A high reliability communication method

Abstract

The application provides a high-reliability communication method, and relates to the technical field of digital communication and functional safety. The application determines a current working channel, establishes corresponding communication timing monitoring, generates a command frame containing frame header protection information and frame check information according to a predetermined frame structure, and encodes and transmits the command frame through the current working channel; an answer frame corresponding to the command frame is received, validity determination is performed on the answer frame, byte comparison is performed on the double-channel answer frame when double channels work; when both double channels are valid responses and the bytes are consistent, or when a single channel is a valid response, the communication data in the answer frame is submitted, and the corresponding communication timing monitoring is reset after the communication data is submitted; when the communication data is not submitted or the communication timing monitoring is timed out, the received answer frame is discarded, and communication abnormality disposal is performed according to a fault tolerance time constraint. The application is beneficial to improving the synchronization, check, fault tolerance and abnormality disposal reliability of short frame serial communication.

Description

Technical Field

[0001] This invention relates to the fields of digital communication and functional safety technology, and in particular to a highly reliable communication method. Background Technology

[0002] In safety-related embedded control scenarios, controllers typically transmit short-frame commands and status data via serial links. Affected by ambient electromagnetic interference, device clock skew, temperature drift, and changes in link impedance, the communication process is prone to anomalies such as sampling offsets, frame boundary misjudgments, bit flips, or response mismatches. For control systems requiring continuous monitoring and timely responses, these anomalies can lead to data parsing errors, or even allow upper-level control logic to continue operating without recognizing the communication failure.

[0003] Existing serial communication solutions mostly rely on fixed baud rate sampling, frame verification, and task watchdog timers for protection. While these methods can detect transmission errors to some extent, they are insufficiently covered for frame header disturbances, request-response mismatches, channel congestion, and latent link failures in short-frame scenarios. Although some redundant communication designs include backup links, the lack of consistency verification and online self-checking mechanisms during the receiving process can still lead to the submission of erroneous data after a single point of failure or transient interference.

[0004] Therefore, how to improve the synchronization stability, error detection capability, anomaly handling timeliness, and link availability of short frame serial communication without increasing bandwidth and processing overhead has become a technical problem that needs to be solved in the field of high-reliability embedded communication. Summary of the Invention

[0005] This invention aims to solve the problem of reduced communication data reliability in short frame serial communication caused by insufficient synchronization stability, frame header disturbance, request and response mismatch, channel blockage, and latent link faults. It provides a highly reliable communication method that enables the communication process to have frame-level verification, channel-level comparison, time constraint handling, and online self-testing capabilities under limited bandwidth and processing resources.

[0006] To achieve the above objectives, this invention provides a highly reliable communication method. The method includes: determining the current working channel and establishing a corresponding communication timing monitoring; generating a command frame containing frame header protection information and frame check information according to a predetermined frame structure; encoding and sending the command frame through the current working channel; receiving a response frame corresponding to the command frame; determining the validity of the response frame returned by the current working channel to obtain a valid or invalid response; and comparing the bytes of the response frames from both channels when the current working channel is dual-channel to obtain byte consistency or byte inconsistency; submitting communication data in the response frame when both channels are dual-channel and both channels provide valid responses with consistent bytes, or when the current working channel is single-channel and the single channel provides a valid response; and resetting the communication timing monitoring corresponding to the current working channel after submitting the communication data; and discarding the received response frame and performing communication anomaly handling according to fault tolerance time constraints when no communication data is submitted or the communication timing monitoring in the current working channel times out.

[0007] Preferably, the predetermined frame structure includes a preamble, a composite frame header, a data field, and a CRC16 checksum. The composite frame header includes frame header protection information, read / write control bits, and a frame length field. The frame header protection information may use ECC checksum bits, and the read / write control bits and frame length field participate in extended Hamming code encoding to generate ECC checksum bits. When the dual-channel operation is in progress, the command frame is written to both channels and transmission is started synchronously. The two channels respectively perform Manchester encoding on the command frame.

