FPGA-based industrial communication timing self-calibration and self-healing system and method

Abstract

The application discloses an industrial communication timing self-calibration and self-recovery system and method based on FPGA, and relates to the technical field of industrial automation communication control.The system comprises a distributed processing unit and an IO module, wherein the IO module is integrated with an FPGA master module, a FLASH and an environmental interference parameter acquisition module, and is used for loading the FLASH and collecting field environmental interference parameters after power-on; the FPGA master module comprises a serial port transceiving control module, an on-chip timing acquisition and comparison unit, a dynamic timing monitoring unit, a dynamic phase compensation and timing correction module, a read-write timing control module and a communication protocol analysis module, and is used for compensating timing deviation of a communication signal in real time by adopting a hardware parallel processing mode, and constructing an industrial communication system with closed-loop control capability of real-time monitoring, intelligent adjustment and automatic repair.The application has stability and reliability, and provides a safe and efficient communication guarantee scheme for a modern industrial automation control system.

Description

Technical Field

[0001] This invention relates to an FPGA-based industrial communication timing self-calibration and self-healing system and method, belonging to the field of industrial automation communication control technology. Background Technology

[0002] In industrial DCS systems, the main control unit (DPU) and I / O modules commonly use RS485 serial communication, implementing hardware-level signal processing based on FPGA chips. This architecture, using FPGA as the core processor in conjunction with RS485 serial communication, exhibits three major advantages in practical industrial applications: efficient parallel processing capabilities to handle multiple signals simultaneously, flexible programmability supporting various industrial protocols, and nanosecond-level timing control precision ensuring accurate execution. However, this architecture still faces key challenges in complex industrial environments: traditional static timing schemes, such as those in patent CN107544478B, cannot adapt to drastic temperature changes and strong electromagnetic interference, leading to sampling offsets and buffer conflicts; traditional communication protocols, such as MODBUS-RTU, used in patent CN112468382A, only define basic data transmission function frame formats, failing to support equipment status monitoring and self-healing functions, resulting in slow fault repair response; furthermore, static memory management presents security risks. Summary of the Invention

[0003] The purpose of this invention is to propose an FPGA-based industrial communication timing self-calibration and self-healing system and method, which aims to form a complete monitoring-compensation-protection control closed loop, thereby comprehensively improving the system's real-time performance, reliability, and security.

[0004] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0005] In a first aspect, the present invention proposes an FPGA-based industrial communication timing self-calibration and self-healing system, comprising a distributed processing unit and several IO modules, wherein the IO modules integrate an FPGA main control module;

[0006] The FPGA main control module is connected to an external FLASH and an environmental interference parameter acquisition module, which is used to load the internal program of the FLASH and collect the on-site environmental interference parameters after power-on.

[0007] The FPGA main control module integrates a serial port transceiver control module, an on-chip timing acquisition and comparison unit, a dynamic timing monitoring unit, a dynamic phase compensation and timing correction module, a read / write timing control module, and a communication protocol parsing module.

[0008] The serial port transceiver control module is used for message exchange between the distributed processing unit and the IO module.

[0009] The on-chip timing acquisition and comparison unit is used to acquire and process the field environmental interference parameters and hardware timing data to obtain real-time timing parameters; when the reference timing is received, timing diagnosis is performed, bidirectional calibration is initiated for abnormal timing, and a self-healing request is sent after multiple rounds of bidirectional calibration failure.

[0010] The dynamic timing monitoring unit is used to compare the real-time timing parameters with the system reference parameters to obtain the global timing offset error;

[0011] The dynamic phase compensation and timing correction module is used to perform three-level timing correction on the global timing offset error to obtain the corrected reference timing, and write the reference timing into the read / write timing control module;

[0012] The read / write timing control module is used to write the reference timing into the on-chip timing acquisition and comparison unit and the communication protocol parsing module;

[0013] The communication protocol parsing module is used to perform dual semantic data parsing on the reference timing to obtain regular business messages and dedicated self-healing control messages, and to perform three-level progressive seamless self-healing on the dedicated self-healing control messages when a self-healing request is received.

[0014] Furthermore, the environmental interference parameter acquisition module includes a field signal acquisition module, a temperature acquisition module, and an EMI electromagnetic interference monitoring module;

[0015] The field signal acquisition module is used to collect environmental operating condition data, including board temperature, operating voltage, and clock jitter.

[0016] The temperature acquisition module is used to acquire temperature drift data;

[0017] The EMI electromagnetic interference monitoring module is used to collect EMI electromagnetic interference data.

[0018] Furthermore, the system also includes a partitioned storage unit, which divides the physical storage space into a real-time sampling area, a control command area, and a parameter configuration area. The real-time sampling area is used to store the environmental interference parameters collected by the FPGA main control module; the control command area is used to store the loop control commands issued by the distributed processing unit; and the parameter configuration area is used to store the core fixed parameters.

[0019] When the read / write timing control module performs read / write operations on the partitioned storage unit, it performs four hardware security checks in parallel: permission verification, dynamic address obfuscation verification, address boundary firewall verification, and access audit count verification.

[0020] Secondly, this invention proposes an FPGA-based industrial communication timing self-calibration and self-healing method, applied to the system described in claim 1, comprising:

[0021] The system is powered on and initialized, the internal FLASH program is loaded, and environmental interference parameters are collected.

