Control method of triple modular redundancy computer system

Abstract

The invention relates to the technical field of carrier rocket rocket-borne computers, in particular to a control method of a rocket-borne triple-modular redundancy computer system, and the method comprises the steps: obtaining and recording an output right state signal and a data verification signal of each target processor under a triple-modular redundancy architecture computer system, generating an output weight voting signal corresponding to the target processor; according to the output right voting signal output by each target processor, an output processor with the output right of the communication bus is determined from all the processors through an output right voting circuit, and data are output through the processor with the right. Through real-time mutual verification of key data of each processor and shielding of system faults, reliability of a core computer of the carrier rocket is improved, a single-point problem is eliminated, and through simple and ingenious software and hardware design, a safe and reliable triple modular redundancy output right switching strategy is realized.

Description

Technical Field

[0001] This application relates to the field of computer control technology, and in particular, to a control method for a triple modular redundant computer system. Background Art

[0002] As a commonly used fault-tolerant design technology in aerospace equipment, a triple modular redundant computer system has three processors running the same software and performing the same operations, and uses the majority of the same outputs as the correct output of the voting system. Therefore, as long as multiple identical errors do not occur simultaneously in the three processors, the correct output of the system can be guaranteed. At present, the reliability requirements for the electrical system of launch vehicles are becoming increasingly stringent. Although the existing control technology for triple modular redundant computer systems can improve the reliability of on-board computers, the control method is relatively complex, resulting in relatively high hardware and software costs.

[0003] Based on this, those skilled in the art urgently need a control method for a triple modular redundant computer system that can control the triple modular redundant computer system through simple software and hardware settings. Summary of the Invention

[0004] An embodiment of this application provides a control method for a triple modular redundant computer system, which can control the triple modular redundant computer system through simple software and hardware settings.

[0005] Other features and advantages of this application will become apparent through the following detailed description, or will be partially learned through the practice of this application.

[0006] According to one aspect of the embodiments of this application, a control method for a triple modular redundant computer system is provided. The triple modular redundant computer system includes three processors and an output right voting circuit. The triple modular redundant computer system is an on-board triple modular redundant computer system. The method includes: for a target processor, obtaining and recording an output right status signal of the target processor, where the output right status signal is used to indicate whether each processor has the output right of the communication bus, and the target processor is any one of the processors; respectively comparing the data of the target processor and other processors, and generating a data check signal based on the comparison result; generating an output right voting signal corresponding to the target processor based on the output right status signal and the data check signal; and determining an output processor with the output right of the communication bus from each processor through the output right voting circuit according to each output right voting signal, and outputting data through the output processor.

[0007] In some embodiments of the present application, the obtaining and recording the output right status signal of the target processor includes: detecting the output right status pin of the target processor, and obtaining and recording the output right status signal of the target processor; in the output right status signal, the binary signal at the corresponding position of the processor with the output right is 1, and the binary signal at the corresponding position of the processor without the output right is 0.

[0008] In some embodiments of the present application, before comparing the data of the target processor and other processors respectively, the method further includes: sending the data of the target processor to other processors, and controlling the target processor to receive the data of the other processors.

[0009] In some embodiments of the present application, based on the foregoing solution, the sending the data of the target processor to other processors and controlling the target processor to receive the data of the other processors includes: putting the data of the target processor into a preset memory address and sending it to other processors through a high-speed serial communication circuit, and controlling the target processor to receive the data of the other processors through the high-speed serial communication circuit and store it in a preset memory address.

[0010] In some embodiments of the present application, the comparing the data of the target processor and other processors respectively and generating a data check signal based on the comparison result includes: comparing the data of the target processor and other processors respectively, and generating a data check signal based on the comparison result; in the data check signal, if the data of the target processor is consistent with that of any processor, the binary signal at the corresponding position is 1; if the data of the target processor is inconsistent with that of any processor, the binary signal at the corresponding position is 0.

[0011] In some embodiments of the present application, the generating the output right voting signal corresponding to the target processor based on the output right status signal and the data check signal includes: obtaining a first binary array corresponding to the output right status signal, and obtaining a second binary array corresponding to the data check signal; generating the output right voting signal corresponding to the target processor based on the first binary array and the second binary array, and adjusting the output right status signal of the target processor.

[0012] In some embodiments of the present application, based on the foregoing solution, generating the output right voting signal corresponding to the target processor based on the first binary array and the second binary array and adjusting the output right status signals of each processor includes: performing a bitwise AND operation based on the first binary array and the second binary array, and generating the output right voting signal corresponding to the target processor according to the calculation result, and adjusting the output right status signal of the target processor.

