Data transmission circuit and system for double-control-unit ejection lifesaving device

Abstract

The invention discloses a data transmission circuit and system for a dual-control-unit ejection lifesaving device, and the circuit comprises a first control unit and a second control unit, the first control unit comprises a first main processor and a first auxiliary processor, and the second control unit comprises a second main processor and a second auxiliary processor; the data communication interface comprises a first internal communication interface, a second internal communication interface, an inter-unit communication interface and an external communication interface; the state monitoring circuit is connected between the first main processor and the second main processor and is used for monitoring the working state of the first main processor; and the sending path switching circuit is connected with the first main processor, the second main processor, the state monitoring circuit and an external communication interface, and is used for communicating the first main processor or the second main processor with the external communication interface based on a signal of the state monitoring circuit. According to the invention, the data transmission is not interrupted when the first main processor fails, and the reliability and safety of the ejection lifesaving device are improved.

Description

Technical Field

[0001] This invention relates to the field of signal processing technology for ejection escape devices, and more particularly to a data transmission circuit and system for a dual-control unit ejection escape device. Background Technology

[0002] The ejection seat electronic control system, as the core control device of the ejection seat, has universal adaptability to both high-altitude and plain environments, and can meet the life-saving needs of different flight environments, such as high altitude and plains. During normal flight, it needs to receive aircraft main inertial navigation and atmospheric data in real time, and periodically report its own data; after ejection is initiated, it needs to accurately select the ejection control program and optimize the ejection sequence based on the relevant parameters of the human-seat system and the embedded control model, which is crucial to ensuring the pilot's safe rescue.

[0003] To enhance the safety and reliability of ejection seat evacuation, current technologies generally employ a redundant design with two sets of primary and backup controllers, requiring the control system to upload data in real time for onboard status monitoring. However, current technology has significant limitations: Firstly, for aircraft models that only reserve a single data channel for the seat control system to transmit data to the UMC (Mechatronics Management Computer), the independent data from the two primary and backup controllers cannot be reported directly and efficiently, and existing solutions do not solve the compatibility problem between multi-processor data and single-channel transmission. Secondly, existing primary and backup controller designs are mostly independent operation modes, lacking an integrated system architecture. This not only fails to achieve effective integration of multi-processor data but also fails to consider redundancy protection mechanisms for data transmission—when the primary transmitting processor malfunctions, it is difficult to quickly and reliably switch the data transmission path, posing a risk of data transmission interruption or distortion, which in turn affects the onboard accurate monitoring of the seat control system's status and fails to fully leverage the safety advantages of dual-controller redundancy design. Existing technologies only remain at the basic level of "parallel deployment of dual controllers," without proposing an integration strategy for multi-processor data, designing an integrated solution adapted to single-channel transmission, or considering an intelligent switching mechanism after the failure of the main transmitting node. They cannot meet the stringent requirements of ejection seat control systems for data transmission reliability and integrity. Summary of the Invention

[0004] The main objective of this invention is to provide a data transmission circuit and system for a dual-control unit ejection rescue device. Through an intelligent switching mechanism, data transmission is not interrupted when the first main processor fails, thereby improving the reliability and safety of the ejection rescue device.

[0005] The technical solution adopted in this invention is: a data transmission circuit for a dual-control unit ejection rescue device, comprising: A first control unit and a second control unit, wherein the first control unit includes a first main processor and a first auxiliary processor, and the second control unit includes a second main processor and a second auxiliary processor; The data communication interface includes a first internal communication interface connecting the first auxiliary processor and the first main processor, a second internal communication interface connecting the second auxiliary processor and the second main processor, an inter-unit communication interface connecting the first main processor and the second main processor, and an external communication interface for sending data to an external device. A status monitoring circuit is connected between the first main processor and the second main processor to monitor the working status of the first main processor. A path switching circuit is provided, which connects the first main processor, the second main processor, the status monitoring circuit, and the external communication interface. Based on the signal from the status monitoring circuit, the first main processor or the second main processor is connected to the external communication interface.

[0006] According to the above technical solution, the first internal communication interface and the second internal communication interface are SCI serial communication interfaces; the inter-unit communication interface is an SPI serial peripheral interface; and the external communication interface is an RS422 interface.