[0022] The on-chip timing acquisition and comparison unit collects and processes the field environmental interference parameters and hardware timing data to obtain real-time timing parameters; the dynamic timing monitoring unit compares the real-time timing parameters with the system reference parameters to obtain the global timing offset error.

[0023] The dynamic phase compensation and timing correction module performs three-level timing correction based on the global timing offset error to obtain the corrected reference timing, and writes the reference timing into the read / write timing control module; wherein, the reference timing is transmitted in the form of a message;

[0024] The reference timing is written into the communication protocol parsing module by the read / write timing control module to perform dual semantic data parsing, thereby obtaining regular business messages and dedicated self-healing control messages.

[0025] The read / write timing control module writes the reference timing into the on-chip timing acquisition and comparison unit to perform abnormal timing diagnosis, initiates bidirectional calibration for abnormal timing, and sends a self-healing request after multiple rounds of bidirectional calibration failure.

[0026] Upon receiving the self-healing request, the communication protocol parsing module performs a three-level progressive, seamless self-healing process on various dedicated self-healing control messages.

[0027] Furthermore, the three-level timing correction includes dynamic coarse adjustment of the PLL global clock, small-amplitude phase compensation adjustment of the PLL, and pin-level hardware fine adjustment of the IO DELAY:

[0028] When the global timing offset error is >100ns, the PLL global clock dynamic coarse adjustment is started. The port is dynamically reconfigured through the FPGA phase-locked loop IP core to modify the phase offset parameters of each PLL output clock online. The global clock tree is phase-shifted over a wide range in 20ns fixed increments.

[0029] When 1.6ns < global timing offset error ≤ 100ns, start PLL small phase compensation adjustment, use PLL dynamic phase offset for medium range compensation, reduce the step level as needed, and gradually converge the global timing offset error to within 1.6ns;

[0030] When the global timing offset error is ≤1.6ns, IO DELAY pin-level hardware fine-tuning is initiated. With a fixed step size of 50ps, the delay of each signal is independently adjusted using the IDELAYE2 / ODELAYE2 hardware delay unit. This corrects the static inherent timing errors caused by unequal PCB trace lengths and differences in package pin delays. At the same time, independent IODELAY delay links are configured for the positive and negative signals of the RS485 differential bus, with a fixed step size of 50ps to adjust the terminal signal delay, eliminating the influence of device process and temperature on the 50ps step accuracy.

[0031] Furthermore, the step of writing the reference timing data into the communication protocol parsing module for dual-semantic data parsing to obtain regular service messages and dedicated self-healing control messages includes:

[0032] The reference timing sequence is written into the communication protocol parsing module, and dual semantic data parsing is performed based on the data length N of the reference timing sequence.

[0033] When 1≤N≤255, the current message is determined to be a regular service message. The fixed frame format of the regular service message consists of the following fields from top to bottom: 2-byte frame header + 1-byte slave address + 1-byte data length N + N-byte data field + 2-byte CRC16 checksum.

[0034] When N=0, the current message is determined to be a dedicated self-healing control message. When the dedicated self-healing control message completes four verifications: frame header feature code verification, IO module address matching verification, message frame length integrity verification, and CRC16 global data verification, the dedicated self-healing control message is allowed to trigger self-healing action.

[0035] Furthermore, the reference timing is written into the on-chip timing acquisition and comparison unit for abnormal timing diagnosis, bidirectional calibration is initiated for abnormal timing, and a self-healing request is sent after multiple rounds of bidirectional calibration failure, including:

[0036] The on-chip timing acquisition and comparison unit continuously buffers 16 complete communication timing samples of the reference timing through a 16-level sliding window register built inside the FPGA. It identifies the timing drift rate through a sliding window slope algorithm and performs a three-level timing anomaly quantization and classification based on the identification results.

[0037] When 0 < | |≤0.5ns / frame, judged as a mild timing anomaly, with slow timing drift, no immediate communication errors, and only a slight decrease in timing margin;

[0038] When 0.5ns / frame <| |≤2ns / frame, judged as moderate timing anomaly, with continuous timing drift, occasional single-frame bit errors, and continuous insufficient timing margin;

[0039] When | | > 2ns / frame, is considered a severe timing anomaly, with rapid timing deterioration, multiple consecutive bit errors, and a risk of communication interruption; where, The timing drift rate within a 16-frame sliding window is calculated using the following formula:

[0040]

[0041] and The reference timings for the nth frame and the (n-1)th frame, respectively. ;

[0042] Based on the three-level timing anomaly quantification classification, bidirectional calibration is initiated. For slowly accumulating timing drift, active reverse self-calibration is initiated during bus idle periods to iteratively optimize phase parameters. For transient hardware conflicts, a passive timing avoidance mechanism is triggered.

[0043] When multiple rounds of bidirectional calibration fail to suppress timing drift, a self-healing request of the corresponding level is sent to the communication protocol parsing module.

[0044] Furthermore, upon receiving the self-healing request, the communication protocol parsing module performs a three-level progressive, seamless self-healing process on various dedicated self-healing control messages, including:

[0045] When the self-healing request is received, the self-healing request is arbitrated according to a preset fixed priority order;

[0046] The system performs a three-level progressive, seamless self-healing process on the arbitrated signal, resetting the temporary hardware state in layers. The first level is positive timing correction, which addresses initial micro-timing offsets by linking the dynamic phase compensation and timing correction modules to perform positive timing correction. The second level is dynamic timing phase compensation and phase correction, which addresses persistent timing deviations that cannot be eliminated by positive timing correction by dynamically adjusting the bus differential phase and timing latch parameters to repair accumulated phase errors in the link. The third level is background idle window self-healing repair, which addresses stubborn timing faults that cannot be resolved by the first two levels of self-healing by waiting for the bus to be completely idle and for periods without service packet transmission to issue a dedicated self-healing control message command to complete deep timing reconstruction and repair underlying timing anomalies.

