Non-similar redundancy control circuit

Abstract

The invention discloses a dissimilar redundancy control circuit, and belongs to the technical field of dissimilar redundancy control. The circuit comprises a main ZYNQ processor circuit, a backup DSP processor circuit, an external main RS422 communication circuit, an external backup RS422 communication circuit, a main power supply management circuit, a backup power supply management circuit, a three-path pressure intensity signal acquisition circuit, an analog-to-digital conversion circuit, and an internal RS422 communication circuit, an internal main CAN1 communication circuit and an internal backup CAN2 communication circuit which are arranged between the circuit and a servo mechanism. According to the circuit with the dissimilar redundancy control loop, the communication loop and the driving loop, the system has the first-degree fault-tolerant capability through a backup scheme, and therefore the reliability of the system is improved.

Description

Technical Field

[0001] The invention relates to a non-similar redundancy control circuit, belonging to the technical field of non-similar redundancy control. Background Art

[0002] When facing multi-axis control applications, the ZYNQ processor is a very good choice because the on-chip expansion function interface and operating speed of TI's dedicated chips developed for motor control are limited. ZYNQ is a fully programmable system-on-chip that combines an ARM processor and a 7 series FPGA, providing the performance of ASIC and the flexibility of FPGA. Its architecture includes a processing system (PS) and programmable logic (PL), and is widely used in automotive, communications, aerospace and other fields. ZYNQ achieves efficient communication between PS and PL through the AXI interface, supporting flexible system design and upgrades.

[0003] However, due to the inherent long reset time of the ZYNQ processor (about 2 seconds), when used in real-time control systems such as motor control, if a momentary power outage causes the ZYNQ processor to reset during motor operation, the operation of the motor control system will be out of control, causing serious consequences. On the other hand, in equipment with very high reliability requirements, in order to avoid system failures caused by component batch problems, using processors with different architectures as backup is a reliable solution.

[0004] In order to improve system reliability, non-similar redundancy is a common solution. Patent CN20141009701.1 proposes a non-similar three-redundancy airborne electrical load management center, whose core control chip uses two DSPs and one FPGA to realize the non-similar redundancy design at the hardware level. Two different programming languages ​​and algorithms are used in the software to realize the non-similar redundancy design at the software level, which can reduce homomorphic failures and improve the mission reliability of the system. Patent CN202111308743.1 proposes a non-similar redundancy switch quantity acquisition circuit. Using the non-similar redundancy idea, the 28V / open circuit switch signal is converted into a high / low level signal that can be processed by an ordinary chip through a comparator and an optocoupler signal acquisition circuit respectively, and the input signal is considered valid only when the two output signals are valid at the same time, avoiding misjudgment caused by common mode failure. The circuit is safe and reliable, and has strong anti-interference ability. The above patents adopt the idea of ​​non-similar redundancy, but the existing designs do not involve solutions to the problem of long reset time inherent in the ZYNQ processor. Summary of the invention

[0005] The technical problem solved by the present invention is: to overcome the shortcomings of the prior art, a non-similar redundancy control circuit is proposed, a ZYNQ processor is used as the main processor, and a DSP processor is used as the backup processor. When the control power supply is instantly cut off and the ZYNQ processor is reset or the ZYNQ processor chip fails, the backup control channel can be activated to ensure system performance.