[0007] According to the above technical solution, the status monitoring circuit includes at least two interconnected I / O ports, which are connected between the first main processor and the second main processor.

[0008] According to the above technical solution, the status monitoring circuit includes a first monitoring I / O port and a second monitoring I / O port; the working status of the first main processor is determined by detecting the level switching state on the first monitoring I / O port and the second monitoring I / O port.

[0009] According to the above technical solution, the judgment performed by the status monitoring circuit includes: setting a counting window and setting an initial toggle count value greater than 0; when the first monitoring I / O port and the second monitoring I / O port normally toggle their levels within the window at a preset period, the initial toggle count value increases; when the initial toggle count value is greater than 0, the first main processor is determined to be normal; when the first monitoring I / O port and the second monitoring I / O port do not normally toggle their levels within the window at a preset period, the initial toggle count value decreases; when the initial toggle count value is less than 0, the first main processor is determined to be faulty.

[0010] According to the above technical solution, the transmission path switching circuit includes a logic switch composed of NAND gates and an optocoupler isolator.

[0011] According to the above technical solution, the data input terminal of the logic switch is connected to the transmit pin of the first main processor and the transmit pin of the second main processor respectively; the output terminal of the logic switch drives the transmit chip of the external communication interface; the control terminal of the logic switch is controlled by the output signal of the status monitoring circuit and is isolated by an optocoupler isolator.

[0012] According to the above technical solution, the working logic of the transmission path switching circuit includes: when the status monitoring circuit does not output a signal indicating that the first main processor has failed, the logic switch connects the transmission pin of the first main processor to the external communication interface; when the status monitoring circuit outputs a signal indicating that the first main processor has failed, the second main processor sets a dedicated control pin to a high level, drives the optocoupler to work, and connects the output of the logic switch to the transmission pin of the second main processor to the external communication interface.

[0013] According to the above technical solution, the data received by the first main processor from the first auxiliary processor from the first internal communication interface is integrated with its own data; The second main processor receives data from the second auxiliary processor from the second internal communication interface and integrates it with its own data; The first main processor receives the data integrated by the second main processor through the inter-unit communication interface and performs system-level integration.

[0014] Another aspect of the present invention provides a data transmission system for a dual-control unit ejection rescue device, including the data transmission circuit for a dual-control unit ejection rescue device as described above.

[0015] The beneficial effects of this invention are as follows: By using a redundant configuration of dual control units and a multi-level data communication interface, efficient transmission and integration of multi-processor data are achieved. The status monitoring circuit monitors the working status of the first main processor in real time. Combined with the transmission path switching circuit, the data is automatically switched to the second main processor when the main processor malfunctions. This not only adapts to the external single-channel transmission requirements but also ensures the continuity and integrity of data transmission, significantly improving the reliability and safety of data transmission in the ejection life-saving device.

[0016] Furthermore, a status monitoring circuit is constructed using at least two interconnected I / O ports to avoid misjudgment of a single I / O port failure and enhance the accuracy of main processor status monitoring. Furthermore, the switching circuit employs NAND gates and optocouplers to achieve fast logic response and electrical isolation, thereby improving anti-interference capability and stability. Furthermore, the switching logic is clearly defined, and automatic switching occurs when the main processor fails, ensuring continuous and uninterrupted data transmission. Attached Figure Description