[0047] Furthermore, the fixed priority order is: severe timing anomaly request > moderate timing anomaly request > host computer manual self-healing message > timed preventive self-healing > mild timing anomaly request. The severe, moderate, and mild timing anomaly requests are self-healing requests corresponding to the three-level timing anomaly quantification classification. The host computer manual self-healing message is a timing self-healing correction action triggered by external manual intervention. The timed preventive self-healing is a periodic calibration signal generated autonomously by the system.

[0048] Furthermore, the method also includes:

[0049] After the self-healing repair is completed, the bus waveform and read / write control module timing are sampled in real time and sent to the on-chip timing acquisition and comparison unit to form an outer loop closed-loop verification. At the same time, timing abnormality logs, RAM access abnormality records, and the status of the entire self-healing process are summarized and uploaded to the engineer station through multiple channels such as serial port, bus, and distributed processing unit to complete the visual monitoring of faults and the entire process closed loop.

[0050] Compared with the prior art, the beneficial effects of the present invention are:

[0051] This invention, through a monitoring initialization mechanism, simultaneously completes environmental monitoring, timing acquisition, and storage security configuration, thus avoiding timing instability and storage access security risks during the initial power-on period. Based on a three-segment serial timing isolation architecture, it completely solves the metastability and read / write conflict problems caused by traditional coupled timing, ensuring communication timing stability at the hardware level. Through on-chip and off-chip timing monitoring and data fusion three-level timing compensation, combined with a sliding window slope prediction algorithm, it can identify latent timing drift faults in advance and distinguish between instantaneous interference and cumulative faults, significantly improving adaptability compared to traditional fixed timing schemes. Based on the standard serial port message structure, it reuses zero-length messages as self-healing instructions. With a quadruple hardware verification mechanism, zero protocol modification cost is achieved while completely avoiding false self-healing issues; the addition of RAM dynamic address obfuscation and a quadruple hardware parallel verification mechanism enables hardware protection of stored data without software encryption; an innovative passive avoidance + active calibration bidirectional timing control mode is designed to differentiate between idle and working periods for calibration without occupying normal communication bandwidth; a three-level progressive, seamless self-healing approach replaces the traditional whole-machine restart repair method, resetting temporary hardware states as needed without causing interruption to control system services; the solution is implemented using pure FPGA hardware, achieving microsecond-level response latency, effectively improving the stability and autonomous operation and maintenance capabilities of the entire DCS serial communication link. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a diagram of the overall collaborative architecture of the system proposed in the embodiments of the present invention;

[0054] Figure 2 This is a schematic diagram of the system processing flow proposed in an embodiment of the present invention. Detailed Implementation

[0055] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the present invention or its application or use.

[0056] Example 1:

[0057] This embodiment proposes an FPGA-based industrial communication timing self-calibration and self-healing system, the overall architecture of which is shown in the figure below. Figure 1 As shown, the system comprises a host computer engineering station, a DPU (Distributed Processing Unit) of the DCS (Distributed Control System), and multiple field I / O modules. The I / O modules integrate an FPGA main control module as the core control unit, which establishes a stable communication link with the DPU via an RS485 bus. The I / O modules are responsible for interfacing with field devices, comprehensively acquiring various analog, digital, and other types of field signals, and employing differentiated processing mechanisms for different signal types: various field signals are pre-processed and uniformly uploaded to the DPU for data interaction; simultaneously, the I / O modules can receive and respond to various control commands issued by the DPU in real time, realizing bidirectional data interaction between field signal acquisition and remote command execution. Furthermore, the DPU communicates with the host computer engineering station via a network cable, providing network support for system parameter configuration, equipment status monitoring, operational data viewing, and online operation and maintenance debugging.

[0058] The FPGA main control module is externally connected to FLASH, RS485 bus, temperature acquisition module, and EMI electromagnetic interference monitoring module. It loads the internal firmware in the FLASH after power-on and simultaneously starts environmental monitoring to continuously collect environmental interference parameters. Internally, it integrates a serial port transceiver control module, an on-chip timing acquisition and comparison unit, a communication protocol parsing module, a read / write timing control module, a partitioned storage unit, and a dynamic phase compensation and timing correction module. The serial port transceiver control module is used for message exchange between the distributed processing unit and the IO module. The on-chip timing acquisition and comparison unit collects environmental condition data such as board-level temperature, operating voltage, and clock jitter in real time and in parallel, along with hardware timing data such as global clock phase, IO port delay, RS485 differential phase difference, and FIFO and RAM read / write timing. It removes interference and invalid data from the collected raw data, unifies the data format and timing, and then transmits it to the dynamic timing monitoring unit. When a reference timing is received, timing diagnosis is performed, bidirectional calibration is initiated for abnormal timing, and a self-healing request is sent after multiple rounds of bidirectional calibration failure.