[0008] Preferably, the response frame adopts a predetermined frame structure. The validity determination of the response frame includes frame header protection check, CRC16 check, and command frame echo matching. The frame header protection check uses ECC check and distinguishes between error-free, single-bit error, and two-bit error based on the frame header's accompanying parity check results. Single-bit errors are corrected and then CRC16 check is performed again. Response frames corresponding to two-bit errors are recorded as invalid responses. When the current working channel is dual-channel, the data field of the response frame is determined according to the frame length field in the composite frame header of the response frame, and communication data is extracted from the data field of the byte-consistent dual-channel response frame before submission.

[0009] Preferably, communication timing monitoring tracks the interval between two consecutive submissions of communication data. When communication timing monitoring times out, the corresponding channel is reset and a reset flag is generated. Communication anomaly handling includes calculating the time margin, which is the fault tolerance time minus the cumulative time elapsed since the last submission of communication data. The time margin is sufficient to accommodate channel diagnosis. For the channels involved in the communication anomaly, diagnostic data writing, reading back, and fault injection verification are performed, and the faulty channel is determined based on the read-back data and the fault injection verification results.

[0010] Preferably, the communication anomaly handling includes a retransmission mechanism and a degraded communication mechanism. Both the retransmission and degraded communication mechanisms are executed based on time margin. The number of retransmissions is determined by the retransmission time after deducting the time margin for one fault handling period and the execution time of a single complete communication. Each retransmission retransmits the command frame according to a predetermined frame structure. The degraded communication mechanism includes single-channel operation. If the single-channel operation fails two consecutive CRC16 checks and the time margin for executing the degraded communication mechanism can accommodate the fault handling period, diagnostic data writing and reading are performed, and frequency switching or security processing is performed based on the relationship between the written and read values.

[0011] Preferably, the method further includes performing a loopback self-test during power-on initialization, communication anomalies, periodic background checks, before entering low-power mode, or after exiting low-power mode. The loopback self-test configures one channel of the dual channels to transmit mode and the other channel to receive mode, transmits a predetermined test vector, and compares the received data with the predetermined test vector to obtain the loopback self-test result.

[0012] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0013] By combining Manchester encoding with a preamble and a composite frame header structure, the synchronization stability in short frame serial communication is improved, and the risk of receiving out-of-synchronization caused by consecutive identical voltage levels is reduced.

[0014] By combining frame header protection verification, CRC16 verification, and command frame echo matching, the ability to identify frame header disturbances, bit flips, and response mismatches is enhanced.

[0015] By comparing the bytes of the dual-channel response frames, abnormal data from a single channel is prevented from being submitted directly, thus improving the data reliability of redundant communication links.

[0016] By monitoring communication timing and constraining fault tolerance time, communication blockages, deadlocks, or prolonged periods without effective responses can be promptly included in anomaly handling.

[0017] By combining channel diagnostics, retransmission, degraded communication, and loopback self-test, transient interference can be distinguished from channel faults, and the probability of erroneous data entering the upper-level control logic can be reduced while maintaining communication availability. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall process of a highly reliable communication method.

[0019] Figure 2 This is a schematic diagram of a high-reliability communication system structure.

[0020] Figure 3 This is a schematic diagram of the predetermined frame structure.

[0021] Figure 4 This is a schematic diagram of the loopback self-test path. Detailed Implementation

[0022] The following describes a specific embodiment of a high-reliability communication method, illustrating the command frame generation, response frame determination, dual-channel submission, communication timing monitoring, communication anomaly handling, retransmission degradation, and loopback self-test processes. This embodiment is applicable to short-frame communication scenarios such as battery management systems, industrial controllers, relay protection devices, and motor drivers.

[0023] In this embodiment, the communicating parties include a command sending side and a command receiving side. The command sending side generates a command frame during a security task, such as a command frame for reading the battery cell voltage; the command receiving side receives the command frame and returns a corresponding response frame; the command sending side receives the response frame and performs a communication data submission determination. Figure 3 As shown, both the command frame and the response frame use the same predefined frame structure, which includes a preamble, a composite frame header, a data field, and a CRC16 checksum in sequence. Figure 3 In the composite frame header, ECC[3:0] represents the 4-bit frame header protection information, R / W represents the read / write control bits, and Len[2:0] represents the 3-bit frame length field. The data fields of the response frame include the echo field and the response data field. The echo field is used to carry the composite frame header of the command frame or the composite frame header of the command frame after ECC processing, and the frame length field represents the total length of the echo field and the response data field.