[0006] The technical solution of the present invention is:

[0007] A non-similar redundancy control circuit, including a main ZYNQ processor circuit, a backup DSP processor circuit, an external main RS422 communication circuit, an external backup RS422 communication circuit, a main power management circuit, a backup power management circuit, a three-way pressure signal acquisition circuit, an analog-to-digital conversion circuit, and an internal RS422 communication circuit between a servo mechanism, an internal main CAN1 communication circuit, and an internal backup CAN2 communication circuit;

[0008] The three-way pressure signal acquisition circuit acquires the signals of the three-way pressure sensors to obtain the engine pressure;

[0009] The main ZYNQ processor circuit is connected to the control unit and the measurement and control unit respectively through the external main RS422 communication circuit, connected to the servo mechanism through the internal main RS422 communication circuit and the internal main CAN1 communication circuit, connected to the power battery through the main power management circuit, and connected to the three-way pressure signal acquisition circuit through the analog-to-digital conversion circuit;

[0010] The backup DSP processor circuit is connected to the control unit and the measurement and control unit respectively through the external backup RS422 communication circuit, is connected to the servo mechanism through the internal backup CAN2 communication circuit, is connected to the power battery through the backup power management circuit, and is directly connected to the three-way pressure signal acquisition circuit.

[0011] Furthermore, the main ZYNQ processor circuit includes a ZYNQ processor, a power supply chip, and an external crystal oscillator;

[0012] The ZYNQ processor includes a processing system and a programmable logic unit. The programmable logic unit realizes information interaction with the servo mechanism through the external master RS422 communication circuit and the control unit and the measurement and control unit through the internal master RS422 communication circuit and the internal master CAN1 communication circuit; the programmable logic unit completes the power management from the power battery to the servo mechanism through the master power management circuit, and completes the pressure signal collection through the analog-to-digital conversion circuit and the three-way pressure signal collection circuit; the processing system is equipped with a pressure closed-loop control module, which performs pressure closed-loop control according to the collected pressure signal and pressure command, generates a pressure command and sends it to the programmable logic unit, and sends it to the servo mechanism through the internal master RS422 communication circuit and the internal master CAN1 communication circuit;

[0013] The power supply chip provides power to the processing system and programmable logic unit;

[0014] An external crystal oscillator provides clock information for the processing system and programmable logic unit.

[0015] Further, the backup DSP processor circuit includes a DSP processor, a power supply chip, and an external crystal oscillator;

[0016] The DSP processor has a built-in pressure closed-loop control program, and is equipped with an on-chip serial port, an on-chip CAN controller, an on-chip GPIO interface, and an on-chip AD module; the on-chip serial port realizes information interaction with the control unit and the measurement and control unit through an external backup RS422 communication circuit, and the on-chip CAN controller realizes information interaction with the servo mechanism through an internal backup CAN2 communication circuit; its on-chip GPIO interface completes power management from the power battery to the servo mechanism through a backup power management circuit; the DSP uses the on-chip AD module and three-way pressure signal acquisition circuit to complete the acquisition of pressure signals, performs pressure closed-loop control based on the acquired pressure signals and pressure commands, generates pressure commands, and sends them to the servo mechanism through the internal backup CAN2 communication circuit;

[0017] The power supply chip provides power to the DSP processor;

[0018] The external crystal oscillator provides clock information for the DSP processor.

[0019] Further, the external master RS422 communication circuit includes 4-way 422 isolation receiving units and 2-way 422 isolation sending units;

[0020] The ZYNQ processor receives command information from the main bus and backup bus of the control unit and the measurement and control unit through 4-way 422 isolation receiving units, and feeds back the status information of the servo system to the control unit and the measurement and control unit through 2-way 422 isolation sending units.

[0021] Further, the external backup RS422 communication circuit includes 2-way 422 isolation receiving units and 2-way 422 isolation sending units;

[0022] The backup DSP processor receives the command information of the backup bus of the control unit and the measurement and control unit through the 2-way 422 isolation receiving unit, and feeds back the status information of the servo system to the control unit and the measurement and control unit through the 2-way 422 isolation sending unit.