[0017] Figure 1 This is a block diagram of the data transmission circuit structure for a dual-control unit ejection life-saving device according to an embodiment of the present invention; Figure 2This is a schematic diagram of the data fusion and transmission link in the data transmission circuit of the dual-control unit ejection life-saving device according to an embodiment of the present invention; Figure 3 This is a hardware circuit diagram of data fusion in the data transmission circuit of the dual-control unit ejection life-saving device according to an embodiment of the present invention; Figure 4 This is a circuit diagram of the hardware interface switching and fusion data transmission UMC in the data transmission circuit of the dual control unit ejection life-saving device according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Example 1 This embodiment provides a data transmission circuit for a dual-control unit ejection rescue device, the structure of which is as follows: Figure 1 As shown, its core ensures the reliability and integrity of data transmission through redundant design and hierarchical coordination mechanisms, specifically including: The first and second control units form a dual-unit redundant architecture. The first control unit includes a first main processor and a first auxiliary processor, and the second control unit includes a second main processor and a second auxiliary processor, providing the hardware foundation for the acquisition and integration of multi-source data. Furthermore, a hierarchical data integration logic is adopted within and between units: the first main processor receives data from the first auxiliary processor through a first internal communication interface and integrates it with its own data within the unit; the second main processor receives data from the second auxiliary processor through a second internal communication interface and similarly integrates its own data within the unit; subsequently, the first main processor receives the integrated data from the second main processor through the inter-unit communication interface, thereby achieving system-level fusion of data from the four processors and ensuring comprehensive data coverage.

[0020] Specifically, the data can be health management data. Health management data is a key data set collected and generated by each processor within the ejection escape device's controller, encompassing self-test results, operating status, fault information, and other content. After fusion processing, it can characterize the performance degradation or functional failure status of a single processor, the same-side combination, and the entire controller, accurately locate faults, and provide a basis for system status monitoring and fault response through a unique external port.

[0021] The data communication interface is designed to adapt to different transmission scenarios. Specifically, it includes a first internal communication interface connecting the first auxiliary processor and the first main processor, a second internal communication interface connecting the second auxiliary processor and the second main processor, an inter-unit communication interface connecting the first main processor and the second main processor, and an external communication interface for sending the fused data to external devices. Furthermore, to match the data transmission requirements at each level, the first and second internal communication interfaces use an SCI serial communication interface to ensure stable data transmission within the unit; the inter-unit communication interface uses an SPI serial peripheral interface to meet the high-speed data interaction requirements between units; and the external communication interface uses an RS422 interface to adapt to long-distance, interference-resistant external data transmission scenarios.

[0022] A status monitoring circuit is connected between the first and second main processors, specifically for real-time monitoring of the first main processor's operating status, providing accurate data for subsequent transmission path switching. Furthermore, to avoid misjudgments due to a single monitoring node failure, the status monitoring circuit uses at least two interconnected I / O ports connected between the first and second main processors. Specifically, this status monitoring circuit includes a first monitoring I / O port and a second monitoring I / O port, determining the operating status of the first main processor by detecting the level transition states on these two I / O ports. Further, the status monitoring circuit employs a quantitative judgment mechanism: a counting window is set, with an initial transition count value N greater than 0. When the first and second monitoring I / O ports normally transition levels within the window at a preset period, the count increases; a count greater than 0 indicates the first main processor is functioning normally. When the first and second monitoring I / O ports do not normally transition levels within the window at the preset period, the count decreases; a count less than 0 indicates the first main processor is faulty. Further, the preset level transition period is set to 5 milliseconds, balancing the response speed and accuracy of status detection.

[0023] The transmission path switching circuit is connected to the first main processor, the second main processor, the status monitoring circuit, and the external communication interface. Based on the output signal of the status monitoring circuit, it can automatically connect either the first or second main processor to the external communication interface, ensuring uninterrupted data transmission. Furthermore, this transmission path switching circuit uses a logic switch composed of NAND gates and an optocoupler. The data input terminals of the logic switch are connected to the transmission pins of the first and second main processors, respectively. The output terminal of the logic switch drives the transmission chip of the external communication interface. The control terminal of the logic switch is controlled by the output signal of the status monitoring circuit and is isolated by the optocoupler. Furthermore, the transmission path switching circuit follows a clear operating logic: when the status monitoring circuit does not output a signal indicating a failure of the first main processor, the logic switch connects the transmission pin of the first main processor to the external communication interface, and the first main processor is responsible for data transmission; when the status monitoring circuit outputs a signal indicating a failure of the first main processor, the second main processor sets a dedicated control pin to a high level, driving the optocoupler to operate, switching the output terminal of the logic switch to the transmission pin of the second main processor, and the second main processor takes over the data transmission task.