[0059] The dynamic timing monitoring unit is used to compare the real-time timing parameters with the system reference parameters, accurately quantify three types of timing errors: global timing offset, local pin delay, and differential signal skew, obtain the global timing offset error, and complete the error interval determination through the built-in hierarchical model, and transmit the flag to the dynamic phase compensation and timing correction module.

[0060] The dynamic phase compensation and timing correction module is used to initiate a three-level correction process for global timing offset errors, sequentially completing the adjustment of large, medium, and small deviations, and independently balancing the delay of the positive and negative terminals of the serial port, FIFO, and RS485 differential signals, ultimately converging the timing deviation of the entire link to a high-precision range of ±5ns to obtain the corrected reference timing; the corrected reference timing is then written to the read / write timing control module.

[0061] The read / write timing control module is used to write the reference timing data into the on-chip timing acquisition and comparison unit, the partitioned storage unit, and the communication protocol parsing module.

[0062] The communication protocol parsing module is used to perform dual semantic data parsing on the reference timing to obtain regular business messages and dedicated self-healing control messages. When a self-healing request is received, the module performs a three-level progressive and seamless self-healing on the dedicated self-healing control messages.

[0063] All communication, timing calibration, message parsing, and fault self-healing logic are implemented based on pure hardware logic of FPGA, ensuring accurate and controllable communication timing.

[0064] Example 2:

[0065] This embodiment proposes an FPGA-based industrial communication timing self-calibration and self-healing method based on Embodiment 1. Figure 2As shown, it includes the following steps:

[0066] S1: Power-on initialization and global detection.

[0067] After receiving external power, the FPGA loads the internal firmware program in the FLASH memory and starts the temperature acquisition module and EMI electromagnetic interference monitoring module to collect temperature drift parameters and electromagnetic interference intensity in the industrial environment.

[0068] The partitioned storage unit is configured with fine-grained management logic, dividing the RAM physical storage space into three independent partitions with non-overlapping boundaries: a real-time sampling area, a control instruction area, and a parameter configuration area. The size of each partition can be configured online via FPGA registers.

[0069] By generating dynamic address obfuscation random seeds, the storage security protection foundation is built in advance to avoid the scanning and tampering risks brought about by fixed address mapping.

[0070] In this embodiment, the address range of the real-time sampling area is 0x0000–0x1FFF, which has read-only attributes and is used to store field I / O acquisition data; the address range of the control instruction area is 0x2000–0x3FFF, which has controllable read and write attributes and is used to store loop control commands issued by the host computer; the address range of the parameter configuration area is 0x4000–0x5FFF, which has restricted read and write attributes and is used to store core fixed parameters such as communication baud rate, timing threshold, self-healing level, and fault log; the three areas are physically isolated, and the hardware prohibits cross-area address jump access; the FPGA internally presets three timing phase and delay duration lookup tables to match the optimal phase isolation parameters corresponding to different electromagnetic interference intensities and different ambient temperatures, which are stored in the parameter configuration area of ​​the on-chip RAM. The optimal timing parameters can be automatically matched by looking up the table according to the real-time temperature and electromagnetic interference intensity on site, and can be preset according to different models and manufacturers of FPGAs, solving the defects of traditional fixed timing parameters that cannot adapt to changing field conditions.

[0071] S2: Temporal fusion and three-level compensation.

[0072] The on-chip timing acquisition and comparison unit acquires four types of data: EMI electromagnetic interference data collected by the EMI electromagnetic interference monitoring module, temperature drift data collected by the temperature acquisition module, FIFO read / write timing margin, and on-chip RAM read / write timing margin. After removing random interference noise, the real-time timing parameters are obtained.

[0073] The real-time timing parameters are compared with the system baseline parameters by the dynamic timing monitoring unit to obtain the global timing offset error;

[0074] The global timing offset error is sent to the dynamic phase compensation and timing correction module. This module sequentially performs three levels of timing correction, completing the weighted fusion of multi-source data to obtain the corrected reference timing. This overcomes the shortcomings of traditional timing correction, which is only a unidirectional open-loop adjustment, lacks feedback closed-loop, and has insufficient calibration accuracy. The three levels of timing correction include PLL global clock dynamic coarse adjustment, PLL small-amplitude phase compensation adjustment, and IO DELAY pin-level hardware fine adjustment.

[0075] When the global timing offset error exceeds 100ns, it is determined that temperature and voltage drift are causing the entire board clock to be systematically ahead or behind, and dynamic coarse adjustment of the PLL global clock is initiated. The phase offset parameters of each PLL output clock are modified online through the FPGA PLL IP core DRP dynamic reconfiguration port, and a large-scale phase shift of the global clock tree is performed in fixed 20ns increments to offset the large-scale timing deviation introduced by slow time-varying temperature drift. To avoid clock jitter affecting business logic, PLL dynamic reconfiguration is only performed during idle time slots on the communication bus.

[0076] When 1.6ns < global timing offset error ≤ 100ns, start PLL small phase compensation adjustment, continue to use PLL dynamic phase offset for medium range compensation, and reduce the adjustment step as needed to gradually converge the timing error to within 1.6ns, avoiding the hardware limitation of insufficient range of IO delay unit.