[0023] Furthermore, the main power management circuit and the backup power management circuit are located in the same circuit, and the circuit includes four switch tubes and slow-start resistors R1 and R2, which complete the surge current suppression and on-off control of the power battery supplying power to the servo mechanism;

[0024] The first switch tube is connected in series with the resistor R1 to form a first branch, the third switch tube is connected in series with the resistor R2 to form a second branch, the second switch tube and the fourth switch tube are respectively the third branch and the fourth branch, and the above four branches are connected in parallel and connected in series to the negative line end of the power battery, and then connected to the servo mechanism; wherein the first branch and the third branch are connected in parallel to form a main power management circuit, and the second branch and the fourth branch are connected in parallel to form a backup power management circuit;

[0025] The control signals of the first switch tube and the second switch tube come from the ZYNQ processor, and the control signals of the third switch tube and the fourth switch tube come from the DSP processor; the ZYNQ processor or the DSP processor can control the power connection of the back-end servo mechanism, and the power-off control of the servo mechanism requires the ZYNQ processor and the DSP processor to jointly control the shutdown to complete.

[0026] Furthermore, an intra-chip serial port communication is set between the ZYNQ processor and the DSP processor, so as to enable the primary ZYNQ processor and the backup DSP processor to communicate with each other.

[0027] The ZYNQ processor uses an on-chip output pin to send a ZYNQ_STATUS heartbeat signal to the on-chip input pin of the DSP processor, indicating the working status of the ZYNQ processor;

[0028] The DSP processor uses an on-chip output pin to send a DSP_STATUS heartbeat signal to the on-chip input pin of the ZYNQ processor, indicating the working status of the DSP processor.

[0029] Furthermore, the three-way pressure sensor is configured with three redundancy, and the pressure information is obtained through a two-out-of-three logic judgment; the analog-to-digital conversion circuit is configured in the ZYNQ processor to collect the three-way pressure signals with dual redundancy to avoid the failure of the analog-to-digital conversion chip.

[0030] Furthermore, the non-similar redundancy control circuit works in the following way:

[0031] After receiving the start-up control instruction, the ZYNQ processor executes the control system instructions according to the set program, collects the pressure signal, outputs the heartbeat signal to the DSP processor, runs the pressure closed-loop control program, and sends the servo mechanism position instruction to the servo mechanism through the internal RS422 communication circuit and the internal main CAN1 communication circuit; the DSP processor does not execute the pressure closed-loop control program by default, and only executes the receiving control unit, measurement and control unit instructions, inter-board communication, pressure signal collection, and receiving the heartbeat signal of the ZYNQ processor.

[0032] Furthermore, the method for performing master-backup switching of the non-similar redundancy control circuit is as follows: when the ZYNQ processor is reset due to power failure, or the ZYNQ processor itself fails, the heartbeat signal of the ZYNQ processor disappears, and when the DSP processor detects that the heartbeat signal of the ZYNQ processor disappears for a duration of 10ms, the DSP processor is awakened, outputs the heartbeat signal to the ZYNQ processor, runs the pressure closed-loop control program, and sends the servo mechanism position instruction to the servo mechanism through the internal backup CAN2 communication circuit; when the ZYNQ processor detects the heartbeat signal of the DSP processor for 5ms, the internal pressure closed-loop control program is terminated.

[0033] Furthermore, if the servo mechanism fails, the ZYNQ processor and the DSP processor notify each other through the inter-board communication bus to turn off the switch tubes to isolate the servo mechanism from the servo system. At this time, the ZYNQ processor turns off the two switch tubes in the main power management circuit, and the DSP processor turns off the two switch tubes in the backup power management circuit.

[0034] The advantages of the present invention compared with the prior art are:

[0035] (1) The present invention aims to solve the inherent disadvantage of the ZYNQ processor's long reset time and to avoid system failures caused by component batch problems. It provides a circuit with a non-similar redundancy control loop, a communication loop, and a drive loop. Through a backup solution, the system has a one-time fault tolerance capability, thereby improving system reliability.

[0036] (2) The circuit of the present invention integrates the main and backup power management circuits, which can realize the slow start control of the power battery output voltage, avoiding the damage to the power supply battery caused by the large current impact during the power-on process.

