schematic diagram of the structure of a secure twin core collaborative device;

[0061] Figure 5 Developed architecture for PEDC software;

[0062] Figure 6 is a related circuit diagram of the first output circuit and the second output circuit;

[0063] Figure 7 It is a circuit diagram between the first input circuit, the second input circuit and the two processors. DETAILED DESCRIPTION

[0064] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0065] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0066] Embodiment 1:

[0067] like Figures 1 to 4 As shown, a secure twin core collaboration method is provided, wherein the collaboration method collaborates two processors through a collaboration state machine, wherein the states of the collaboration state machine include a start state, an execution state, an end state, and a security state.

[0068] When the state of the cooperative state machine is the start state, the cooperative method performs synchronous operation on the two processors and sets the state of the cooperative state machine to the execution state if no failure occurs;

[0069] When the state of the collaborative state machine is the execution state, the collaborative method first executes the safety task and synchronizes the safety task data, then performs synchronization operation and cross-check on the two processors, and sets the state of the collaborative state machine to the end state if no fault occurs;

[0070] Security tasks refer to programs run by users when the system is running normally.

[0071] When the state of the cooperative state machine is the end state, the cooperative method performs synchronous operation on the two processors and sets the state of the cooperative state machine to the start state if no failure occurs;

[0072] The collaborative method sets the state of the collaborative state machine to a safe state in the event of a failure;

[0073] When the state of the cooperative state machine is a safe state, the cooperative method executes the task in the safe state.

[0074] The state of the collaborative state machine also includes a ready state;

[0075] When the state of the collaborative state machine is a safe state, the collaborative method further sets the state of the collaborative state machine to a ready state;

[0076] When the state of the collaborative state machine is the preparation state, the collaborative method performs a preparation operation and sets the state of the collaborative state machine to the start state if no failure occurs.

[0077] The state of the collaborative state machine also includes an initialization state;

[0078] When the state of the collaborative state machine is the initialization state, the collaborative method performs an initialization operation.

[0079] By performing synchronization operations between the two processors, it is ensured that the two processors can maintain a consistent operating state at any time, effectively improving the reliability of the system; through synchronization and cross-checking, abnormal situations between the two processors can be detected in time to ensure the security of the system.

[0080] The collaborative method comprises the following steps:

[0081] S1: When the collaborative state machine is in the initialization state, the initialization operation is performed;

[0082] S2: When the state of the collaborative state machine is in the ready state, the preparation operation is performed and fault detection and corresponding collaborative state machine state setting are performed;

[0083] The preparation operation includes the following sub-steps:

[0084] (1) Reset the error code;

[0085] (2) Synchronize the two processors;

[0086] When the result of the fault detection in step S2 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S2 is that no fault occurs, the state of the collaborative state machine is set to a start state;

[0087] S3: When the state of the cooperative state machine is the start state, the two processors are operated synchronously, and fault detection and corresponding cooperative state machine state setting are performed;

[0088] When the result of the fault detection in step S3 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S3 is that no fault occurs, the state of the collaborative state machine is set to an execution state;

[0089] S4: When the state of the collaborative state machine is the execution state, the safety task is executed first and the safety task data is synchronized. Then, the two processors are synchronized and cross-checked, and fault detection and corresponding collaborative state machine state settings are performed.

[0090] The fault detection in step S4 is performed twice, the first fault detection is performed after the safety task is executed, and the second fault detection is performed after the cross-check;

[0091] When the result of the first fault detection in step S4 is that a fault occurs, the state of the collaborative state machine is set to a safe state, and the next step is directly performed;

[0092] When the result of the second fault detection in step S4 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the second fault detection in step S4 is that no fault occurs, the state of the collaborative state machine is set to an end state;

[0093] Tasks executed in a safe state refer to programs run by users when the system is not running normally.

[0094] S5: When the state of the cooperative state machine is the end state, the two processors are operated synchronously, and fault detection and corresponding cooperative state machine state setting are performed;

[0095] When the result of the fault detection in step S5 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S5 is that no fault occurs, the state of the collaborative state machine is set to a start state;

[0096] S6: When the state of the collaborative state machine is a safe state, the task in the safe state is executed and the state of the collaborative state machine is set to a ready state.

[0097] In step S6, before setting the state of the collaborative state machine to the ready state, a state setting judgment is performed first. If the result of the state setting judgment is to enter the ready state, the state of the collaborative state machine is set to the ready state, otherwise the state of the collaborative state machine is set to the safe state.