[0024] The preamble can be an 8-bit synchronization header, such as 0x55. The preamble is used for bit synchronization and start-of-frame identification during reception. The composite frame header is 1 byte, with the high 4 bits for header protection information and the low 4 bits for control information. The low 4 bits of control information include a 1-bit read / write control bit and a 3-bit frame length field, indicating the length of the data field, which ranges from 0 to 7 bytes. The CRC16 checksum is 2 bytes and can be calculated using the CRC-16 / DNP algorithm.

[0025] In one implementation, the frame header protection information is an ECC check bit, which is generated based on the read / write control bit and the frame length field. When the composite frame header is processed according to bit numbering bit0 to bit7, bit0, bit1, and bit2 are the frame length fields Len[0], Len[1], and Len[2], respectively; bit3 is the read / write control bit; and bits4, bit5, bit6, and bit7 are the ECC check bits. , , , Accordingly, the 4 data bits are denoted as , , , ,in , , Corresponding to Len[0], Len[1], and Len[2] respectively. Corresponding read / write control bits.

[0026] The frame generation side generates ECC check bits according to the (8,4) extended Hamming code. The 8-bit codeword used for ECC check is represented in the following order:

[0027] ;

[0028] in, to For data bits, to For local check bits, This is to cover the first 7 bits of the global even parity bit.

[0029] The check digit is generated according to the following relationship:

[0030] ;

[0031] in, This represents the XOR operation.

[0032] When the frame receiver decodes the composite frame header, it forms the receive codeword according to bits 0 to 7 of the composite frame header. to And calculate the 3-bit syndrome. and global parity The calculation relationships are as follows:

[0033] ;

[0034] when and At that time, the composite frame header is determined to be error-free. and At that time, the composite frame header is determined to be a single bit error, and according to... Flip the corresponding error bit: Time flip , Time flip , Time flip , Time flip , Time flip , Time flip , Time flip .when and At that time, the error bit corresponds to Flip .when and If the composite frame header is found to have two bit errors, the corresponding response frame is recorded as an invalid response.

[0035] like Figure 1 As shown, in conjunction with the above frame structure, the high-reliability communication method includes the process of determining the current working channel and sending command frames, receiving and judging response frames, submitting communication data according to the channel status, and performing communication anomaly handling. Figure 1 S1 corresponds to the command frame generation and sending process, S2 corresponds to the response frame reception, validity determination and dual-channel byte comparison process, S3 corresponds to the communication data submission and communication timer monitoring reset process, and S4 corresponds to the abnormal handling process when communication data is not submitted or the communication timer monitoring times out.

[0036] In S1, the command sending side determines the current working channel and establishes communication timing monitoring corresponding to the current working channel. The current working channel can be dual-channel or single-channel. When operating in dual-channel mode, the two channels communicate in parallel using the same command frames; when operating in single-channel mode, only one channel is reserved for sending command frames and receiving response frames.

[0037] In dual-channel operation, the command sending side writes the same command frame into the corresponding transmission paths of both channels and starts transmission synchronously. Each channel performs Manchester encoding on the command frame before transmitting the encoded signal. Manchester encoding ensures that each bit period contains a transition, allowing the frame receiving side to recover the clock using these transitions and reducing the risk of loss of synchronization caused by long consecutive 0s or 1s.

[0038] like Figure 2 As shown, the two channels can use independent sending and receiving paths. Figure 2 In this context, AFE_logic represents analog front-end logic, ADC represents analog-to-digital conversion unit, AFE_CTRL represents analog front-end control unit, cpusystem represents processor system, WDG represents communication timing monitoring unit, S2P represents serial-to-parallel conversion unit, ECC represents frame header protection and verification processing unit, CRC represents CRC16 frame verification processing unit, CMP represents comparison unit, BUS represents system bus, SRAM represents static storage unit, and EISCalc represents back-end calculation unit. In specific implementation, each channel is configured with a transmit buffer, receive buffer, transmit / receive control logic, Manchester encoding / decoding logic, ECC processing logic, CRC16 processing logic, and diagnostic control logic. The frame transmission / receive, encoding / decoding, verification, and diagnostic processes for the two channels are executed separately. An anomaly in the transmission or verification of a single channel will not directly change the frame processing result of the other channel.