[0024] Another aspect of the present invention provides a data transmission system for a dual-control unit ejection rescue device. The control system includes the aforementioned data transmission circuit for the dual-control unit ejection rescue device. Through redundant design of the control circuit, hierarchical data fusion, precise status monitoring, and intelligent path switching, the reliability and safety of the ejection rescue device are comprehensively improved.

[0025] Example 2 Based on Embodiment 1, this embodiment provides another data transmission circuit for a dual-controller ejection life-saving device, which addresses the deficiency in the prior art that it is impossible to integrate two controllers into a system and then transmit data to the onboard UMC via a single RS422 interface.

[0026] The integrated electronic control system for the ejection seat includes control module AB and controller module CD. Each module contains two processors: A and B or C and D. A schematic diagram of the data fusion and transmission link is shown below. Figure 2 As shown: First, the airborne main inertial navigation system (INS) and atmospheric data are synchronously input to chair-mounted INS modules 1 and 2. All data from these modules are then sent to processor modules A, B, C, and D, respectively. Next, initial data fusion is performed within each module via SCI communication: in module AB, processor B sends its own data to processor A via SCI, where A fuses the data from A and B; in module CD, processor D sends its data to processor C via SCI, where C fuses the data from C and D. Then, system-level fusion is achieved between modules via SPI communication: processor C in module CD sends the fused C and D data to processor A in module AB via SPI, where A further fuses the data from all four processors. Finally, the fused data is sent to the onboard UMC via an interface switching circuit: by default, processor A sends the data first; if processor A fails, the system automatically switches to processor C.

[0027] Inside control module AB, processor B sends its own data to processor A via SCI, and processor A merges the data from processors A and B. Inside control module CD, processor D sends its own data to processor C via SCI, and processor C merges the data from processors C and D.

[0028] When the health status words of processors A and B are both normal, if either A or B reports an abnormality, the corresponding status bit after fusion will report an abnormality, and the abnormal processor will be marked by a separate status bit; the data bit is the arithmetic average of the data of processors A and B.

[0029] When processor A fails to receive data from processor B, the status bit is A's own status bit information, and a separate status bit indicates that processor B is abnormal; the data bit is the forwarded data of processor A itself.

[0030] The same logic applies to the data fusion logic of processors C and D.

[0031] The control module AB communicates with CD via SPI to send the data from the processor CD fused by processor C to processor A. The main transmitting processor A further merges the health management data of the four processors and sends the system data to the onboard UMC through an RS422 interface.

[0032] When the health status words of processors A and C are both normal, if both A and C report an error in their status bits, then the corresponding status bit in the merged data will report an error. The data bits are then directly merged and forwarded from processor C by processor A.

[0033] When processor A fails to receive data from processor C, the status bit indicates that processor A directly sends its fused AB information to UMC and reports an error in processors C and D; the data bit indicates that processor A directly sends its fused AB data to UMC.

[0034] Specifically, the hardware circuit diagram for data fusion in this embodiment is as follows: Figure 3 As shown: The internal connections of control modules AB (processors A and B) are as follows: They are connected via multiple sets of SCI serial communication interface pins, including SCITXDA, SCIRXDC, SCIRXDA, and SCIRXDB. Specifically, the SCITXDA pin of processor B (corresponding to the label "TXB-A") is connected to the SCIRXDC pin of processor A; this link is used for processor B to send its own data to A. Processor A is equipped with SCIRXDA and SCIRXDB pins, corresponding to the interfaces labeled "RXA-GD2" and "RXA-GD1" in the diagram. These two interfaces handle data reception, specifically for acquiring information transmitted by chair-mounted inertial measurement modules 1 and 2. Processor B is also equipped with SCIRXDA and SCIRXDB pins, corresponding to the interfaces "RXB-GD2" and "RXB-GD1" in the diagram, receiving data transmitted by chair-mounted inertial measurement modules 1 and 2, thus enabling information exchange between these modules and processor B.