[0098] The basis for the state setting judgment is whether the user turns on the self-recovery mode. If the user turns on the self-recovery mode, the state of the collaborative state machine is set from the safe state to the ready state, otherwise the state of the collaborative state machine is set to the safe state unchanged.

[0099] The execution sequence flow of the program is controlled through the collaborative state machine.

[0100] When a component is created, the state machine is in the initialization state. The user configures the component and allocates the required memory for the component.

[0101] In the execution state, when the user calls the component, the component will automatically execute: synchronization, user security tasks, and cross-checking.

[0102] When a problem occurs during the execution process, it will lead to a safe state, and the component will execute the tasks in the safe state set by the user.

[0103] The synchronization operation is used to achieve synchronization between two processors and task alignment.

[0104] The purpose of the synchronization operation is to align the execution of tasks by the two MCUs to prevent a large time deviation between the contents executed by the two MCUs.

[0105] The synchronization operation includes the following synchronization steps:

[0106] A. Construct synchronization message;

[0107] B. Send a message;

[0108] C. Determine whether a message sending failure or receiving failure occurs. If a failure occurs, terminate the synchronization operation;

[0109] D. The message transmission success flag is set;

[0110] E. Check the message.

[0111] The sending failure in the synchronization step C is a message sending timeout; the receiving failure in the synchronization step C is a message receiving timeout.

[0112] Before the synchronization step B, it is determined whether the last message was successfully transmitted. If it was not successfully transmitted, a message sequence error occurs and the synchronization operation is terminated.

[0113] Figure 2 This is a flowchart of the synchronization module (i.e., synchronization operation) in the component. Each synchronization processor will send and receive information once at a specified time. Timeout means communication failure occurs, leading to safety.

[0114] Before the synchronization operation is performed, one processor sends a synchronization message to another processor and waits for information from the other processor.

[0115] When a processor executes a synchronization module, it will first send synchronization information to another processor, and then wait for information from the other processor, so that the time points can be automatically aligned. (For example: processor 1 runs faster than processor 2, and processor 1 receives data only after processor 2 completes its task and sends data. At this moment, both have completed their tasks. This mechanism can eliminate the problem of inconsistent program time caused by factors such as different processor main frequencies.)

[0116] The cross check is performed by using an exclusive OR operation on each bit of the data obtained by the synchronization operation and the data itself.

[0117] The processor will save the data sent by itself and the data synchronized with another processor. After the synchronization is completed, the data is mutually checked and each bit of the data is XORed. The result is then saved. Users can customize operations based on the results.

[0118] The following table shows the data packets for communication between processors. It can be seen from the table that: 1. It can be used for synchronization and data type communication; 2. It has a message ID (this message ID is the safety task operation cycle of this processor); 3. It contains component state machine information. 4. Application ID, used for the design of multiple safety tasks of users. 5. It has CRC check.

[0119] Table 1 Functional safety components - message content

[0120]

[0121] A secure twin core collaborative platform is used to implement a secure twin core method, including two processors, the two processors running the same software, the two processors being communicatively connected, and the two processors performing synchronous operations and cross-checking through communication.

[0122] The two processors are respectively a first control chip and a second control chip;

[0123] An input end of the first control chip is electrically connected to a first input circuit, and an output end of the first control chip is electrically connected to a first output circuit;

[0124] The input end of the second control chip is electrically connected to a second input circuit, and the output end of the second control chip is electrically connected to a second output circuit;

[0125] The first input circuit is electrically connected to an input signal terminal, and the input signal terminal is also electrically connected to a second input circuit;

[0126] The first output circuit is electrically connected to an output signal terminal, the output signal terminal is also electrically connected to the second output circuit, and the output signal terminal is electrically connected to an actuator;

[0127] The first control chip controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the second control chip controls whether the second output circuit is turned on according to the signal input by the second input circuit;

[0128] The first control chip sends the signal input by the first input circuit to the second control chip through a synchronous operation;

[0129] The second control chip sends the signal input by the second input circuit to the first control chip through a synchronous operation;

[0130] The first control chip performs a cross check (i.e., logic comparison) on a signal input by the first input circuit and a signal sent by the second control chip through synchronous operation to determine whether a fault occurs in the first input circuit and the second input circuit;

[0131] The second control chip performs a cross check on the signal input by the second input circuit and the signal sent by the first control chip through synchronous operation to determine whether the first input circuit and the second input circuit are faulty.

[0132] When the two signals are inconsistent, a fault alarm mechanism is triggered, for example, one of the valid signals of the two signals is judged to be in a fault state.

[0133] The first output circuit and the second output circuit are connected in series and then electrically connected to the output signal terminal.