[0039] In S2, the command sending side receives the response frame corresponding to the command frame and performs a validity check on the response frame returned by the current working channel. The validity check includes frame header protection check, CRC16 check, and command frame echo matching. The frame header protection check is used to determine whether the composite frame header of the response frame is error-free or correctable; the CRC16 check is used to determine whether the overall transmission content of the response frame has an error; and the command frame echo matching is used to determine whether the response frame corresponds to the current command frame.

[0040] Command frame echo matching can be achieved through the echo field in the response frame's data field. When processing the response frame, the command sending side compares the echo field with the composite header of the command frame sent this time. If the header protection check, CRC16 check, and command frame echo matching all pass, a valid response is obtained; otherwise, an invalid response is obtained. Under short frame conditions, the Hamming distance (HD) of CRC-16 / DNP can reach 10, detecting errors of no more than 9 bits, with an undetected error rate of less than 0.1 ppm.

[0041] If a single-bit error occurs in the composite frame header and the ECC check can correct it, the CRC16 check will continue after the composite frame header is corrected. If the CRC16 check passes and the command frame echo matches, the response frame can still be considered a valid response. If a two-bit error occurs in the composite frame header, or the CRC16 check fails, or the echo field does not match the current command frame, the response frame will be treated as an invalid response.

[0042] When the current working channel is dual-channel, the command sending side performs byte comparison on the dual-channel response frames according to the byte tick during the reception of response frames. After the validity determination is completed, the command sending side combines the validity determination result and the byte comparison result to decide whether to submit communication data. The objects involved in the comparison are the byte sequences of the dual-channel response frames used for submission determination in the receive buffer, and the comparison range includes the composite frame header, data fields, and CRC16 checksum. The composite frame header field can use the fields processed by ECC verification of each channel for byte comparison; if the ECC verification result is an uncorrectable error, the corresponding response frame will not enter the communication data submission process.

[0043] In S3, when the current working channel is dual-channel, the command sender only submits the communication data in the response frame if both channels provide valid responses and their bytes are identical. When submitting communication data, the command sender determines the data field length based on the frame length field in the composite frame header of the response frame and extracts the communication data from the data field of the byte-identified dual-channel response frame. Since the data fields of the two channels have already been compared byte-by-byte, the data field of either channel can be used as the submission object.

[0044] When the current working channel is a single channel, if the single channel returns a valid response, the command sending side submits the communication data in the single channel response frame. When submitting a single channel response, the command sending side also determines the data field length based on the frame length field in the composite frame header of the response frame, and extracts the communication data from the data field of the single channel response frame.

[0045] When operating in dual-channel mode, communication timing monitoring can be configured for each channel. After both channels submit successfully, the communication timing monitoring for both channels is reset. When operating in single-channel mode, the communication timing monitoring for that single channel is reset. If the communication timing monitoring reaches a preset timeout, the communication method resets the corresponding channel and generates a reset flag, which can be queried and recorded by the master controller.

[0046] In S4, if no communication data is submitted, or the communication timing monitoring in the current working channel times out, the communication method enters the communication anomaly handling phase. If a received acknowledgment frame exists, the command sending side discards the received acknowledgment frame; if no complete acknowledgment frame exists, the command sending side clears residual bytes or abnormal status flags from the receive buffer. Communication anomaly handling is subject to fault tolerance time constraints.

[0047] Fault tolerance time is denoted as In battery management system (BMS) applications, failure to report overvoltage information in a timely manner may lead to battery thermal runaway. During engineering verification, thermal model simulations, cell test data, and vehicle safety analysis can be combined to determine the time boundary between voltage exceeding the threshold and irreversible thermal runaway, and this time boundary should be written into the safety manual or safety configuration. In BMS scenarios, The timeframe can range from 100ms to 500ms, with the specific value depending on the application project configuration.