[0037] (3) The circuit of the present invention sets heartbeat signal monitoring and inter-board serial port communication between the main ZYNQ processor and the backup DSP processor, and can automatically switch to the backup DSP processor after the main ZYNQ processor is reset or fails, avoiding human intervention.

[0038] (4) In the present invention, a dual redundant analog-to-digital conversion circuit is set outside the main ZYNQ processor to implement a two-out-of-three logic for the pressure sensor signal, thereby avoiding the problem of single-point failure of the circuit other than the reset of the ZYNQ processor and improving the system reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0040] Figure 1 A block diagram of the composition principle of a non-similar redundancy control circuit according to an embodiment of the present invention;

[0041] Figure 2 The figure is a master-backup switching flow chart of the non-similar redundancy control circuit according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0043] The present invention proposes a circuit of a non-similar redundancy control loop, a communication loop and a drive loop, which is used to realize pressure closed-loop control, communication management and power management in a system composed of multiple servo mechanisms and has a first-order fault tolerance capability.

[0044] The circuit is as Figure 1 As shown, it includes a main ZYNQ processor circuit 101, a backup DSP processor circuit 102, an external main RS422 communication circuit 103, an external backup RS422 communication circuit 104, a main and backup power management circuit 105, a three-way pressure signal acquisition circuit 106, an analog-to-digital conversion circuit, and an RS422 communication circuit with the servo mechanism, a main CAN1 communication circuit, and a backup CAN2 communication circuit.

[0045] The master ZYNQ processor circuit 101 includes a ZYNQ processor, a power supply chip DC / DC_1, and an external crystal oscillator. The ZYNQ processor, with a specific specification of XC7Z020-1CLG484I, includes a processing system (PS) and a programmable logic (PL). The on-chip PL part of the master ZYNQ processor exchanges information with the control unit and the measurement and control unit in the external system 107 through the external master RS422 communication circuit 103. The on-chip PL part exchanges information with the servo mechanism through the internal master RS422 communication circuit and the internal master CAN1 communication circuit. In addition, the on-chip PL part completes the power management of the power battery to the servo mechanism through the master power management circuit in 105. At the same time, the on-chip PL part completes the acquisition of pressure signals for pressure closed-loop control through the analog-to-digital conversion circuit 1, the analog-to-digital conversion circuit 2 and the three-way pressure signal acquisition circuit 106.

[0046] The external master RS422 communication circuit includes 4-way 422 isolated receiving units and 2-way 422 isolated sending units. The master ZYNQ processor receives the command information of the master bus and backup bus of the control unit and the measurement and control unit through the 4-way 422 isolated receiving units, and feeds back the status information of the servo system to the control unit and the measurement and control unit through the master bus through the 2-way 422 isolated sending units.

[0047] The three-way pressure signal acquisition circuit acquires the signals of the three-way pressure sensors to obtain the engine pressure, and performs pressure closed-loop control in combination with the pressure command issued by the control system. The output of the closed-loop control generates a pressure command, which is sent to the programmable logic unit through the AXI bus inside the ZYNQ processor, and is sent to the servo mechanism through the internal master RS422 communication circuit and the internal master CAN1 communication circuit. The three-way pressure sensor is a three-redundant configuration. The pressure information is obtained through three-out-of-two logic judgment in the program. In the ZYNQ processor peripherals, the analog-to-digital conversion circuit 1 and the analog-to-digital conversion circuit 2 are configured to collect the three-way pressure signal in dual redundancy to avoid the failure of the analog-to-digital conversion chip.