[0013] In some embodiments of the present application, based on the foregoing solution, generating the output right voting signal corresponding to the target processor according to the calculation result includes: if the calculation result is not 0 and the number of 0s in the second binary array is less than the number of 1s, generating the output right voting signal corresponding to the target processor, where the output right voting signal is used to indicate that the output right does not switch; if the calculation result is 0 or the number of 0s in the second binary array is greater than or equal to the number of 1s, calculating the product of the first binary array and 2, and generating the output right voting signal corresponding to the product, where the output right voting signal is used to indicate that the output right switches and the processor with the output right.

[0014] In some embodiments of the present application, based on the foregoing solution, calculating the product of the first binary array and 2, and generating the output right voting signal corresponding to the product includes: calculating the product of the first binary array and 2, if a binary digit overflow occurs in the product, generating the output right voting signal corresponding to the product, where the output right voting signal is used to indicate that the output right switches to the first processor with the output right.

[0015] In some embodiments of the present application, based on the foregoing solution, adjusting the output right status signals of each processor according to the calculation result includes: if the calculation result is not 0 and the number of 0s in the second binary array is less than the number of 1s, maintaining the output right status signal of the target processor unchanged; if the calculation result is 0 or the number of 0s in the second binary array is greater than or equal to the number of 1s, calculating the product of the first binary array and 2, and adjusting the output right status signal of the target processor according to the product.

[0016] According to one aspect of the embodiments of the present application, a triple modular redundant computer system is provided. The triple modular redundant computer system includes: three processors; three corresponding two-out-of-three arbitrators; three corresponding independent gate circuits; wherein, the three processors respectively output three judgment signals to the three two-out-of-three arbitrators, each two-out-of-three arbitrator divides the output right result signal into four, one signal is output to the independent gate circuit of the processor to determine whether to open the independent gate circuit, and the other three are output to the output right status pins corresponding to the triple modular processor. Each output right status pin corresponds to a processor, and the level signal on each output right status pin is used to indicate whether the corresponding processor has the output right.

[0017] Based on the above solution, the present application has at least the following advantages or improvements:

[0018] In the technical solutions provided by some embodiments of the present application, the output right status signal and the data check signal of the target processor can be obtained and recorded, the output right voting signal corresponding to the target processor is generated, and the output right status signal of the target processor is adjusted; according to each output right voting signal, an output processor with the output right of the communication bus is determined from each processor, and data is output through the output processor. The control method of the triple modular redundant computer system provided by the present application is reasonable. By checking the data of different processors, the output processor suitable for outputting data is selected, which improves the reliability of the core computer of the launch vehicle and eliminates the single point problem. Through simple and ingenious software and hardware design, a safe and reliable triple modular redundant output right switching strategy is realized.

[0019] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings here are incorporated into the specification and form a part of this specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0021] In the drawings:

[0022] Figure 1 Shows the architecture diagram of a triple modular redundant computer system according to an embodiment of the present application;

[0023] Figure 2 Shows the processor connection architecture diagram according to an embodiment of the present application;

[0024] Figure 3 Shows the flow diagram of the control method of the triple modular redundant computer system according to an embodiment of the present application;

[0025] Figure 4 Shows the flow diagram of obtaining the output right status signal according to an embodiment of the present application;

[0026] Figure 5 Shows the flow diagram of generating the data check signal according to an embodiment of the present application;

[0027] Figure 6 Shows the flow diagram of generating the output right voting signal and adjusting the output right status signal according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0028] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more complete and comprehensive, and will fully convey the concept of the example embodiments to those skilled in the art.

[0029] In addition, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of the embodiments of this application. However, those skilled in the art will realize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be employed. In other cases, well-known methods, devices, implementations, or operations are not shown or described in detail to avoid obscuring aspects of this application.

[0030] It should be noted that the triple modular redundant computer system mentioned in this application can be used as an on-board triple modular redundant computer system. That is to say, the triple modular redundant computer system can be installed on a rocket or other aerospace equipment and used as the core computer for data processing. Next, a triple modular redundant computer system including three processors will be described. For those skilled in the art to better understand this application, the three processors are respectively named Module A, Module B, and Module C. The three modules of the triple modular redundant computer system are redundant to each other. All three modules can receive the data of the on-board electrical system bus, but only one module with the output right can send data to the on-board electrical communication bus. That is to say, the module with the output right is the output processor. By default, Module A has the output right. If Module A works normally, the output right does not switch; if Module A has a working error, the output right is switched to Module B; when Module B has the output right, if Module B works normally, the output right does not switch, and if Module B has a working error, the output right is switched to Module C; when Module C has the output right, if Module C is normal, the output right does not switch, and if Module C has a working error, the output right is switched to Module A.