[0048] For handling communication anomalies, the time margin can be calculated first. The time margin is denoted as... The cumulative time elapsed since the last submission of communication data is recorded as follows: . , and satisfy:

[0049] ;

[0050] in, It can be continuously measured by a high-precision hardware timer. As the duration of communication anomalies increases... Gradually decrease, subsequent retransmissions, diagnostics, and degraded communication are all affected. constraint.

[0051] When the time margin allows for channel diagnostics, the communication method performs diagnostic data writing, reading back, and fault injection verification on the channels involved in the communication anomalies. Channel diagnostics can include two types of processes: normal write-readback and fault injection write-readback, used to check the channel transmission path, protocol verification path, and error rejection path.

[0052] During normal write-readback, a test value of 0xA5 can be written to the diagnostic register address 0x20, and then the diagnostic register can be read back through the same channel. If the readback value is 0xA5, and both ECC and CRC16 checks pass, the communication method recording channel has successfully completed the write-readback. To expand the coverage, write-readback can be repeatedly performed on multiple diagnostic register addresses and multiple test values.

[0053] During the fault injection write-readback process, the diagnostic register address can be kept unchanged. A frame carrying an incorrect CRC16 checksum or an incorrect ECC checksum can be constructed, and a test value of 0x5A can be attempted to be written. Under normal circumstances, the command receiving side will refuse to execute the write operation and discard the abnormal frame after detecting a CRC16 checksum failure or an uncorrectable ECC checksum. Subsequently, the diagnostic register is read back. If the readback value is not 0x5A, the abnormal frame has not been received and executed; if the readback value becomes 0x5A, the channel error has led to a path failure.

[0054] The communication method determines the faulty channel based on readback data and fault injection verification results. If only one channel fails to diagnose, the faulty channel can be disabled and single-channel operation can be initiated. If both channels fail to diagnose, the communication method enters a safety process, latches the fault code, and stops sending non-diagnostic commands.

[0055] In the retransmission mechanism, the communication method determines the number of retransmissions based on a time margin. The time margin is denoted as... This represents the fault tolerance time minus the cumulative time elapsed since the last submission of communication data. The execution time of a single complete communication session is denoted as... , It is obtained by adding the frame transmission time, the response processing delay, the response reception and verification time, and the security arbitration delay.

[0056] In one implementation, the duration of a complete communication operation is used as the fault handling reserve time, and the first fault handling reserve time is denoted as... Both conditions are met:

[0057] ;

[0058] First retransmission It can be determined according to the following relationship:

[0059] ;

[0060] in, This indicates rounding down to the nearest integer. If the calculated result is... If the retransmission count is 0, then the retransmission count is 0. Each retransmission retransmits the command frame according to the predetermined frame structure in S1.

[0061] In another implementation, the fault handling reservation time can be configured separately. The fault handling reservation time is denoted as... The retransmission time is recorded as Both conditions are met:

[0062] ;

[0063] Second retransmission According to and The ratio is determined as follows:

[0064] ;

[0065] when At that time, retransmission will no longer be performed.

[0066] First retransmission Second retransmission number The different reserved duration configuration methods are all used to avoid retransmission taking up the time required for fault handling or security handling.

[0067] The degraded communication mechanism includes single-channel operation. Upon entering single-channel operation, the communication method continues to perform ECC verification, CRC16 verification, and command frame echo matching on the single-channel response frame. If the single-channel response frame corresponding to the current command frame fails the CRC16 verification, the communication method, without forming a valid response or switching to the next command frame, retransmits the current command frame according to the predetermined frame structure in S1, and performs CRC16 verification again on the retransmitted single-channel response frame. If both the initial single-channel response frame corresponding to the current command frame and the retransmitted single-channel response frame fail the CRC16 verification, and the time margin for implementing the degraded communication mechanism is sufficient to accommodate the fault handling reserve time, the communication method performs diagnostic data writing and readback.

[0068] If the diagnostic data write value matches the readback value, the communication method switches the communication frequency to a pre-certified low-frequency operating point. For example, it can switch from 2Mbps to 500kbps. The pre-certified low-frequency operating point must pass electromagnetic compatibility and cross-domain noise tests during the chip certification phase, and meet setup and hold time requirements under worst-case process corner conditions. After the switch, the communication method recalculates the time margin and the duration of a single complete communication session to avoid the communication duration exceeding the fault tolerance time constraint after frequency reduction.