[0048] The backup DSP processor circuit 102 includes a DSP processor, a power supply chip DC / DC_2, and an external crystal oscillator. The DSP processor is specifically TMS320F28335. Its on-chip serial port realizes information interaction with the control unit and the measurement and control unit through the external backup RS422 communication circuit 104. Its on-chip CAN controller realizes information interaction with the servo mechanism through the internal backup CAN2 communication circuit. In addition, its on-chip GPIO interface completes power management from the power battery to the servo mechanism through the backup power management circuit in 105. At the same time, the DSP uses the on-chip AD and three-way pressure signal acquisition circuit 106 to complete the acquisition of pressure signals for pressure closed-loop control, and uses the closed-loop output as a pressure command, which is sent to the servo mechanism through the internal backup CAN2 communication circuit.

[0049] The external backup RS422 communication circuit includes 2-way 422 isolated receiving units and 2-way 422 isolated sending units. The backup DSP processor receives the command information of the backup bus of the control unit and the measurement and control unit through the 2-way 422 isolated receiving units, and feeds back the status information of the servo system to the control unit and the measurement and control unit through the backup bus through the 2-way 422 isolated sending units.

[0050] The main backup power management circuit includes switch tubes 1 to 4 and two slow-start resistors R1 and R2, which complete the surge current suppression and on-off control of the power supply from the power battery to the servo mechanism. Among them, switch tubes 1 to 2 and slow-start resistor R1 constitute the main power management circuit, and switch tubes 3 to 4 and slow-start resistor R2 constitute the backup power management circuit. The control signals of switch tubes 1 and 2 come from the main ZYNQ processor, and the control signals of switch tubes 3 and 4 come from the backup DSP processor. Among them, switch tube 1 is connected in series with resistor R1, switch tube 3 is connected in series with resistor R2, switch tube 2, and switch tube 4, a total of 4 branches are connected in parallel, and after parallel connection, they are connected in series at the negative line end of the power battery. The ZYNQ processor or the DSP processor can control the power supply of the back-end servo mechanism. The power-off control of the servo mechanism requires the ZYNQ processor and the DSP processor to jointly control the shutdown to complete.

[0051] Two heartbeat signals ZYNQ_STATUS and DSP_STATUS are set between the main ZYNQ processor and the backup DSP processor. The ZYNQ_STATUS signal originates from the main ZYNQ processor and is received by the backup DSP processor, indicating the working status of the ZYNQ processor; the DSP_STATUS signal originates from the backup DSP processor and is received by the main ZYNQ processor, indicating the working status of the DSP processor. At the same time, serial port communication is set up between the main ZYNQ processor and the backup DSP processor for inter-chip communication between the main ZYNQ processor and the backup DSP processor.

[0052] like Figure 2As shown in the figure, it is a master-backup switching flow chart of the non-similar redundancy control circuit. Under normal circumstances, the ZYNQ processor as the main processor receives the start-up command and executes the control system command according to the predetermined program, collects the pressure signal to run the pressure closed-loop control program, and gives the pressure command to the servo mechanism through the RS422 bus and the CAN1 bus, and sends the heartbeat signal to the DSP processor through the IO port on the PL. The DSP processor does not execute the pressure closed-loop control program by default, and only executes the programs such as receiving the control unit, the measurement and control unit command, the inter-board communication, collecting the pressure signal, and receiving the heartbeat signal of the ZYNQ processor. When the ZYNQ processor is reset due to power failure, or the ZYNQ processor itself fails, the heartbeat signal of the ZYNQ processor disappears. When the DSP processor detects that the heartbeat signal of the ZYNQ processor disappears for a duration of 10ms, the DSP processor is awakened, outputs the heartbeat signal to the ZYNQ processor, runs the pressure closed-loop control program, and gives the pressure command to the servo mechanism through the CAN2 bus. When the ZYNQ processor detects the heartbeat signal of the DSP processor for 5ms, it terminates the running of the pressure closed-loop control program.

[0053] The ZYNQ processor continuously exchanges information with the DSP processor through inter-board serial port communication. If the servo mechanism fails, the ZYNQ processor and the DSP processor notify each other to turn off the switch tube to isolate the servo mechanism from the servo system. At this time, the ZYNQ processor turns off the switch tubes 1 to 2 in the main power management circuit, and the DSP processor turns off the switch tubes 3 to 4 in the backup power management circuit.

