Summary of the invention
The technical problem to be solved in the present invention is the defect overcoming prior art, it is provided that a kind of two take the function peace of a framework
Full controller, it is capable of high reliability and safety.
The technical scheme solving the problems referred to above is: this two take the functional safety controller of a framework, and it includes the first peace
Full MCU chip (U1), the second safe MCU chip (U2), a dual port RAM chip (U3), four isolated can transceivers (U4,
U5, U6, U7), station address reading chip (U8), the first temperature acquisition chip (U9), the second temperature acquisition chip (U10),
Two hot plug chips (U11, U12), a redundancy chip (U13), the first power management chip (U14), second source manages
Chip (U15);
Two hot plug chips provide the monitoring of respective input 5V and respective overcurrent protection respectively, and redundancy chip makes two
Road 5V becomes a road 5V;First power management chip give two safe MCU chips (U1, U2), a dual port RAM chip (U3),
Four isolated can transceivers (U4, U5, U6, U7), station address reading chip (U8), the first temperature acquisition chip (U9), the
Two temperature acquisition chip (U10) power supplies;Second source managing chip powers to the 1.2V of two safe MCU chips (U1, U2), is
The 5V of system input gives four isolated can transceivers (U4, U5, U6, U7), the first power management chip (U14), and second source manages
Chip (U15) is powered;Two safe MCU chips (U1, U2) are connected with dual port RAM chip (U3) by EMIF interface respectively;Two
Individual isolated can transceiver is coupled with CAN1 control unit interface and the CAN2 control unit interface of the first safe MCU chip (U1);Separately
Two isolated can transceivers are coupled with CAN1 control unit interface and the CAN2 control unit interface of the second safe MCU chip (U2);
Station address is read chip (U8) and is connected by IIC interface and a safe MCU chip;First temperature acquisition chip (U9) passes through
IIC interface and a safe MCU chip are connected;Second temperature acquisition chip (U10) is by SPI interface and another safe MCU
Chip is connected.
The present invention is by power safety protection, MCU module, CAN communication, station address reading, temperature acquisition, it is possible to realize height
Reliability and safety.
Detailed description of the invention
As it is shown in figure 1, this two take the functional safety controller of a framework, it includes the first safe MCU chip (U1), the
Two safe MCU chips (U2), a dual port RAM chip (U3), four isolated can transceivers (U4, U5, U6, U7), ground, a station
Chip (U8) is read in location, the first temperature acquisition chip (U9), the second temperature acquisition chip (U10), two hot plug chips (U11,
U12), a redundancy chip (U13), the first power management chip (U14), second source managing chip (U15);
Two hot plug chips provide the monitoring of respective input 5V and respective overcurrent protection respectively, and redundancy chip makes two
Road 5V becomes a road 5V;First power management chip give two safe MCU chips (U1, U2), a dual port RAM chip (U3),
Four isolated can transceivers (U4, U5, U6, U7), station address reading chip (U8), the first temperature acquisition chip (U9), the
Two temperature acquisition chip (U10) power supplies;Second source managing chip powers to the 1.2V of two safe MCU chips (U1, U2), is
The 5V of system input gives four isolated can transceivers (U4, U5, U6, U7), the first power management chip (U14), and second source manages
Chip (U15) is powered;Two safe MCU chips (U1, U2) are connected with dual port RAM chip (U3) by EMIF interface respectively;Two
Individual isolated can transceiver is coupled with CAN1 control unit interface and the CAN2 control unit interface of the first safe MCU chip (U1);Separately
Two isolated can transceivers are coupled with CAN1 control unit interface and the CAN2 control unit interface of the second safe MCU chip (U2);
Station address is read chip (U8) and is connected by IIC interface and a safe MCU chip;First temperature acquisition chip (U9) passes through
IIC interface and a safe MCU chip are connected;Second temperature acquisition chip (U10) is by SPI interface and another safe MCU
Chip is connected.
The present invention is by power safety protection, MCU module, CAN communication, station address reading, temperature acquisition, it is possible to realize height
Reliability and safety.
It addition, input two-way 5V power supply from adapter, respectively 5V1 and 5V2,5V1,5V2 are respectively through hot plug chip
(U11, U12) becomes 5V_H1,5V_H2,5V_H1 and 5V_H2 forms a road 5V power supply, through first by redundancy chip (U13)
Power management chip (U14) is changed into 3.3V, is changed into 1.2V through second source managing chip (U15).Hot plug chip has
Have the functions such as overvoltage monitoring, under-voltage monitoring, overcurrent protection, make 5V power supply in normal working range, if not normally
In the range of, will be switched off the nmos switch that hot plug chip is controlled, if it occur that cross stream, also also can disconnect it by hot plug chip
The nmos switch controlled, it is ensured that circuit below will not be damaged.