[0077] When the global timing offset error is ≤1.6ns, the FPGA's on-chip IOB embedded IDELAYE2 / ODELAYE2 hardware delay unit is enabled. With a hardware fixed minimum step of 50ps, independent delay calibration is performed on the UART serial port transmit / receive pins, external FIFO read / write control and data pins to correct the static inherent timing errors caused by unequal PCB trace lengths and package pin delay differences. For RS485 differential bus signals, independent IODELAY delay links are configured for the positive and negative differential paths respectively. The terminal signal delay is adjusted separately with 50ps granularity to reduce the skewness of the differential pair's inner edge and avoid bus misjudgment caused by differential sampling time deviation. The IDELAY unit is uniformly calibrated by CAL upon power-up to eliminate the influence of device process and temperature on the 50ps step accuracy and ensure the consistency of delay levels.

[0078] The three-level timing correction converges step by step, with coarse adjustment for large deviations, fine adjustment for medium deviations, and fine adjustment for small deviations, gradually reducing timing errors and ultimately ensuring that the timing deviation of the entire link converges to within ±5ns, meeting the timing margin requirements of industrial 485 communication.

[0079] The corrected reference timing is synchronously sent to the read / write timing control module and the serial port transceiver control module to eliminate the initial timing deviation.

[0080] S3: Isolation read / write and security protocol handling.

[0081] After receiving and correcting the stable reference timing, the read / write timing control module writes the three-level corrected timing parameters into the partitioned storage unit. All interaction messages between the external DPU and the IO module are transmitted independently via the 485 bus. After being uniformly received by the FPGA serial port transceiver control module, they are directly sent to the communication protocol parsing module. The module independently completes dual semantic data parsing, distinguishing between regular business messages and dedicated self-healing control messages. Regular business messages carry on-site analog and digital acquisition data and equipment operating status information, ensuring the basic business flow such as normal data upload and downlink command execution. Dedicated self-healing control messages are system-customized timing anomaly trigger instructions. After identification, they can actively issue self-healing control signals to trigger the system's hierarchical timing self-healing review process, automatically correcting timing deviations and repairing timing anomaly faults. The fixed frame format of regular service messages, from top to bottom, consists of a 2-byte frame header, a 1-byte slave address, a 1-byte data length N, an N-byte data field, and a 2-byte CRC16 checksum. The frame header is used for bus frame synchronization and location, the slave address is used for multi-node polling on the 485 bus, the data length N indicates the length of subsequent valid data fields in bytes, and the CRC16 checksum is used for transmission link error detection. Dual semantic parsing is fully compatible with existing message formats, without modifying the original frame structure or adding message fields; it only expands the semantics of the data length N. Dedicated self-healing control messages have N=0 and an empty data field, requiring no additional message definition, are compatible with all existing devices, and maintain the same message format as regular services.

[0082] When 1 ≤ N ≤ 255, the current message is determined to be a regular business message. The read / write timing control module uses a three-stage serial isolation mechanism—serial port reception → FIFO buffer → RAM read / write—to parse the data field content. The serial port reception phase, FIFO buffer transport phase, and RAM read / write phase are each configured with an independent phase operation flag register. The three sets of flag registers use hardware mutual exclusion latching logic, allowing only one set of flags to be pulled high at any given time, while the other two sets of flags are forcibly pulled low by hardware to block them. Before the current phase completes the timing loop and the phase latch signal is manually cleared, the subsequent phase hardware circuit cannot trigger the start signal. By forcibly locking the timing execution order, multi-timing parallel operation and cross-phase jumps are prohibited, eliminating metastability and bus read / write conflicts caused by the coupling of FIFO and RAM read / write timings from the hardware level.

[0083] The read / write timing control module performs four hardware security checks synchronously and in parallel through partitioned storage units for each read / write operation of the on-chip RAM: permission verification, dynamic address obfuscation verification, address boundary firewall verification, and access audit count verification. This process does not occupy any communication clock cycles, resulting in no additional communication delay and providing comprehensive protection against security attacks such as unauthorized access, address scanning, and targeted data tampering. Specifically, permission verification matches the current operation command with the partition's read / write permissions, blocking unauthorized reads and writes; access audit count verification counts the total number of accesses and the number of abnormal accesses, latching abnormal addresses; dynamic address obfuscation verification performs encrypted conversion between the physical access address and the logical offset address; and address boundary firewall verification determines whether the physical access address exceeds the partition address range. The specific formula for dynamic address obfuscation verification is as follows:

[0084]

[0085] In the formula, For physical access address, Here, `Seed` is the logical offset address, and `Seed` is a partition-independent obfuscation seed randomly generated upon FPGA power-on. XOR is the operation for XOR; mod is the modulo operation. This corresponds to the maximum value of the partition address boundary; it is directly calculated through hardware combinational logic, breaking the fixed one-to-one mapping relationship between logical addresses and physical addresses, thus preventing data leakage.

[0086] When N=0, the current message has no valid data field and is redefined as a dedicated self-healing control message. For dedicated self-healing control messages with N=0, four checks are performed sequentially: frame header signature verification, IO module address matching verification, message frame length integrity verification, and CRC16 full-domain data verification. Self-healing action is only triggered if all four checks pass. If any check fails, it is directly judged as a random line error and the message is discarded without triggering any self-healing action, thus eliminating the problem of false self-healing. For valid self-healing control messages that pass the checks, the system supports online command refresh of the RAM dynamic obfuscation seed, updating the stored security key without system downtime. The dynamic obfuscation seed is a dynamic security key used for data verification, message encryption, and firmware anti-cracking within the FPGA. Online RAM seed refresh means that the security key can be changed remotely online without device shutdown or restart, preventing tampering.