[0031] Next, please refer to Figure 1 , Figure 1The figure shows an architecture diagram of a triple modular redundant computer system according to an embodiment of the present application. The triple modular redundant computer system may include three processors A, B, and C, three two-out-of-three arbitrators 101, 102, and 103, three independent gate circuits 104, 105, and 106, and three communication bus interface circuits 107, 108, and 109. The three processors A, B, and C can output three decision signals to the three two-out-of-three arbitrators. Each two-out-of-three arbitrator divides the output right result signal into four paths. One path of the signal is output to the independent gate circuit of this module to determine whether to open the independent gate circuit, and the other three paths are output to the output right status pins corresponding to the triple modular processors. Each output right status pin corresponds to a processor respectively. The level signal on each output right status pin can be used to indicate whether the corresponding processor has the output right. The signals of the three output right status pins of the same processor can be collectively referred to as the output right status signal of the current processor. Each module's processor connects the serial port output pin for bus communication and one path of the output signal of the two-out-of-three arbitrator of this module to the input end of the independent gate circuit of this module. The output of the independent gate circuit is connected to the data input port of the bus interface circuit of this module. Each module's processor connects the serial port input pin for bus communication to the data output port of the bus interface circuit of this module; the bus interface circuit of each module is simultaneously connected to the communication bus of the on-board electrical system.

[0032] In an embodiment of the present application, all three modules have the ability to receive data from the on-board electrical communication bus, but only one module with the output right can send data to the bus. Each of the three modules performs bus transceiver operations in each working cycle. Through the logical output of the three two-out-of-three arbitrators, only one unique module has the output right, and the corresponding two-out-of-three arbitrator outputs a valid signal. Only then can the independent gate circuit of the module with the output right be effectively opened, and the serial port output data of this module can be sent to the bus through the bus interface circuit of this module. Even if the two modules without the output right send data to the bus interface circuit, since the corresponding independent gate circuit switch is not opened, the data cannot be sent to the communication bus.

[0033] Next, please refer to Figure 2 , Figure 2 which shows an architecture diagram of processor connections according to an embodiment of the present application. As Figure 2 (a) shows, the three processors are interconnected pairwise. Each module has 2 high-speed serial transceivers, and each transceiver provides four IO pins to form two pairs of differential signals for transmission and reception. As Figure 2As shown in (b), the differential pair of the receive end of the first high-speed serial transceiver in Module A is connected to the differential pair of the transmit end of the second high-speed serial transceiver in Module B, and the differential pair of the transmit end of the first high-speed serial transceiver in Module A is connected to the differential pair of the receive end of the second high-speed serial transceiver in Module B; the differential pair of the transmit end of the first high-speed serial transceiver in Module B is connected to the differential pair of the receive end of the second high-speed serial transceiver in Module C, and the differential pair of the receive end of the first high-speed serial transceiver in Module B is connected to the differential pair of the transmit end of the second high-speed serial transceiver in Module C; the differential pair of the transmit end of the first high-speed serial transceiver in Module C is connected to the differential pair of the receive end of the second high-speed serial transceiver in Module A, and the differential pair of the receive end of the first high-speed serial transceiver in Module C is connected to the differential pair of the transmit end of the second high-speed serial transceiver in Module A.

[0034] Next, please refer to Figure 3 , Figure 3 which shows a simplified flowchart of a control method for a triple modular redundant computer system according to an embodiment of the present application. The triple modular redundant computer system includes at least one processor, and the triple modular redundant computer system is an on-board triple modular redundant computer system. The method may include steps S301 - S304:

[0035] Step S301: For a target processor, obtain and record the output right status signal of the target processor.

[0036] Wherein, the output right status signal is used to indicate whether each processor has the output right of the communication bus, and the target processor is any one of all processors.

[0037] Step S302: Compare the data of the target processor and other processors respectively, and generate a data check signal based on the comparison result.

[0038] Step S303: Generate an output right voting signal corresponding to the target processor based on the output right status signal and the data check signal.

[0039] Step S304: According to each output right voting signal, and through the output right voting circuit, determine an output processor with the output right of the communication bus from all processors, and output data through the output processor.

[0040] As described above, the triple modular redundant computer system may include three processors, named Module A, Module B, and Module C respectively. The target processor may be any one of Module A, Module B, and Module C.