[0069] If the written value and the readback value are inconsistent, or if the CRC16 check fails again after switching to the pre-certified low-frequency operating point, or if the communication timing monitoring times out during downgraded communication, the communication method latches the fault code, stops sending non-diagnostic commands, and outputs a reset signal. The reset signal can put the corresponding communication object into a reset or idle state, clear the previous configuration, and retain the fault code for subsequent diagnostic reading.

[0070] The loopback self-test can be performed during power-on initialization, communication anomalies, periodic background checks, before entering low-power mode, or after exiting low-power mode. Periodic background checks can be scheduled during system idle periods to minimize impact on normal communication tasks. Communication anomalies include CRC16 check failure, inconsistent dual-channel bytes, uncorrectable ECC, command frame echo matching failure, or communication timing monitoring timeout.

[0071] like Figure 4 As shown, when performing a loopback self-test, one of the dual channels can be configured as transmit mode and the other as receive mode, or vice versa. Figure 4 In this code, SSWU0 and SSWU1 represent two communication channels, SSWU_TRX_CTRL represents the channel transmit / receive control logic, SSWU_WDG represents the communication timing monitoring unit within the channel, TX_REG represents the transmit register, RX_REG represents the receive register, SSWU_ECC represents the ECC processing logic, SSWU_CRC16 represents the CRC16 processing logic, SSWU_DIAG represents the diagnostic control logic, and PIN_MUX represents the port selection logic used to select between the external connection path and the internal loopback path. During the loopback self-test, the port selection logic, based on the loopback enable signal output by the channel transmit / receive control logic, connects the transmit logic output of the transmit mode channel to the receive logic input of the receive mode channel, thus connecting the transmit mode channel and the receive mode channel through the internal loopback path. The internal test connection line between the transmit logic output and the receive logic input forms an on-chip short-circuit path, and the multiplexer switch in the port selection logic used to switch between the external connection path and the internal loopback path forms the loopback selection circuit. The transmit mode channel sends a predetermined test vector, and the receive mode channel receives the test vector and compares the received data with the predetermined test vector. The predetermined test vector may include a walking-1 sequence and a PRBS sequence. The walking-1 sequence sets a single bit to 1 in different positions sequentially, while the PRBS sequence covers more transition combinations.

[0072] The loopback self-test covers the Manchester codec, level shifter, drive buffer, receive buffer, FIFO, and control logic. If the received data matches the predetermined test vector, the communication method obtains a loopback self-test pass result, clears the temporary error flag, and restores normal dual-channel communication. If the received data does not match the predetermined test vector, the communication method obtains a loopback self-test failure result, and disables the faulty channel based on the channel diagnostic results.

[0073] When the loopback self-test shows an anomaly in a single channel, the communication method disables the abnormal channel and keeps the other channel operating. When both channels show anomalies, the communication method disables configuration write commands, retains only monitoring or diagnostic commands, latches fault codes, and can send fault notifications to external systems.

[0074] Through the above process, command and response frames are continuously checked at multiple stages, including physical encoding, frame header protection, frame verification, request-response binding, dual-channel consistency comparison, communication timing monitoring, and loopback self-test. The results of each stage are used to determine whether communication data should be submitted, and to execute retransmission, diagnosis, degraded communication, or security processing in case of abnormalities. The above process provides executable processing methods for the predetermined frame structure, validity determination, byte comparison, communication timing monitoring, time margin, retransmission mechanism, degraded communication mechanism, and loopback self-test process.

[0075] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A high-reliability communication method, characterized in that, include: S1: Determine the current working channel and establish corresponding communication timing monitoring. Generate a command frame containing frame header protection information and frame check information according to the predetermined frame structure, and send it through the current working channel. S2: Receive the response frame corresponding to the command frame, determine the validity of the response frame returned by the current working channel, and obtain a valid response or an invalid response; when the current working channel is a dual channel, compare the bytes of the dual channel response frames and obtain whether the bytes are consistent or inconsistent. S3: When the current working channel is dual-channel and both channels have valid responses and the bytes are consistent, submit the communication data in the response frame; when the current working channel is single-channel and the single channel has a valid response, submit the communication data in the response frame; after submitting the communication data, reset the communication timing monitoring corresponding to the current working channel. S4: If no communication data is submitted or the communication timing monitoring in the current working channel times out, discard the received response frame if there is one, and perform communication anomaly handling according to the fault tolerance time constraint.