[0087] S4: Timing diagnostics and bidirectional self-calibration.

[0088] The on-chip timing acquisition and comparison unit utilizes a 16-level sliding window register built within the FPGA to continuously buffer 16 consecutive frames of complete communication timing samples output by various timing control modules. It identifies transient interference and gradual timing drift faults using a sliding window slope algorithm, classifying timing anomalies into three levels: light, medium, and severe. This enables anomaly level calculation, overcoming the limitation of traditional single-frame threshold judgment in identifying slow timing drift. Simultaneously, it employs differentiated weighted sliding window weighted accumulation to filter invalid offset values ​​caused by single burst interference, avoiding false fault identification. The three-level timing anomaly quantification and grading standard is directly determined by hardware based on thresholds.

[0089] When 0 < | |≤0.5ns / frame, judged as a mild timing anomaly, with slow timing drift, no immediate communication errors, and only a slight decrease in timing margin;

[0090] When 0.5ns / frame <| |≤2ns / frame, judged as moderate timing anomaly, with continuous timing drift, occasional single-frame bit errors, and continuous insufficient timing margin;

[0091] When | |>2ns / frame, which is judged as a severe timing anomaly, with rapid timing deterioration, multiple consecutive bit errors, and a risk of communication interruption;

[0092] In the formula, The average slope of the temporal offset within a 16-frame sliding window is used to characterize the speed of temporal drift. The calculation formula is as follows:

[0093]

[0094] and The reference timing delays for the nth frame and the (n-1)th frame are calculated using the following formulas:

[0095]

[0096] For the actual timing delay of the nth frame, The timing delay is based on the factory standard.

[0097] The system is equipped with a bidirectional adaptive timing calibration mechanism. Through a bidirectional calibration mode of active calibration in idle state + passive avoidance of transient faults, it takes into account the dual requirements of long-term timing repair and transient fault suppression. In particular, for slowly accumulated timing drift, active reverse self-calibration is initiated during the bus idle period to iteratively optimize the phase parameters.

[0098] For transient hardware conflicts, a passive timing avoidance mechanism is triggered. The hardware monitors the FIFO empty / full flag, RAM busy / idle status, and three-segment timing mutual exclusion latch conflict flag in real time. When any transient hardware timing conflict is detected, the blocking signal comm_block is immediately pulled high, and the hardware forcibly freezes the current state machine jump clock. No timing register parameters are modified, and the clock phase is not adjusted; only the current communication timing is delayed. After the hardware conflict flag is cleared and the bus hardware is ready, the blocking signal is automatically removed, and the previous communication process continues. This method is specifically designed to handle millisecond-level transient interference conflicts, without parameter changes and without affecting the long-term timing reference.

[0099] When multiple rounds of calibration fail to suppress the fault, a self-healing request of the corresponding level is sent to the upper-layer communication protocol parsing module.

[0100] S5: Hierarchical self-healing and closed-loop feedback reporting.

[0101] The communication protocol parsing module arbitrates the self-healing request signals output by the on-chip timing acquisition and comparison unit according to a preset fixed priority order. The fixed priority order is: severe timing anomaly request > moderate timing anomaly request > host computer manual self-healing message > timed preventive self-healing > mild timing anomaly request. Severe, moderate, and mild timing anomaly requests correspond to the three levels of timing anomaly quantification and classification. The host computer manual self-healing message supports receiving host computer manual operation and maintenance instructions forwarded by the DPU, triggering controllable timing self-healing correction actions through external manual intervention. Timed preventive self-healing is when the equipment has no timing faults, the system autonomously generates periodic calibration signals to carry out low-priority routine timing preventive calibration and maintenance.

[0102] The system performs a three-level progressive, seamless self-healing process on the arbitrated signal, resetting the temporary hardware state in layers. The first level is positive timing correction, which directly links the mid-layer dynamic phase compensation and timing correction modules to correct initial micro-timing offsets without interrupting message communication, achieving a completely disturbance-free self-healing process. The second level is dynamic timing phase compensation and phase correction, which dynamically adjusts the bus differential phase and timing latch parameters to repair accumulated phase errors in the link, addressing persistent timing deviations that cannot be eliminated by positive timing correction. This only temporarily suspends message transmission and reception, without affecting core business operations. The third level is background idle window self-healing repair, which addresses stubborn timing faults that cannot be resolved by the first two levels. It waits for the RS485 bus to be completely idle and for periods without service message transmission before issuing a dedicated native zero-length self-healing message command to complete deep timing reconstruction, thoroughly repairing underlying timing anomalies. The entire self-healing process reuses the original standard message frame format without requiring changes to the original bus communication protocol in the field. The three-level progressive, seamless self-healing system upgrades and provides backup at each level from the front end to the back end without interfering with each other. The entire process only resets the FPGA timing registers and cache states, completely preserving the system's on-site acquired business data and fixed parameter configurations, without requiring a system reboot or risking data loss. After each level of self-healing is completed, the bus timing waveform is sampled in real time for closed-loop verification to confirm the current repair effect. If the current level of self-healing fails, the next level of self-healing process is automatically triggered until the communication timing returns to the standard margin range.

[0103] After each level of self-healing is completed, the FPGA samples the RS485 bus waveform and read / write timing control module back to the front-end on-chip timing acquisition and comparison unit in real time to complete the outer loop closed-loop verification. If the verification fails, it automatically proceeds to the next level of self-healing process until the timing returns to the standard margin range.