[0054] The above-described embodiments are only preferred specific implementations of the present invention. Common changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included in the protection scope of the present invention.

Claims

1. A non-similar redundancy control circuit, characterized in that: It includes a main ZYNQ processor circuit, a backup DSP processor circuit, an external main RS422 communication circuit, an external backup RS422 communication circuit, a main power management circuit, a backup power management circuit, a three-way pressure signal acquisition circuit, an analog-to-digital conversion circuit, and an internal RS422 communication circuit with the servo mechanism, an internal main CAN1 communication circuit, and an internal backup CAN2 communication circuit; The three-way pressure signal acquisition circuit acquires the signals of the three-way pressure sensors to obtain the engine pressure; The main ZYNQ processor circuit is connected to the control unit and the measurement and control unit respectively through the external main RS422 communication circuit, connected to the servo mechanism through the internal main RS422 communication circuit and the internal main CAN1 communication circuit, connected to the power battery through the main power management circuit, and connected to the three-way pressure signal acquisition circuit through the analog-to-digital conversion circuit; The backup DSP processor circuit is connected to the control unit and the measurement and control unit respectively through the external backup RS422 communication circuit, is connected to the servo mechanism through the internal backup CAN2 communication circuit, is connected to the power battery through the backup power management circuit, and is directly connected to the three-way pressure signal acquisition circuit.

2. The non-similar redundancy control circuit according to claim 1, characterized in that: The main ZYNQ processor circuit includes a ZYNQ processor, a power supply chip, and an external crystal oscillator; The ZYNQ processor includes a processing system and a programmable logic unit. The programmable logic unit realizes information interaction with the servo mechanism through the external master RS422 communication circuit and the control unit and the measurement and control unit, and realizes information interaction with the servo mechanism through the internal master RS422 communication circuit and the internal master CAN1 communication circuit; the programmable logic unit completes the power management from the power battery to the servo mechanism through the master power management circuit, and completes the pressure signal collection through the analog-to-digital conversion circuit and the three-way pressure signal collection circuit; The power supply chip provides power to the processing system and programmable logic unit; An external crystal oscillator provides clock information for the processing system and programmable logic unit.

3. The non-similar redundancy control circuit according to claim 1, characterized in that: The backup DSP processor circuit includes a DSP processor, a power supply chip, and an external crystal oscillator; The DSP processor has a built-in pressure closed-loop control program, and is equipped with an on-chip serial port, an on-chip CAN controller, an on-chip GPIO interface, and an on-chip AD module; the on-chip serial port realizes information interaction with the control unit and the measurement and control unit through an external backup RS422 communication circuit, and the on-chip CAN controller realizes information interaction with the servo mechanism through an internal backup CAN2 communication circuit; Its on-chip GPIO interface completes the power management from the power battery to the servo mechanism through the backup power management circuit; The power supply chip provides power to the DSP processor; The external crystal oscillator provides clock information for the DSP processor.

4. The non-similar redundancy control circuit according to claim 1, characterized in that: The external main RS422 communication circuit includes 4-way 422 isolation receiving units and 2-way 422 isolation sending units; The ZYNQ processor receives command information from the main bus and backup bus of the control unit and the measurement and control unit through 4-way 422 isolation receiving units, and feeds back the status information of the servo system to the control unit and the measurement and control unit through 2-way 422 isolation sending units.

5. The non-similar redundancy control circuit according to claim 1, characterized in that: The external backup RS422 communication circuit includes 2-way 422 isolation receiving units and 2-way 422 isolation sending units; The backup DSP processor receives the command information of the backup bus of the control unit and the measurement and control unit through the 2-way 422 isolation receiving unit, and feeds back the status information of the servo system to the control unit and the measurement and control unit through the 2-way 422 isolation sending unit.

