Message storage type LEU of switching value condition safety acquisition structure

Abstract

A message storage type LEU of a switching value condition safety acquisition structure is characterized in that the safety acquisition structure comprises two independent power supply MCUs, the two MCUs safely and synchronously acquire external switching value conditions, the conditions are subjected to validity judgment, messages corresponding to the conditions are selected from independent message memories respectively after the conditions are judged to be valid, and the messages are stored in the message memories. The corresponding message is safely transmitted to the FPGA, and the FPGA outputs the message in a DBPL coding mode; the LEU supports four paths of message output; five independent FPGAs are adopted in the safety collection framework, FPGA 1-4 complete coding output of four paths of messages respectively, FPGA 5 conducts back-check verification on the four paths of messages, double MCUs are in periodic communication with the FPGA 5 respectively to obtain the back-checked messages, and consistency verification is conducted on the back-checked messages and the selected messages. The method has the technical advantages that the FPGA does not execute a safety structure of a safety function; the MCU supports 64-path switching value condition safety acquisition; and the LEU message data configuration process is simplified.

Description

Technical Field

[0001] This invention relates to a message storage type ground electronic unit (LEU) in a transponder transmission system. Background Technology

[0002] In a transponder transmission system, a message-storage type LEU can directly acquire the switching conditions of the relay interlocking device, select the message corresponding to the condition stored in the LEU, and transmit it securely to the active transponder.

[0003] When using switch conditions as input, the LEU can support the acquisition of up to 64 switch conditions. The acquisition of these conditions should comply with the fail-safe principle. In the past, in order to achieve the safe acquisition function of external switch conditions, the LEU adopted a dual-FPGA combined fail-safe structure. After the dual FPGAs acquired the switch conditions, they performed a two-out-of-two vote and selected the corresponding message. After selecting the message, the message was output and the message was checked back.

[0004] In the above LEU security architecture, both FPGAs undertake security functions. Therefore, a strict security verification mechanism must be introduced into the FPGA design, and security constraints must be applied throughout the entire FPGA development process, limiting the flexibility and real-time performance of the FPGA design. Especially when maintaining and upgrading the LEU security functions, the development difficulty increases significantly, and maintenance costs rise substantially.

[0005] To achieve the safe acquisition function of switch quantity conditions, and to decouple the safe function from the non-safe function, a combined fault-safe structure consisting of two MCUs needs to be designed, and the FPGA no longer undertakes the safety function. Summary of the Invention

[0006] To improve the maintainability of LEU systems and simplify the LEU security structure, this invention implements a design structure in which security functions are executed by a combination of two MCUs.

[0007] This invention provides a message storage-type LEU with a secure acquisition structure for switch quantity conditions. The secure acquisition architecture includes two independently powered MCUs. The two MCUs securely and synchronously acquire external switch quantity conditions, determine the validity of the conditions, and after determining that the conditions are valid, each MCU selects the corresponding message from its independent message memory and securely transmits the corresponding message to the FPGA. The FPGA then outputs the message using differential bidirectional level code (DBPL) encoding. The LEU supports four-channel message output.

[0008] The secure data acquisition architecture uses five independent FPGAs. Four FPGAs (FPGA1 to FPGA4) encode and output four packets respectively, and the fifth FPGA (FPGA5) performs back-check verification on the four packets. The two MCUs communicate with the fifth FPGA periodically to obtain the back-checked packets and perform consistency verification with the selected packets. The FPGA does not perform security functions.

[0009] The technical advantages of this invention are as follows:

[0010] (1) A security structure in which an FPGA does not perform security functions;

[0011] (2) The MCU supports 64-channel switch quantity conditional security acquisition;

[0012] (3) Simplify the LEU message data configuration process. Attached Figure Description

[0013] Figure 1 Safety structure design for LEU;

[0014] Figure 2 The process of configuring LEU message data. Detailed Implementation

[0015] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the invention in any way. It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these modifications and improvements all fall within the scope of protection of the present invention.

[0016] The LEU security architecture of this invention is as follows: Figure 1 As shown, the system consists of two independently powered MCUs. The two MCUs synchronously and securely acquire external switching conditions. Each MCU verifies the validity of the condition. Once a condition is deemed valid, each MCU retrieves the corresponding message from its independent message memory (FLASH) and securely transmits it to the FPGA. The FPGA then outputs the message using differential bidirectional level code (DBPL) encoding. The LEU supports four-channel message output capability. This design uses five independent FPGAs: four FPGAs (FPGA1-4) encode and output the four messages respectively, and one FPGA (FPGA5) performs back-check verification on the four messages. The two MCUs periodically communicate with FPGA5 to obtain the back-checked messages and perform consistency verification with their selected messages.

[0017] In this structural design, dual MCUs implement the message selection function. After the dual MCUs select the message to be sent, they each transmit half-packet message data to the corresponding FPGA1 to 4. FPGA1 to 4 each assemble the message into a complete message and independently perform DBPL encoding and output. FPGA5 reads back and buffers the messages output by FPGA1 to 4. The dual MCUs periodically read back 4 channels of message data to FPGA5 and perform consistency verification with the expected message to be sent.

[0018] In this design, the FPGA does not perform security functions. FPGAs 1-4 receive message data sent by the two MCUs, and locally cache only the single message to be sent. When FPGAs 1-4 fail, they may send old messages, and FPGA 5 will send the old messages back to the two MCUs. The two MCUs will then perform a message consistency check to confirm the message output is abnormal. When FPGA 5 fails, it will send the old messages back to the two MCUs, and the two MCUs will also detect the abnormality. Any failure of the FPGA can be detected by the above reactive fault-safe structure, and the two MCUs will jointly output a security control signal to shut down the LEU message output.