[0041] In the technical solutions provided by some embodiments of the present application, the output right status signal and the data check signal of the target processor can be obtained and recorded, the output right voting signal corresponding to the target processor can be generated, and the output right status signal of the target processor can be adjusted; according to each output right voting signal, an output processor with the output right of the communication bus can be determined from each processor, and data can be output through the output processor. The control method of the triple modular redundant computer system provided by the present application is reasonable. By checking the data of different processors, the output processor suitable for outputting data is selected, the reliability of the core computer of the launch vehicle is improved, and the single-point problem is eliminated. Through simple and ingenious software and hardware design, a safe and reliable triple modular redundant output right switching strategy is realized.

[0042] Please refer to Figure 4 , Figure 4 which shows a simplified flowchart of obtaining the output right status signal according to an embodiment of the present application. The method for obtaining and recording the output right status signal of the target processor may include steps S401-S402:

[0043] Step S401, detect the output right status pin of the target processor, and obtain and record the output right status signal of the target processor.

[0044] Step S402, in the output right status signal, the binary signal at the corresponding position of the processor with the output right is 1, and the binary signal at the corresponding position of the processor without the output right is 0.

[0045] In an embodiment of the present application, each module is configured with a three-bit output right flag register. In the initial state, a group of three-bit binary signals (output right status signals) will be bound to this register, and the default is "001". The lowest bit represents the output right judgment result of module A, the middle bit is the output right judgment result of module B, and the highest bit is the output right judgment result of module C. When set to "1", it means that this module has the output right. When set to "0", it means that this module does not have the output right; there is and only one output right flag bit set to "1", and the other two bits are both "0"; the output right flag bit is updated at the beginning of each working cycle of the processor, and the updated value comes from the level status of the three-bit output right status pins of each module.

[0046] Taking module A as an example, if the output right status signal obtained after detecting the level status of the three-bit output right status pins of module A is "010", it means that now module B has the output right, and both module A and module C do not have the output right.

[0047] In an embodiment of the present application, when the level states of the three output right state pins obtained are "000", it is considered that the current working cycle is the first working cycle. At this time, it can be defaulted that module A has the output right, and the output right state signal is "001", then write "001" to the output right flag register.

[0048] In an embodiment of the present application, before comparing the data of the target processor and all processors respectively, the method may further include: sending the data of the target processor to other processors, and controlling the target processor to receive the data of the other processors. In this embodiment, the data of the target processor can be placed in a preset memory address and sent to other processors through a high-speed serial communication circuit, and controlling the target processor to receive the data of the other processors through the high-speed serial communication circuit and store it in the remaining preset memory addresses.

[0049] Taking module A as an example, take out the key data of module A in this cycle and put it into the specified memory address 1. At the same time, send this key data to the other two modules through the high-speed serial communication circuit, and put the key data received from the other two modules through the high-speed serial communication circuit into the specified memory address 2 and the specified memory address 3. At this time, there is the key data of module A in the current working cycle on the specified memory address 1, the key data of module B in the current working cycle on the specified memory address 2, and the key data of module C in the current working cycle on the specified memory address 3. Subsequently, it can be determined whether there is a working error in module A by self-checking the data of module A, comparing and verifying the data of module A and module B, and comparing and verifying the data of module A and module C.

[0050] Please refer to Figure 5 , Figure 5 shows a simplified flowchart of generating a data check signal according to an embodiment of the present application. The method of comparing the data of the target processor and other processors respectively and generating a data check signal based on the comparison result may include steps S501 - S503:

[0051] Step S501, compare the data of the target processor and other processors respectively, and generate a data check signal based on the comparison result.

[0052] Step S502, in the data check signal, if the data of the target processor and any processor are the same, the binary signal at the corresponding position is 1.

[0053] Step S503, if the data of the target processor and any processor are different, the binary signal at the corresponding position is 0.

[0054] In one embodiment of the present application, a three-bit data decision result flag register can be configured for each module to store the data check signal, which is "111" by default. The least significant bit is the data check result of module A itself, the middle bit is the data check result of module B, and the most significant bit is the data check result of module C. When set to "1", it indicates that the data is consistent and correct; when set to "0", it indicates that the data check is inconsistent.

[0055] Taking module A as an example, self-check the data of module A itself. The data check is correct. Then compare the data of module A and module B, and it is found that the data is inconsistent. Then compare the data of module A and module C, and it is found that the data is consistent. At this time, the generated data check signal is "101".