[0035] Connections within the control module CD (processors C and D): Consistent with the logic of modules AB, processors C and D are connected via SCI interface pins such as SCITA and SCIRDDC. The SCITA pin of processor D (corresponding to the label "TXD-C") is connected to the SCIRDDC pin of processor C, responsible for sending data from D to C. Processor C is equipped with SCITA and SCIRDDB pins, corresponding to the interfaces labeled "RXC-GD1" and "RXC-GD2" in the diagram. These two interfaces handle data reception, specifically used to acquire information transmitted by chair-mounted inertial measurement modules 1 and 2. Processor D is also equipped with SCITA and SCIRDDB pins, corresponding to the interfaces "RXD-GD1" and "RXD-GD2" in the diagram, receiving data transmitted by chair-mounted inertial measurement modules 1 and 2, completing the information transfer between these modules and processor D.

[0036] The cross-module connection between control modules AB and CD (processors A and C) is as follows: They are connected via a four-wire SPI serial peripheral interface, including SPISIMOA, SPISOMIA, SPICLKA, and SPISTEA (corresponding identifiers "SIMOA, SOMIA, CLKA, STEA"). This link is used by processor C to transmit the fused C and D data to processor A, achieving system-level data integration. Simultaneously, interconnect I / O ports are set up between processors A and C to enable C to monitor A. If processor C detects a failure in processor A, it drives the intelligent switching circuit to switch the transmission interface, allowing the auxiliary transmitter processor C to send data to the UMC. Specifically, A and C are connected via two interconnect I / O ports, "IOCA1" and "IOCA2," which are the hardware channels for processor C to monitor the operating status of A. The "CKZ-A" I / O port of processor C (corresponding to its GPIO3 pin) is the control terminal for driving the interface switching circuit, used to trigger the transmission path switch when A fails. The “TXA” pin of processor A and the “TXC” pin of processor C are hardware interfaces for sending data to the on-board UMC, respectively. The transmission path of the two will be switched later through an interface switching circuit.

[0037] The hardware interface switching circuit mainly uses NAND gates to switch the interface for processor A or C to send health information to the UMC. The TXW driver is the transmitter of the RS422 transceiver chip. Normally, TXW is implemented by processor A (TXA) for data transmission; when processor C determines that processor A has malfunctioned, processor C sets its other I / O port (CKZ-A) high, driving... Figure 4 The optocoupler operates, and the TXW signal is transmitted by the processor C (TXC) through this interface switching circuit.

[0038] The circuit diagram for hardware interface switching and fusion data transmission UMC in this embodiment is as follows: Figure 4 As shown: The core of the circuit is divided into a transmission path switching unit and an RS422 communication unit: the switching unit uses NAND gates as its logic core, and its input terminals are respectively connected to the transmission pin "TXA" of processor A and the transmission pin "TXC" of processor C, and simultaneously connected to the signal of the optocoupler (GH281-2) controlled by processor C; under normal conditions, the NAND gate logic connects "TXA" to the subsequent circuit, and processor A is responsible for data transmission; when processor C determines that A has failed, its "CKZ-A" pin (driven by R736 and V284) triggers the optocoupler to conduct, changes the NAND gate logic, switches the transmission path to "TXC", and processor C takes over the transmission. The switched transmit signal (TXW) is connected to the SM3490 chip (DI pin) of the RS422 communication unit. The SM3490 converts the single-ended signal into a differential signal, which is then output to the on-board UMC via inductor L12 and interface J-OUT±. At the same time, components such as R192, R728, and C328 in the circuit play the role of impedance matching and filtering, while V295 and V297 provide overvoltage protection for the circuit. Overall, intelligent switching of the data transmission path and reliable RS422 differential transmission are realized.

[0039] Processors A and C communicate via I / O ports, with processor C monitoring processor A. If processor C determines that the IOCA1 and IOCA2 levels are abnormal, it considers processor A to have malfunctioned. The determination method is as follows: the I / O levels in the window are set to toggle with a period of 5ms, and the initial toggle count is set to N. When the I / O levels in the window toggle normally, the count is incremented by 1, up to a maximum of N. If the count is greater than 0, processor A is considered to be functioning normally. When the I / O levels in the window do not toggle, the count is decremented by 1. If the count is less than 0, processor A is considered to have failed.

[0040] In summary, the present invention provides a data transmission circuit and system for a dual-control unit ejection life-saving device, which can ensure uninterrupted data transmission when the first main processor fails through an intelligent switching mechanism, thereby improving the reliability and safety of the ejection life-saving device's data transmission circuit.