2. The high-reliability communication method according to claim 1, characterized in that, In step S1, the predetermined frame structure includes a preamble, a composite frame header, a data field, and a CRC16 checksum. The composite frame header includes frame header protection information, read / write control bits, and a frame length field. The CRC16 checksum is frame verification information.

3. The high-reliability communication method according to claim 2, characterized in that, In step S1, the frame header protection information is the ECC check bit, and the read / write control bit and frame length field participate in extended Hamming code encoding to generate the ECC check bit; The transmission of command frames via the current working channel encoding includes: when the current working channel is dual-channel, the command frames are written to both channels and transmission is started synchronously, and the command frames are Manchester encoded by both channels respectively.

4. The high-reliability communication method according to claim 2, characterized in that, The response frame adopts the predetermined frame structure; in step S2, the validity determination includes frame header protection check, CRC16 check and command frame echo matching; a valid response is obtained when all three checks pass, and an invalid response is obtained when any one fails.

5. A high-reliability communication method according to claim 4, characterized in that, In step S2, the frame header protection check uses ECC check, and distinguishes between no error, single-bit error and two-bit error based on the frame header symmetric and global parity check results; after a single-bit error is corrected, CRC16 check is performed again, and the response frame corresponding to a two-bit error is recorded as an invalid response.

6. A high-reliability communication method according to claim 4, characterized in that, In step S3, when the current working channel is dual-channel, the communication data in the submitted response frame includes: determining the data field of the response frame according to the frame length field in the composite frame header of the response frame, and extracting the communication data from the data field of the byte-consistent dual-channel response frame before submission.

7. The high-reliability communication method according to claim 1, characterized in that, Communication timing monitoring tracks the interval between two consecutive submissions of communication data. In step S4, the communication anomaly handling according to the fault tolerance time constraint includes: when the communication timing monitoring times out, resetting the corresponding channel and generating a reset flag.

8. A high-reliability communication method according to claim 1, characterized in that, In step S4, the communication anomaly handling according to the fault tolerance time constraint includes: calculating the time margin, which is the fault tolerance time minus the cumulative time elapsed since the last submission of communication data; when the time margin can accommodate channel diagnosis, performing diagnostic data writing, readback and fault injection verification on the channel involved in the communication anomaly, and determining the faulty channel based on the readback data and fault injection verification results.

9. A high-reliability communication method according to claim 4, characterized in that, In step S4, communication anomaly handling is performed according to the fault tolerance time constraint, including retransmission mechanism and degraded communication mechanism; both retransmission mechanism and degraded communication mechanism are executed based on time margin, which is the fault tolerance time minus the cumulative time elapsed since the last submission of communication data. In the retransmission mechanism, the number of retransmissions is determined by the retransmission time after deducting the time reserved for fault handling from the time margin and the execution time of a single complete communication. Each retransmission retransmits the command frame according to the predetermined frame structure in step S1. The degradation communication mechanism includes single-channel operation. When the single-channel operation fails two consecutive CRC16 checks and the time margin when executing the degradation communication mechanism can accommodate the time reserved for fault handling, diagnostic data writing and reading are performed. When the written value and the read value are consistent, the communication frequency is switched to the pre-certified low-frequency operating point. If the written value and the readback value are inconsistent, the CRC16 check fails again after switching, or the communication timing monitoring times out during the downgrade communication process, the fault code is latched, non-diagnostic commands are stopped from being sent, and a reset signal is output.

10. A high-reliability communication method according to claim 1, characterized in that, The method further includes: performing a loopback self-test before power-on initialization, communication anomaly, periodic background detection, entering low-power mode, or exiting low-power mode; the loopback self-test configures one channel of the dual channels as the transmit mode and the other channel as the receive mode, transmits a predetermined test vector, and compares the received data with the predetermined test vector to obtain the loopback self-test result.

Images