[0056] Taking module A as an example again, take out the key data of module A in this cycle and put it into the specified memory address 1. At the same time, send the key data to the other two modules through the high-speed serial communication circuit. Put the key data received from the other two modules through the high-speed serial communication circuit into the specified memory address 2 and the specified memory address 3. At this time, there is the key data of module A in the current working cycle at the specified memory address 1, the key data of module B in the current working cycle at the specified memory address 2, and the key data of module C in the current working cycle at the specified memory address 3. At this time, self-check the data at the specified memory address 1, compare the data at the specified memory address 1 with the data at the specified memory address 2, and then compare the data at the specified memory address 1 with the data at the specified memory address 3. Generate a data check signal according to the comparison result.

[0057] Please refer to Figure 6 , Figure 6 shows a simplified flowchart of generating an output right voting signal and adjusting an output right status signal according to an embodiment of the present application. The method for generating the output right voting signal corresponding to the target processor based on the output right status signal and the data check signal may include steps S601 - S602:

[0058] Step S601, obtain a first binary array corresponding to the output right status signal, and obtain a second binary array corresponding to the data check signal.

[0059] Step S602, based on the first binary array and the second binary array, generate the output right voting signal corresponding to the target processor, and adjust the output right status signals of each processor.

[0060] In one embodiment of the present application, a bitwise AND operation can be performed based on the first binary array and the second binary array. According to the calculation result, an output right voting signal corresponding to the target processor is generated to adjust the output right status signals of each processor. If the calculation result is not 0 and the number of 0s in the second binary array is less than the number of 1s, an output right voting signal corresponding to the target processor is generated, and the output right voting signal is used to indicate that the output right does not switch; if the calculation result is 0 or the number of 0s in the second binary array is greater than or equal to the number of 1s, the product of the first binary array and 2 is calculated, and an output right voting signal corresponding to the product is generated, and the output right voting signal is used to indicate that the output right switches and the processor with the output right.

[0061] Taking the A module as an example, by detecting the level signals of the three output right status pins of the A module, the output right status signal "001" corresponding to the A module is obtained. The first binary array is 001, indicating that the A module had the output right in the previous working cycle. Then, by comparing the data of the A module, B module, and C module, a data check signal "111" is generated. The second binary array is 111, and the number of 0s in the second binary array is less than the number of 1s, indicating that the data of the three modules is consistent and the A module has not had a working error. Next, a bitwise AND operation is performed based on the first binary array and the second binary array, and the calculation result is 001, which is not 0. Therefore, the output right does not switch, and the corresponding generated output right voting signal indicates that the output right does not change. The A module has the output right, and the B module and C module do not have the output right. Among them, the corresponding generated output right voting signal actually only represents the A module. Subsequently, it is also necessary to jointly determine whether to open the data interface corresponding to the A module through a two-out-of-three arbiter according to the output right voting signals output by the B module and C module, so that the A module has the output right.

[0062] Taking Module A as an example, by detecting the level signals of the three output right status pins of Module A, the output right status signal "001" corresponding to Module A is obtained. The first binary array is 001, indicating that Module A had the output right in the previous working cycle. Then, by comparing the data of Module A, Module B, and Module C, a data check signal of "110" is generated. The second binary array is 110. The number of 0s in the second binary array is less than the number of 1s, and the self-check data of Module A is incorrect, indicating that Module A may have a working error. Next, a bitwise AND operation is performed based on the first binary array and the second binary array, and the calculation result is 0. Therefore, the output right needs to be switched. Calculate the product of the first binary array and 2, and the product is 010. The corresponding generated output right voting signal indicates that the output right needs to be switched to Module B. Module B has the output right in the current working cycle, while Module A and Module C do not have the output right. Among them, the corresponding generated output right voting signal actually only represents Module A. Subsequently, it is also necessary to determine whether to open the data interface corresponding to Module A through a two-out-of-three arbiter based on the output right voting signals output by Module B and Module C, so that Module A has the output right.

[0063] Taking Module A as an example again, by detecting the level signals of the three output right status pins of Module A, the output right status signal "001" corresponding to Module A is obtained. The first binary array is 001, indicating that Module A had the output right in the previous working cycle. Then, by comparing the data of Module A, Module B, and Module C, a data check signal of "001" is generated. The second binary array is 001. The number of 0s in the second binary array is greater than or equal to the number of 1s, indicating that although the self-check data of Module A is correct, the data of Module B, Module C, and Module A are inconsistent. It is determined that Module A has a working error. Next, a bitwise AND operation is performed based on the first binary array and the second binary array, and the calculation result is 001, which is not 0. In summary, it is determined that the output right needs to be switched. Then, calculate the product of the first binary array and 2, and the product is 010, indicating that the output right should be switched to Module B, and the output right voting signal corresponding to the product is generated. Module B has the output right in the current working cycle, while Module A and Module C do not have the output right. Among them, the corresponding generated output right voting signal actually only represents Module A. Subsequently, it is also necessary to determine whether to open the data interface corresponding to Module A through a two-out-of-three arbiter based on the output right voting signals output by Module B and Module C, so that Module A has the output right.