[0041] It should be noted that, depending on the implementation needs, the various steps / components described in this application can be broken down into more steps / components, or two or more steps / components or parts of the operation of steps / components can be combined into new steps / components to achieve the purpose of this invention.

[0042] The order of the steps in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0043] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A data transmission circuit for a dual-control unit ejection life-saving device, characterized in that, include: A first control unit and a second control unit, wherein the first control unit includes a first main processor and a first auxiliary processor, and the second control unit includes a second main processor and a second auxiliary processor; The data communication interface includes a first internal communication interface connecting the first auxiliary processor and the first main processor, a second internal communication interface connecting the second auxiliary processor and the second main processor, an inter-unit communication interface connecting the first main processor and the second main processor, and an external communication interface for sending data to an external device. A status monitoring circuit is connected between the first main processor and the second main processor to monitor the working status of the first main processor. A path switching circuit is provided, which connects the first main processor, the second main processor, the status monitoring circuit, and the external communication interface. Based on the signal from the status monitoring circuit, the first main processor or the second main processor is connected to the external communication interface.

2. The data transmission circuit for a dual-control unit ejection life-saving device according to claim 1, characterized in that, The first internal communication interface and the second internal communication interface are SCI serial communication interfaces; the inter-unit communication interface is an SPI serial peripheral interface; and the external communication interface is an RS422 interface.

3. The data transmission circuit for a dual-control unit ejection life-saving device according to claim 1, characterized in that, The status monitoring circuit includes at least two interconnected I / O ports connected between the first main processor and the second main processor.

4. The data transmission circuit for a dual-control unit ejection rescue device according to claim 3, characterized in that, The status monitoring circuit includes a first monitoring I / O port and a second monitoring I / O port; the working status of the first main processor is determined by detecting the level switching state on the first monitoring I / O port and the second monitoring I / O port.

5. The data transmission circuit for a dual-control unit ejection life-saving device according to claim 4, characterized in that, The judgments performed by the status monitoring circuit include: setting a counting window and setting an initial toggle count value greater than 0; when the first monitoring I / O port and the second monitoring I / O port normally toggle their levels within the window at a preset period, the initial toggle count value increases; when the initial toggle count value is greater than 0, the first main processor is determined to be normal; when the first monitoring I / O port and the second monitoring I / O port do not normally toggle their levels within the window at a preset period, the initial toggle count value decreases; when the initial toggle count value is less than 0, the first main processor is determined to be faulty.

6. The data transmission circuit for a dual-control unit ejection life-saving device according to claim 1, characterized in that, The transmission path switching circuit includes a logic switch composed of NAND gates and an optocoupler isolator.

7. The data transmission circuit for a dual-control unit ejection escape device according to claim 6, characterized in that, The data input terminals of the logic switch are respectively connected to the transmit pins of the first main processor and the second main processor; the output terminal of the logic switch drives the transmit chip of the external communication interface; the control terminal of the logic switch is controlled by the output signal of the status monitoring circuit and is isolated by an optocoupler isolator.

8. The data transmission circuit for a dual-control unit ejection rescue device according to claim 1, characterized in that, The operating logic of the transmission path switching circuit includes: when the status monitoring circuit does not output a signal indicating that the first main processor has failed, the logic switch connects the transmission pin of the first main processor to the external communication interface; when the status monitoring circuit outputs a signal indicating that the first main processor has failed, the second main processor sets a dedicated control pin to a high level, drives the optocoupler to work, and connects the output of the logic switch to the transmission pin of the second main processor to the external communication interface.

9. The data transmission circuit for a dual-control unit ejection life-saving device according to claim 1, characterized in that, The first main processor receives data from the first auxiliary processor via the first internal communication interface and integrates it with its own data; The second main processor receives data from the second auxiliary processor from the second internal communication interface and integrates it with its own data; The first main processor receives the data integrated by the second main processor through the inter-unit communication interface and performs system-level integration.

10. A data transmission system for a dual-control unit ejection life-saving device, characterized in that, Includes the data transmission circuit for the dual-control unit ejection life-saving device as described in any one of claims 1-9.

Images