[0134] Since the first output circuit and the second output circuit are connected in series, after both the first output circuit and the second output circuit are turned on, the output circuit is in a conductive state. The unique physical property of series connection is used to complete the process of "2 out of 2" (that is, there are two independent judgment mechanisms, and only when both judgment mechanisms come to valid conclusions, the whole is considered valid).

[0135] The first control chip performs fault detection on the first output circuit and sends the fault detection result to the second control chip through a synchronous operation, and the second control chip controls the first output circuit to be disconnected when receiving the fault detection result that the first output circuit has a fault;

[0136] The second control chip performs fault detection on the second output circuit and sends the fault detection result to the first control chip through synchronous operation. When the first control chip receives the fault detection result indicating that the second output circuit has a fault, it controls the second output circuit to be disconnected.

[0137] The first control chip is a processor R5; the second control chip is a processor Microblaze.

[0138] A secure twin core collaborative platform realizes:

[0139] 1. The architectural design of the twin-core collaborative platform includes two processors with different physical architectures but running the same software, as well as the synchronization mechanism and cross-checking function between them.

[0140] 2. Design and implementation of safety components to ensure that synchronization between two processors can be automatically established after synchronization is lost, and to guide the safety application after cross-checking and synchronization loss.

[0141] 3. The heterogeneous and cross-platform features of the software enable it to run in different hardware environments. The decoupled design between the software and the user application improves the flexibility and maintainability of the software. The highly reusable software design reduces development costs.

[0142] A safe twin core collaboration method and platform as an independent application module, users can build an unlimited number of functional safety application modules according to their needs.

[0143] 1. No restrictions on platform deployment. No coupling relationship with hardware platform and application program.

[0144] 2. Support cross-checking and built-in secure communication.

[0145] 3. Support automatic synchronization on the machine, support self-recovery and synchronization establishment if necessary after guiding the safety task. Support automatic alignment of clocks between tasks.

[0146] A safe twin core collaboration method and platform provides a software platform with multiple innovative designs that can run on two heterogeneous processors and a hardware platform with a two-out-of-two architecture. This better meets the high safety and reliability requirements of modern rail transit for platform door control systems. At the same time, the software is not limited to platform door control systems and rail transit. Functional safety applications are very broad, including industry, medical care, aerospace, etc. It is applicable to hardware platforms with a two-out-of-two architecture used in fields with high safety integrity levels.

[0147] A secure twin core collaboration method and platform has the following advantages:

[0148] 1. Improve system reliability: The twin core collaborative platform synchronizes tasks in real time through two processors with different physical architectures but running the same software, ensuring that the system can maintain a consistent operating state at any time. This architectural design can effectively improve system reliability and reduce the risk of system crashes caused by single processor failures.

[0149] 2. Enhanced security: The platform introduces cross-checking and synchronization loss automatic recovery mechanisms, which can detect abnormal situations between processors in a timely manner and take corresponding safety measures, such as guiding to safe applications. This helps prevent potential security vulnerabilities and malicious attacks, and ensures the safety of the system and users.

[0150] 3. Improve fault tolerance: In the face of various interference and uncertainty factors, the twin core collaborative platform can maintain the stability of the system. Even if synchronization is lost or cross-checking is abnormal, the system can automatically recover and continue to operate normally, thereby improving the system's fault tolerance and reducing the business interruption time caused by failures.

[0151] 4. Optimize system performance: Since the two processors are always synchronized, the system can use resources more efficiently and improve the speed and efficiency of task execution. At the same time, through cross-checking and automatic recovery mechanisms, the system can avoid additional overhead caused by failures, further improving the overall performance of the system.

[0152] 5. Software advantages: It is heterogeneous and cross-platform, and can adapt to different hardware environments; it is decoupled from user applications, which improves the flexibility and maintainability of the software; its high reusability allows the software to be reused in multiple projects, reducing development costs.

[0153] 6. Complete functions: It has complete functions: synchronization establishment and maintenance, automatic clock alignment, cross-checking, secure communication, etc. It is convenient for users to use.

[0154] 7. These beneficial effects make the collaborative method and platform have important application value in applications with high safety levels such as platform door PEDC control systems, and can provide users with more reliable, safe and efficient solutions.

[0155] Embodiment 2:

[0156] like Figures 1 to 7 As shown, the second embodiment has all the features of the first embodiment, except that:

[0157] This embodiment describes a platform door PEDC control system based on a twin core collaborative platform, which includes two processors with different physical architectures but running the same software, as well as hardware components and software algorithms for achieving synchronization and cross-checking between processors.