[0064] In an embodiment of the present application, the product of the first binary array and 2 can be calculated. If a binary digit overflow occurs in the product, an output right voting signal corresponding to the product is generated, and the output right voting signal is used to indicate that the output right is switched to the first processor having the output right. For example, if the first binary array is 100, it indicates that the C module has the output right of the previous working cycle. When calculating the product of the first binary array and 2, the product is 1000, and at this time, a binary digit overflow occurs. Therefore, the generated output right voting signal can indicate that the output right of the current working cycle is switched from the C module to the A module.

[0065] In an embodiment of the present application, an output processor having the communication bus output right can be determined from each processor according to each output right voting signal. As in the above embodiment, each processor generates a corresponding output right voting signal according to its own first binary array and second binary array. Taking a triple modular redundant computer system as an example, a total of three output right voting signals can be generated. A two-out-of-three arbiter built by basic gate circuits determines the processor finally having the output right of the current working cycle, and outputs the output right result signal to the independent gate circuit of the corresponding processor, thereby opening the independent gate circuit and establishing a communication connection between the communication bus and the processor finally having the output right of the current working cycle through the communication bus interface circuit.

[0066] In an embodiment of the present application, the method of adjusting the output right status signals of each processor according to the calculation result may include: if the calculation result is not 0 and the number of 0s in the second binary array is less than the number of 1s, the output right status signal of the target processor remains unchanged; if the calculation result is 0 or the number of 0s in the second binary array is greater than or equal to the number of 1s, calculate the product of the first binary array and 2, and adjust the output right status signal of the target processor according to the product.

[0067] Taking the A module as an example, by detecting the level signals of the three output right status pins of the A module, the output right status signal "001" corresponding to the A module is obtained. The first binary array is 001, indicating that the A module had the output right in the previous working cycle. Then, by comparing the data of the A module, B module, and C module, the data check signal is generated as "111", and the second binary array is 111. The number of 0s in the second binary array is less than the number of 1s, indicating that the data of the three modules is consistent and the A module has not had a working error. Next, a bitwise AND operation is performed based on the first binary array and the second binary array, and the calculation result is 001, which is not 0. Therefore, the output right does not switch, and the output right status signal of the A module remains unchanged and is still "001".

[0068] Taking module A as an example, by detecting the level signals of the three output right status pins of module A, the output right status signal "001" corresponding to module A is obtained. The first binary array is 001, indicating that module A had the output right in the previous working cycle. Then, by comparing the data of module A, module B, and module C, a data check signal "110" is generated. The second binary array is 110. The number of 0s in the second binary array is less than the number of 1s, and the self-check data of module A is incorrect, indicating that module A may have a working error. Next, a bitwise AND operation is performed based on the first binary array and the second binary array, and the calculation result is 0. Therefore, the output right needs to be switched. Calculate the product of the first binary array and 2, and the product is 010, indicating that the output right should be switched to module B. According to the product, the output right status signal of module A is adjusted to "010".

[0069] Taking module A as an example again, by detecting the level signals of the three output right status pins of module A, the output right status signal "001" corresponding to module A is obtained. The first binary array is 001, indicating that module A had the output right in the previous working cycle. Then, by comparing the data of module A, module B, and module C, a data check signal "001" is generated. The second binary array is 001. The number of 0s in the second binary array is greater than or equal to the number of 1s, indicating that although the self-check data of module A is correct, the data of module BC and module A are inconsistent, and it is determined that module A has a working error. Next, a bitwise AND operation is performed based on the first binary array and the second binary array, and the calculation result is 001, which is not 0. In summary, it is determined that the output right needs to be switched. Then, calculate the product of the first binary array and 2, and the product is 010, indicating that the output right should be switched to module B. According to the product, the output right status signal of module A is adjusted to "010".

[0070] In an embodiment of the present application, the output right voting signal and the output right status signal generated by the same processor can represent the same output right switching situation. In other words, if the output right voting signal represents that the output right does not switch, the output right status signal also represents no switching. Among the output right status pins of the target processor, the level signal of the pin corresponding to the processor currently having the output right is "1"; similarly, if the output right voting signal represents that the output right needs to be switched and it is clear that the output right will be switched to processor X, then among the output right status pins of the target processor, the level signal of the pin corresponding to processor X is "1".