[0104] Finally, all timing anomaly logs, RAM access anomaly records, and the entire self-healing execution status are collected and synchronously uploaded to the engineering station via serial port, RS485 bus, and DPU multi-channel, forming a complete timing monitoring-calibration-self-healing closed-loop operation and maintenance link, completing the visual monitoring of faults and the entire process closed loop.

[0105] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. An FPGA-based industrial communication timing self-calibration and self-healing system, characterized in that, It includes a distributed processing unit and an I / O module, wherein the I / O module integrates an FPGA main control module, FLASH and an environmental interference parameter acquisition module; The FPGA main control module is connected to an external FLASH and an environmental interference parameter acquisition module, which is used to load the internal program of the FLASH and collect the on-site environmental interference parameters after power-on. The FPGA main control module integrates a serial port transceiver control module, an on-chip timing acquisition and comparison unit, a dynamic timing monitoring unit, a dynamic phase compensation and timing correction module, a read / write timing control module, and a communication protocol parsing module. The serial port transceiver control module is used for message exchange between the distributed processing unit and the IO module. The on-chip timing acquisition and comparison unit is used to acquire and process the field environmental interference parameters and hardware timing data to obtain real-time timing parameters; when the reference timing is received, timing diagnosis is performed, bidirectional calibration is initiated for abnormal timing, and a self-healing request is sent after multiple rounds of bidirectional calibration failure. The dynamic timing monitoring unit is used to compare the real-time timing parameters with the system reference parameters to obtain the global timing offset error; The dynamic phase compensation and timing correction module is used to perform three-level timing correction on the global timing offset error to obtain the corrected reference timing, and write the reference timing into the read / write timing control module; The read / write timing control module is used to write the reference timing into the on-chip timing acquisition and comparison unit and the communication protocol parsing module; The communication protocol parsing module is used to perform dual semantic data parsing on the reference timing to obtain regular business messages and dedicated self-healing control messages, and to perform three-level progressive seamless self-healing on the dedicated self-healing control messages when a self-healing request is received.

2. The FPGA-based industrial communication timing self-calibration and self-healing system according to claim 1, characterized in that, The environmental interference parameter acquisition module includes a field signal acquisition module, a temperature acquisition module, and an EMI electromagnetic interference monitoring module; The field signal acquisition module is used to collect environmental operating condition data, including board temperature, operating voltage, and clock jitter. The temperature acquisition module is used to acquire temperature drift data; The EMI electromagnetic interference monitoring module is used to collect EMI electromagnetic interference data.

3. The FPGA-based industrial communication timing self-calibration and self-healing system according to claim 1, characterized in that, The system also includes a host computer engineering station and a partitioned storage unit. The host computer engineering station is used to configure timing thresholds, RAM partition parameters, and self-healing judgment thresholds. The partitioned storage unit divides the physical storage space into a real-time sampling area, a control command area, and a parameter configuration area. The real-time sampling area is used to store the field environmental interference parameters collected by the FPGA main control module. The control command area is used to store loop control commands issued through the distributed processing unit. The parameter configuration area is used to store core fixed parameters. When the read / write timing control module performs read / write operations on the partitioned storage unit, it performs four hardware security checks in parallel: permission verification, dynamic address obfuscation verification, address boundary firewall verification, and access audit count verification.

4. A method for self-calibration and self-healing of industrial communication timing based on FPGA, based on the system described in any one of claims 1-3, characterized in that, include: The system is powered on and initialized, the internal FLASH program is loaded, and environmental interference parameters are collected. The on-chip timing acquisition and comparison unit collects and processes the field environmental interference parameters and hardware timing data to obtain real-time timing parameters; the dynamic timing monitoring unit compares the real-time timing parameters with the system reference parameters to obtain the global timing offset error. The dynamic phase compensation and timing correction module performs three-level timing correction based on the global timing offset error to obtain the corrected reference timing. The communication operation is performed according to the three-segment serial timing sequence of receiving data from the serial port transceiver control module, data transfer via FIFO, and reading / writing data from the read / write timing control module. The reference timing sequence is written into the read / write timing control module. The reference timing sequence is transmitted in the form of a message. The reference timing is written into the communication protocol parsing module by the read / write timing control module to perform dual semantic data parsing, thereby obtaining regular business messages and dedicated self-healing control messages. The read / write timing control module writes the reference timing into the on-chip timing acquisition and comparison unit to perform abnormal timing diagnosis, initiates bidirectional calibration for abnormal timing, and sends a self-healing request after multiple rounds of bidirectional calibration failure. Upon receiving the self-healing request, the communication protocol parsing module performs a three-level progressive, seamless self-healing process on various dedicated self-healing control messages.