[0158] Under PEDC control system:

[0159] The first output circuit includes a first output switch tube, and the second output circuit includes a second output switch tube; the first output switch tube and the second output switch tube are connected in series; the first control chip is electrically connected to a first control module, the first control module is electrically connected to the first output switch tube, and the second control chip is electrically connected to a second control module, and the second control module is electrically connected to the second output switch tube.

[0160] The first output switch tube and the second output switch tube are both N-channel MOS tubes.

[0161] The first control chip is electrically connected to a first detection module, the first detection module is electrically connected to the first output circuit, and the first detection module performs fault detection on the first output circuit;

[0162] The second control chip is electrically connected to a second detection module, the second detection module is electrically connected to the second output circuit, and the second detection module performs fault detection on the second output circuit.

[0163] The detection loops of the first input circuit and the second input circuit are both provided with signal modulation modules, which enable the first input circuit and the second input circuit to output a high level or a low level state when there is no external input, and output a pulse signal when there is an external input.

[0164] The signal modulation module enables the detection loop to continuously cut off the detection loop according to the switching cycle of the signal modulation module.

[0165] The first input circuit and the second input circuit are optocoupler input circuits. The signal modulation module includes an optocoupler element. The optocoupler element is connected in series to the optocoupler input circuit. The optocoupler element performs a switching operation at a fixed frequency to cut off the detection loop.

[0166] The main control chip used in the PEDC system is the AMD-Xilinx XCZU2CG, which is based on the latest 16nm process Zynq UltraScale+ MPSoC platform from AMD-Xilinx. This platform integrates two Cortex TM -A53 processor core, two Cortex TM -R5 real-time processing unit and 16nm FinFET+ programmable logic form a heterogeneous processing system. This design provides high performance, low power consumption and high scalability. It adopts a 2-out-of-2 architecture and dual-core lockstep LockStep design. This architecture ensures the stable operation of the system through dual redundancy and ensures the security of the system through 2-out-of-2. The software layer can be vertically decomposed into the application layer and the system software layer. The application layer implements user functions, and the system software layer provides basic service support for application functions. PEDC software development architecture is as follows Figure 4 In the figure, APP1 is the system communication module, responsible for communicating with other disciplines (signal system, integrated monitoring system, etc.); APP2 is the system monitoring module, responsible for monitoring the operating status of the platform door system; APP3 is the system control module, responsible for controlling the opening and closing of the platform door; Component 1 is the network layer component of the computer network; Component 2 is the application layer component of the computer network; Communication interface 1 and communication interface 2 are the same, which are hard lines; Communication interface 3 is the network communication interface of the system; The user deploys the control module of the system on the processor R5 and the processor Microblaze. Combined with the software, a two-out-of-two control is realized.

[0167] The above-mentioned embodiments only express the specific implementation of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A secure twin core collaboration method, characterized by: The collaboration method collaborates two processors through a collaborative state machine, wherein the states of the collaborative state machine include a start state, an execution state, an end state, and a safety state. When the state of the cooperative state machine is the start state, the cooperative method performs synchronous operation on the two processors and sets the state of the cooperative state machine to the execution state if no failure occurs; When the state of the collaborative state machine is the execution state, the collaborative method first executes the safety task and synchronizes the safety task data, then performs synchronization operation and cross-check on the two processors, and sets the state of the collaborative state machine to the end state if no fault occurs; When the state of the cooperative state machine is the end state, the cooperative method performs synchronous operation on the two processors and sets the state of the cooperative state machine to the start state if no failure occurs; The collaborative method sets the state of the collaborative state machine to a safe state in the event of a failure; When the state of the cooperative state machine is a safe state, the cooperative method executes the task in the safe state.

2. A secure twin core collaboration method according to claim 1, characterized in that: The state of the collaborative state machine also includes a ready state; When the state of the collaborative state machine is a safe state, the collaborative method further sets the state of the collaborative state machine to a ready state; When the state of the collaborative state machine is in the preparation state, the collaborative method performs a preparation operation and sets the state of the collaborative state machine to the start state if no failure occurs; The state of the collaborative state machine also includes an initialization state; When the state of the collaborative state machine is the initialization state, the collaborative method performs an initialization operation.