[0071] In one embodiment of the present application, each processor generates a corresponding output right voting signal according to its own first binary array and second binary array. Taking a triple modular redundant computer system as an example, a total of three output right voting signals can be generated. The processor with the output right in the current working cycle is determined through a two-out-of-three voting mechanism. At this time, the output right status pins of all processors can be adjusted again, and the level signal of the pin corresponding to the processor with the final output right is set to "1", and all other pins are set to "0".

[0072] In one embodiment of the present application, the processor can choose to adopt the ZYNQ-7045 chip platform, which integrates a dual-core ARM Cortex-A9 core on a single chip, with a main frequency of 800MHz (the maximum main frequency is 1.0GHz), and integrates a high-performance FPGA (Field Programmable Gate Array) of Xilinx's Kintex-7 series on the chip. It not only has the programming convenience, high computing performance and certain multi-core capabilities of a general dual-core ARM processor, but also has the advantages of FPGA in parallelism, interface management, high-density computing and data processing. The two are organically combined.

[0073] In one embodiment of the present application, the main control computing module of each module of the processor is equipped with a large-capacity high-speed DDR3 memory cache, with a capacity of 1GB, to ensure the memory requirements of complex programs and operating systems. At the same time, a large-capacity FLASH memory is equipped, and the EMMC storage capacity of each module is 8GB, which can not only meet the data storage requirements of the arrow machine control, but also be used to implement the function of the "black box" or data recorder on the arrow. The DDR3 memory can adopt the main RAM memory of the Zynq PS side. The capacity and running stability have an important impact on system operation, data processing and process processing. Among them, the DDR3 memory selects the MT41K256M16 dynamic DDR3 DRAM chip of Micron Corporation, with 2 chips in parallel, a total bit width of 32bit and a capacity of 1GB. The large-capacity data storage of the system can be realized by using 1 MTFC8GAAAADV large-capacity EMMC flash memory of Micron Corporation.

[0074] In one embodiment of the present application, the input power supply entering the triple modular redundant computer system can be divided into 3 independent power supplies, corresponding to providing different power supplies for 3 processors and peripheral circuits. Among them, the system's primary step-down power supply module selects a scheme of stepping down from 28V to 5V, and the power supply module selects the HMTF28S5 type power supply module. This power supply module has surge resistance, a nominal input wide voltage of 14-40V, and good input and output protection capabilities.

[0075] In one embodiment of the present application, each module of the processor requires multiple power rails such as 1.0V, 1.2V, 1.5V, 1.8V, 3.3V, and 5V. The LTM4627 and LTM4644 power uModule modules from Linear Technology can be used to generate the main power rails of 1.0V, 1.5V, 1.8V, 3.3V, etc. of the system. Then, the TPS51200 is used to generate the power rail dedicated to DDR. The 1.0V and 1.2V analog power supplies used by the GTX transceiver are generated by the LDO chip TPS74901. The main power supply of the system is powered on according to the power-on sequence required by the chip manual. Control is performed through the PowerGood pin and Run pin of the power module.

[0076] In one embodiment of the present application, the PS side of Zynq requires a crystal oscillator with a frequency of 33.333333MHz, which is used to multiply the system frequency to generate the clock frequencies required for the system main frequency, gigabit Ethernet, DDR3 interface, etc. At the same time, the clock source of the system timer is also generated by this crystal oscillator. The crystal oscillator selects the SIT5156 temperature-compensated crystal oscillator from SiTime Corporation, and its stability is better than 5ppm. Multiple high-speed serial interfaces can be realized through the high-speed GTX interface on the ZYNQ PL side, and the in-board high-speed bus data communication between the three modes can be realized through the high-speed serial interface. The crystal oscillator uses a 100MHz differential crystal oscillator. When designing the circuit, it is necessary to control the transmission line impedance, the number of vias, and keep the connection wires of equal length. The two-out-of-three arbitration circuit can select the four-channel 2-input positive AND gate SN74ALVC08DR from TI (Texas Instruments) company, which integrates 2 4-bit asynchronous binary counters. The 74HC / HCT393 chips are selected for both the counter and the latch, and the output signals are respectively connected to the reset ports of the three processors.

[0077] After considering the specification and practicing the disclosed embodiments herein, those skilled in the art will readily conceive of other embodiments of the present application. The present application is intended to cover any variations, uses, or adaptations of the present application, which follow the general principles of the present application and include the common general knowledge or conventional technical means in the technical field not disclosed in the present application.