5. The FPGA-based industrial communication timing self-calibration and self-healing method according to claim 4, characterized in that, The three-level timing correction includes dynamic coarse adjustment of the PLL global clock, small-amplitude phase compensation adjustment of the PLL, and pin-level hardware fine adjustment of IO DELAY: When the global timing offset error is >100ns, the PLL global clock dynamic coarse adjustment is started. The port is dynamically reconfigured through the FPGA phase-locked loop IP core to modify the phase offset parameters of each PLL output clock online. The global clock tree is phase-shifted over a wide range in 20ns fixed increments. When 1.6ns < global timing offset error ≤ 100ns, start PLL small phase compensation adjustment, use PLL dynamic phase offset for medium range compensation, reduce the step level as needed, and gradually converge the global timing offset error to within 1.6ns; When the global timing offset error is ≤1.6ns, IO DELAY pin-level hardware fine-tuning is initiated. With a fixed step size of 50ps, the delay of each signal is independently adjusted using the IDELAYE2 / ODELAYE2 hardware delay unit. This corrects the static inherent timing errors caused by unequal PCB trace lengths and differences in package pin delays. At the same time, independent IODELAY delay links are configured for the positive and negative signals of the RS485 differential bus, with a fixed step size of 50ps to adjust the terminal signal delay, eliminating the influence of device process and temperature on the 50ps step accuracy.

6. The FPGA-based industrial communication timing self-calibration and self-healing method according to claim 4, characterized in that, The step of writing the reference timing sequence into the communication protocol parsing module for dual semantic data parsing to obtain regular business messages and dedicated self-healing control messages includes: The reference timing sequence is written into the communication protocol parsing module, and dual semantic data parsing is performed based on the data length N of the reference timing sequence. When 1≤N≤255, the current message is determined to be a regular service message. The fixed frame format of the regular service message consists of the following fields from top to bottom: 2-byte frame header + 1-byte slave address + 1-byte data length N + N-byte data field + 2-byte CRC16 checksum. When N=0, the current message is determined to be a dedicated self-healing control message. When the dedicated self-healing control message completes four verifications: frame header feature code verification, IO module address matching verification, message frame length integrity verification, and CRC16 global data verification, the dedicated self-healing control message is allowed to trigger self-healing action.

7. The FPGA-based industrial communication timing self-calibration and self-healing method according to claim 4, characterized in that, The process involves writing the reference timing data into the on-chip timing acquisition and comparison unit for abnormal timing diagnosis, initiating bidirectional calibration for abnormal timing data, and sending a self-healing request after multiple rounds of bidirectional calibration failure, including: The on-chip timing acquisition and comparison unit continuously buffers 16 complete communication timing samples of the reference timing through a 16-level sliding window register built inside the FPGA. It identifies the timing drift rate through a sliding window slope algorithm and performs a three-level timing anomaly quantization and classification based on the identification results. When 0 < | |≤0.5ns / frame, judged as a mild timing anomaly, with slow timing drift, no immediate communication errors, and only a slight decrease in timing margin; When 0.5ns / frame <| |≤2ns / frame, judged as moderate timing anomaly, with continuous timing drift, occasional single-frame bit errors, and continuous insufficient timing margin; When | | > 2ns / frame, is considered a severe timing anomaly, with rapid timing deterioration, multiple consecutive bit errors, and a risk of communication interruption; where, The timing drift rate within a 16-frame sliding window is calculated using the following formula: ； and The reference timings for the nth frame and the (n-1)th frame, respectively. ; Based on the three-level timing anomaly quantification classification, bidirectional calibration is initiated. For slowly accumulating timing drift, active reverse self-calibration is initiated during bus idle periods to iteratively optimize phase parameters. For transient hardware conflicts, a passive timing avoidance mechanism is triggered. When multiple rounds of bidirectional calibration fail to suppress timing drift, a self-healing request of the corresponding level is sent to the communication protocol parsing module.

8. The FPGA-based industrial communication timing self-calibration and self-healing method according to claim 4, characterized in that, Upon receiving the self-healing request, the communication protocol parsing module performs a three-level progressive, seamless self-healing process on various dedicated self-healing control messages, including: When the self-healing request is received, the self-healing request is arbitrated according to a preset fixed priority order; The system performs a three-level progressive, seamless self-healing process on the arbitrated signal, resetting the temporary hardware state in layers. The first level is positive timing correction, which addresses initial micro-timing offsets by linking the dynamic phase compensation and timing correction modules to perform positive timing correction. The second level is dynamic timing phase compensation and phase correction, which addresses persistent timing deviations that cannot be eliminated by positive timing correction by dynamically adjusting the bus differential phase and timing latch parameters to repair accumulated phase errors in the link. The third level is background idle window self-healing repair, which addresses stubborn timing faults that cannot be resolved by the first two levels of self-healing by waiting for the bus to be completely idle and for periods without service packet transmission to issue a dedicated self-healing control message command to complete deep timing reconstruction and repair underlying timing anomalies.

9. The FPGA-based industrial communication timing self-calibration and self-healing method according to claim 8, characterized in that, The fixed priority order is: severe timing anomaly request > moderate timing anomaly request > host computer manual self-healing message > timed preventive self-healing > mild timing anomaly request. The severe, moderate, and mild timing anomaly requests are self-healing requests corresponding to the three-level timing anomaly quantification classification. The host computer manual self-healing message is a timing self-healing correction action triggered by external manual intervention. The timed preventive self-healing is a periodic calibration signal generated autonomously by the system.

10. The FPGA-based industrial communication timing self-calibration and self-healing method according to claim 4, characterized in that, The method further includes: After the self-healing repair is completed, the bus waveform and read / write control module timing are sampled in real time and sent to the on-chip timing acquisition and comparison unit to form an outer loop closed-loop verification. At the same time, timing abnormality logs, RAM access abnormality records, and the status of the entire self-healing process are summarized and uploaded to the engineer station through multiple channels such as serial port, bus, and distributed processing unit to complete the visual monitoring of faults and the entire process closed loop.

Images