6. The non-similar redundancy control circuit according to claim 1, characterized in that: The main power management circuit and the backup power management circuit are located in the same circuit. The circuit includes four switch tubes and slow-start resistors R1 and R2, which complete the surge current suppression and on-off control of the power battery supplying power to the servo mechanism. The first switch tube is connected in series with the resistor R1 to form a first branch, the third switch tube is connected in series with the resistor R2 to form a second branch, the second switch tube and the fourth switch tube are respectively the third branch and the fourth branch, and the above four branches are connected in parallel and connected in series to the negative line end of the power battery, and then connected to the servo mechanism; wherein the first branch and the third branch are connected in parallel to form a main power management circuit, and the second branch and the fourth branch are connected in parallel to form a backup power management circuit; The control signals of the first switch tube and the second switch tube come from the ZYNQ processor, and the control signals of the third switch tube and the fourth switch tube come from the DSP processor; the ZYNQ processor or the DSP processor can control the power connection of the back-end servo mechanism, and the power-off control of the servo mechanism requires the ZYNQ processor and the DSP processor to jointly control the shutdown to complete.

7. The non-similar redundancy control circuit according to claim 1, characterized in that: An on-chip serial port communication is set between the ZYNQ processor and the DSP processor for inter-chip communication between the primary ZYNQ processor and the backup DSP processor; The ZYNQ processor uses an on-chip output pin to send a ZYNQ_STATUS heartbeat signal to the on-chip input pin of the DSP processor, indicating the working status of the ZYNQ processor; The DSP processor uses an on-chip output pin to send a DSP_STATUS heartbeat signal to the on-chip input pin of the ZYNQ processor, indicating the working status of the DSP processor.

8. The non-similar redundancy control circuit according to claim 1, characterized in that: The three-way pressure sensor is a triple-redundant configuration, and the pressure information is obtained through three-out-of-two logic judgment; the analog-to-digital conversion circuit is configured in the ZYNQ processor to collect the three-way pressure signal with dual redundancy to avoid the failure of the analog-to-digital conversion chip.

9. The non-similar redundancy control circuit according to claim 1, characterized in that: The method by which the non-similar redundancy control circuit works is: After receiving the start-up control instruction, the ZYNQ processor executes the control system instructions according to the set program, collects the pressure signal, outputs the heartbeat signal to the DSP processor, runs the pressure closed-loop control program, and sends the servo mechanism position instruction to the servo mechanism through the internal RS422 communication circuit and the internal main CAN1 communication circuit; the DSP processor does not execute the pressure closed-loop control program by default, and only executes the receiving control unit, measurement and control unit instructions, inter-board communication, pressure signal collection, and receiving the heartbeat signal of the ZYNQ processor.

10. The non-similar redundancy control circuit according to claim 1, characterized in that: The method for performing master-backup switching of the non-similar redundancy control circuit is as follows: when the ZYNQ processor is reset due to power failure, or the ZYNQ processor itself fails, the heartbeat signal of the ZYNQ processor disappears, and when the DSP processor detects that the heartbeat signal of the ZYNQ processor disappears for a duration of 10ms, the DSP processor is awakened, outputs the heartbeat signal to the ZYNQ processor, runs the pressure closed-loop control program, and sends the servo mechanism position instruction to the servo mechanism through the internal backup CAN2 communication circuit; when the ZYNQ processor detects the heartbeat signal of the DSP processor for 5ms, the internal pressure closed-loop control program is terminated.

11. The non-similar redundancy control circuit according to claim 1, characterized in that: If the servo mechanism fails, the ZYNQ processor and the DSP processor notify each other through the inter-board communication bus to turn off the switch tube to isolate the servo mechanism from the servo system. At this time, the ZYNQ processor turns off the two switch tubes in the main power management circuit, and the DSP processor turns off the two switch tubes in the backup power management circuit.

Images