[0078] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the present application is only limited by the appended claims.

Claims

1. A control method for a triple-module redundant computer system, characterized in that: The triple-mode redundant computer system includes three processors and an output weight voting circuit. The triple-mode redundant computer system is an arrow-borne triple-mode redundant computer system. The method includes: For a target processor, obtaining and recording an output right status signal of the target processor, wherein the output right status signal is used to indicate whether each processor has an output right of a communication bus, and the target processor is any one of the processors; Comparing data of the target processor and other processors respectively, and generating a data verification signal based on the comparison results; Based on the output weight state signal and the data verification signal, generating an output weight voting signal corresponding to the target processor; According to each output right voting signal, an output processor having the output right of the communication bus is determined from each processor through the output right voting circuit, and data is outputted through the output processor.

2. The method according to claim 1, characterized in that The obtaining and recording the output weight status signal of the target processor includes: Detecting the output weight status pin of the target processor, acquiring and recording the output weight status signal of the target processor; In the output right status signal, the binary signal of the position corresponding to the processor having the output right is 1, and the binary signal of the position corresponding to the processor not having the output right is 0.

3. The method according to claim 1, characterized in that Before comparing the data of the target processor and other processors respectively, the method further includes: The target processor sends data to other processors, and controls the target processor to receive data from other processors.

4. The method according to claim 3, characterized in that The sending the data of the target processor to other processors and controlling the target processor to receive the data of the other processors includes: The data of the target processor is placed in a preset memory address and sent to other processors through a high-speed serial communication circuit, and the target processor is controlled to receive the data of other processors through the high-speed serial communication circuit and store them in a preset memory address.

5. The method according to claim 1, characterized in that The step of comparing the data of the target processor and other processors respectively and generating a data verification signal based on the comparison result includes: Comparing data of the target processor and other processors respectively, and generating a data verification signal based on the comparison results; In the data verification signal, if the data of the target processor is consistent with that of any processor, the binary signal at the corresponding position is 1; if the data of the target processor is inconsistent with that of any processor, the binary signal at the corresponding position is 0.

6. The method according to claim 1, characterized in that The step of generating an output weight voting signal corresponding to the target processor based on the output weight status signal and the data verification signal comprises: Obtain a first binary array corresponding to the output weight state signal, and obtain a second binary array corresponding to the data verification signal; Based on the first binary array and the second binary array, an output weight voting signal corresponding to the target processor is generated, and an output weight state signal of the target processor is adjusted.

7. The method according to claim 6, characterized in that Based on the first binary array and the second binary array, generating an output weight voting signal corresponding to the target processor and adjusting an output weight state signal of the target processor, comprising: A bitwise AND operation is performed based on the first binary array and the second binary array, and according to the calculation result, an output weight voting signal corresponding to the target processor is generated to adjust the output weight status signal of each processor.

8. The method according to claim 7, characterized in that The step of generating an output weight voting signal corresponding to the target processor according to the calculation result includes: If the calculation result is not 0, and the number of 0s in the second binary array is less than the number of 1s, an output weight voting signal corresponding to the target processor is generated, and the output weight voting signal is used to indicate that the output weight does not switch; If the calculation result is 0 or the number of 0s in the second binary array is greater than or equal to the number of 1s, the product of the first binary array and 2 is calculated, and an output weight voting signal corresponding to the product is generated, and the output weight voting signal is used to indicate that the output weight has been switched and the processor has the output weight.

9. The method according to claim 7, characterized in that: The step of adjusting the output weight state signal of the target processor according to the calculation result includes: If the calculation result is not 0, and the number of 0s in the second binary array is less than the number of 1s, maintaining the output weight state signal of the target processor unchanged; If the calculation result is 0 or the number of 0s in the second binary array is greater than or equal to the number of 1s, the product of the first binary array and 2 is calculated, and the output weight state signal of the target processor is adjusted according to the product.

10. A triple-module redundant computer system, characterized in that: The triple-module redundant computer system comprises: Three processors; An output right voting circuit, the output right voting circuit comprising three three-to-two arbiters corresponding to the three processors; The corresponding three independent gate circuits; Among them, the three processors respectively output three decision signals to three three-to-two arbiters. Each three-to-two arbitrator divides the output right result signal into four. One signal is output to the independent gate circuit of the processor to determine whether to open the independent gate circuit. The other three signals are output to the output right status pins corresponding to the three-mode processor. Each output right status pin corresponds to a processor. The level signal on each output right status pin is used to indicate whether the corresponding processor has the output right.

Images