[0019] The acquisition function of 64-channel switch input conditions is executed by dual MCUs. Each MCU sends four dynamic square waves to four signal acquisition boards (relay input boards). Each relay input board supports converting 16 switch input conditions into dynamic square waves and then performing parallel-to-serial conversion on these 16 dynamic square waves. The two MCUs can control the parallel-to-serial conversion circuits of the four relay input boards in a time-division multiplexing manner via timer interrupts, ensuring safe acquisition of the 64-channel switch input conditions. During the transmission of dynamic square waves, the dual MCUs drive the parallel-to-serial conversion circuits in the four relay input boards through a time-division multiplexed standard SPI interface, sequentially acquiring the converted data from the four relay input boards. A preamble encoding is designed in the parallel-to-serial conversion circuit to facilitate data channel identification by the MCUs and prevent out-of-order acquisition of data. Within each time slice period, the dual MCUs process the sequentially acquired data, extracting the acquired switch input conditions. For each switch input condition, a large number decision method is used for stability determination. After stability determination, the corresponding message is selected based on the condition.

[0020] like Figure 2As shown, previously, before configuring LEU messages, the hardware board had to be removed, and jumpers had to be set on the board to ensure the LEU entered data configuration mode upon power-up. After message configuration, the board had to be removed again, and jumpers adjusted to ensure the LEU entered normal operating mode upon power-up. To avoid cumbersome manual operations that could affect work efficiency, the LEU message data configuration process has been simplified in this design. An MCU bootloader program has been introduced. By controlling the power-up sequence of the bootloader and main program, the MCU can enter data configuration mode during power-up initialization. LEU message data can then be configured using the LEU message configuration tool. After data configuration, powering on the LEU again will allow it to operate normally.

[0021] In summary, the technical advantages of the present invention are as follows:

[0022] (1) Simplify the security structure of LEU, isolate security functions from non-security functions, and ensure that any failure of FPGA does not affect security;

[0023] (2) Use dual MCUs to control the parallel-to-serial conversion circuit of 4 relay input boards in a time-division manner to safely acquire 64 channels of switch conditions;

[0024] (3) Simplify the LEU message data configuration process and improve the efficiency of data configuration operations.

[0025] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A message storage-type LEU with a secure acquisition structure for switch quantity conditions, the secure acquisition architecture comprising two independently powered MCUs, the dual MCUs securely and synchronously acquiring external switch quantity conditions, determining the validity of the conditions, and after determining the conditions are valid, each MCU selects the corresponding message from its independent message memory and securely transmits the corresponding message to an FPGA, which then outputs the message using differential bidirectional level code (DBPL) encoding; the LEU supports four-channel message output; The secure data acquisition architecture employs five independent FPGAs. Four FPGAs (FPGA1-4) encode and output four message streams respectively, while the fifth FPGA (FPGA5) performs back-check verification on the four message streams. The two MCUs periodically communicate with the fifth FPGA to obtain the back-checked messages and perform consistency verification with the selected messages. FPGAs do not perform security functions.

2. The message storage type LEU according to claim 1, characterized in that, The dual MCUs implement the message selection function. After the dual MCUs select the message to be sent, they each transmit half-packet message data to the corresponding FPGA1 to 4. FPGA1 to 4 each assemble the message into a complete message and independently perform DBPL encoding and output. FPGA5 reads back and buffers the messages output by FPGA1 to 4. The dual MCUs periodically read back 4 channels of message data to FPGA5 and perform consistency verification with the message to be sent.

3. The message storage type LEU according to claim 2, characterized in that, FPGA1-4 receive message data sent by the two MCUs, and locally caches only the single message to be sent. When FPGA1-4 fails, it may send old messages, and FPGA5 will send the old messages back to the two MCUs. The two MCUs will perform a message consistency check to confirm that the message output is abnormal. When FPGA5 fails, it will send the old messages back to the two MCUs, and the two MCUs can also detect the abnormality. Any failure of the FPGA can be detected by the above reaction method. The two MCUs will jointly output a safety control signal to shut down the LEU message output.

4. The message storage type LEU according to claim 1, characterized in that, The acquisition function of 64-channel switch condition is executed by dual MCUs. The two MCUs send 4 channels of dynamic square waves to 4 signal acquisition boards respectively. Each signal acquisition board supports the conversion of 16 channels of switch condition into dynamic square waves and performs parallel-to-serial conversion on the 16 channels of dynamic square waves. The two MCUs can control the parallel-to-serial conversion circuit of the 4 signal acquisition boards in a time-sharing manner through timer interrupts to safely acquire 64 channels of switch condition.

5. The message storage type LEU according to claim 4, characterized in that, During the transmission of dynamic square waves, the dual MCUs drive the parallel-to-serial conversion circuits in the four signal acquisition boards through a time-division multiplexing standard SPI interface, and sequentially acquire the data after parallel-to-serial conversion from the four signal acquisition boards. A preamble encoding is designed in the parallel-to-serial conversion circuit to facilitate data channel identification by the MCU and avoid out-of-order acquisition of data.

6. The message storage type LEU according to claim 5, characterized in that, The dual MCUs process the data collected sequentially in each time slice period, extract the collected switch input conditions, and use a large number decision method to determine the stability of each switch input condition. After the stability is determined, the corresponding message is selected based on the condition.

7. The message storage type LEU according to claim 1, characterized in that, The LEU message data configuration process is simplified by introducing the MCU's bootloader program. By controlling the power-on sequence of the bootloader and main program, the MCU can enter the data configuration mode during power-on initialization. The LEU message data is configured using the LEU message configuration tool. After the data configuration is completed, the LEU can be powered on again to work normally.

Images