3. A secure twin core collaboration method according to claim 2, characterized in that: The collaborative method comprises the following steps: S1: when the state of the collaborative state machine is the initialization state, the initialization operation is performed; S2: When the state of the collaborative state machine is in the ready state, the preparation operation is performed and fault detection and corresponding collaborative state machine state setting are performed; S3: When the state of the cooperative state machine is the start state, the two processors are operated synchronously, and fault detection and corresponding cooperative state machine state setting are performed; S4: When the state of the collaborative state machine is the execution state, the safety task is executed first and the safety task data is synchronized. Then, the two processors are synchronized and cross-checked, and fault detection and corresponding collaborative state machine state settings are performed. S5: When the state of the cooperative state machine is the end state, the two processors are operated synchronously, and fault detection and corresponding cooperative state machine state setting are performed; S6: When the state of the collaborative state machine is a safe state, the task in the safe state is executed and the state of the collaborative state machine is set to a ready state.

4. A secure twin core collaboration method according to claim 3, characterized in that: When the result of the fault detection in step S2 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S2 is that no fault occurs, the state of the collaborative state machine is set to a start state; When the result of the fault detection in step S3 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S3 is that no fault occurs, the state of the collaborative state machine is set to an execution state; The fault detection in step S4 is performed twice, the first fault detection is performed after the safety task is executed, and the second fault detection is performed after the cross-check; When the result of the first fault detection in step S4 is that a fault occurs, the state of the collaborative state machine is set to a safe state, and the next step is directly performed; When the result of the second fault detection in step S4 is that a fault occurs, the state of the collaborative state machine is set to a safe state; When the result of the second fault detection in step S4 is that no fault has occurred, the state of the collaborative state machine is set to the end state; When the result of the fault detection in step S5 is that a fault occurs, the state of the collaborative state machine is set to a safe state; when the result of the fault detection in step S5 is that no fault occurs, the state of the collaborative state machine is set to a starting state.

5. A secure twin core collaboration method according to claim 4, characterized in that: Before setting the state of the collaborative state machine to the ready state in step S6, a state setting judgment is performed first. If the result of the state setting judgment is to enter the ready state, the state of the collaborative state machine is set to the ready state, otherwise the state of the collaborative state machine is set to the safe state; The basis for the state setting judgment is whether the user turns on the self-recovery mode. If the user turns on the self-recovery mode, the state of the collaborative state machine is set from the safe state to the ready state, otherwise the state of the collaborative state machine is set to the safe state unchanged.

6. A secure twin core collaboration method according to claim 2, characterized in that: The preparation operation includes the following sub-steps: (1) Reset the error code; (2) Synchronize the two processors; 7. A secure twin core collaboration method according to claim 1, characterized in that: The synchronization operation includes the following synchronization steps: A. Construct synchronization message; B. Send a message; C. Determine whether a message sending failure or receiving failure occurs. If a failure occurs, terminate the synchronization operation; D. The message transmission success flag is set; E. Check the message.

8. A secure twin core collaboration method according to claim 7, characterized in that: The sending failure in the synchronization step C is a message sending timeout; the receiving failure in the synchronization step C is a message receiving timeout; Before the synchronization step B, it is determined whether the last message was successfully transmitted. If it was not successfully transmitted, a message sequence error occurs and the synchronization operation is terminated.

9. A secure twin core collaboration platform, used to implement a secure twin core collaboration method as described in any one of claims 1 to 8, characterized in that: The invention comprises two processors, the two processors run the same software, the two processors are connected in communication, and the two processors perform synchronous operation and cross-checking through communication.

10. A secure twin core collaborative platform according to claim 9, characterized in that: The two processors are respectively a first control chip and a second control chip; An input end of the first control chip is electrically connected to a first input circuit, and an output end of the first control chip is electrically connected to a first output circuit; The input end of the second control chip is electrically connected to a second input circuit, and the output end of the second control chip is electrically connected to a second output circuit; The first input circuit is electrically connected to an input signal terminal, and the input signal terminal is also electrically connected to a second input circuit; The first output circuit is electrically connected to an output signal terminal, the output signal terminal is also electrically connected to the second output circuit, and the output signal terminal is electrically connected to an actuator; The first control chip controls whether the first output circuit is turned on according to the signal input by the first input circuit, and the second control chip controls whether the second output circuit is turned on according to the signal input by the second input circuit; The first control chip sends the signal input by the first input circuit to the second control chip through a synchronous operation; The second control chip sends the signal input by the second input circuit to the first control chip through a synchronous operation; The first control chip performs a cross-check on a signal input from the first input circuit and a signal sent by the second control chip through synchronous operation to determine whether a fault occurs in the first input circuit and the second input circuit; The second control chip performs a cross-check on the signal input by the second input circuit and the signal sent by the first control chip through synchronous operation to determine whether the first input circuit and the second input circuit are faulty.

Images