It addition, the present invention uses safe MCU, it has a multiple diagnostic method: 1, and internal double-core lock-step compares;2, internal
ECC;3, internal BIST self-inspection;4, the diagnostic method such as voltage and clock supervision.This MCU has passed through SIL3 certification, and diagnosis covers
Rate 90%.
The 1OO2 of MCU, refers to the design and uses two safe MCUs, i.e. RM48L952 (U1) and RM48L952 (U2).
First safe MCU chip (U1) obtains the data of the second safe MCU chip (U2) by dual port RAM chip (U3),
Second safe MCU chip (U2) obtains the data of the first safe MCU chip (U1), the first safety by dual port RAM chip (U3)
MCU chip (U1) compares oneself data and the data obtained from the second safe MCU chip (U2), the second safe MCU chip
(U2) oneself data and the data obtained from the first safe MCU chip (U1) are compared, after continuing executing with after more consistent
Program, if less consistent, two MCU chip will report an error, and stops code below and performs.
It addition, base and the house dog of band time window when being with band independence outside MCU chip, come execution and the crystal oscillator of monitoring programme
Drift, if there being the program of a MCU chip to perform to make a mistake or crystal oscillator drifts about, another MCU chip will be examined
Find this fault, thus take failure to safety principle, will not outwards export any data and control command.
It addition, by CAN1 bus and CAN2 bus and I/O module communication, use 4 CAN transceiver to realize bus redundancy
Communication mechanism;First safe MCU chip (U1) receives and sends an isolated can Transceiver Data by CAN1 bus, and first
Safe MCU chip (U1) receives and sends an isolated can Transceiver Data by CAN2 bus;Second safe MCU chip
(U2) receiving and send an isolated can Transceiver Data by CAN1 bus, the second safe MCU chip (U2) is total by CAN2
Line receives and sends an isolated can Transceiver Data.
RM48L952 (U1) and RM48L952 (U2) can by bus and I/O module communication, be the most all CAN1 or
Person CAN2, it is also possible to by different buses and I/O module communication, CAN1 and CAN2, say as follows is that two different buses are led to
News.The data of ADM3053 (U4) enter RM48L952 (U1) by CAN1 controller, and the data of ADM3053 (U7) pass through CAN2
Controller enter RM48L952 (U2), ADM3053 (U5) and ADM3053 (U6) hot backup redundancy, the data of RM48L952 (U1) with
The data of RM48L952 (U2) are decided by vote by CY7C024AV (U3), if voting is consistent, then report host computer or on-the-spot work
Cheng Shizhan;The data CAN2 controller of ADM3053 (U5) enters RM48L952 (U1), and the data of ADM3053 (U6) can be passed through
CAN1 controller enters RM48L952 (U2), ADM3053 (U4) and ADM3053 (U7) hot backup redundancy, the number of RM48L952 (U1)
Decided by vote by CY7C024AV (U3) according to the data with RM48L952 (U2), if voting is consistent, then report host computer or existing
Field engineer station;
Master control receive host computer or field engineer station order after, the data of the RM48L952 (U1) of master control and
Data CY7C024AV to be passed through (U3) of RM48L952 (U2) are decided by vote, and after voting is consistent, just issue corresponding I/O module.
If data are inconsistent, directly abandoning these data it is considered to be there is communication failure, two MCU can report an error, simultaneously will not
Perform program below, thus take failure to safety principle, will not outwards export any data and control command.
It addition, station address data are considered the data that safety is relevant, it to be used the framework of 1OO2, ensure
The reliability of data and safety.Reader station address is: the first safe MCU chip (U1) is read by IIC interface reader station address
The data of coring sheet (U8), the second safe MCU chip (U2) reads 5 low and high level signals, the first safe MCU chip (U1)
The data of data and the second safe MCU chip (U2) are decided by vote by dual port RAM chip (U3), if read two data
Ratio is more consistent, it is believed that be correct station address, continues executing with code below, if less consistent, then it is assumed that it is wrong,
Two MCU can report an error, and is not carried out program below, thus takes failure to safety principle, will not outwards export any number
According to and control command.
It addition, scene temperature collection is considered the data that safety is relevant, it to be used the framework of 1OO2, protect
The reliability of card data and safety.First safe MCU chip (U1) reads the first temperature acquisition chip (U9) by IIC interface
Data, the second safe MCU chip (U2) reads temperature acquisition chip the second temperature acquisition chip (U10) by SPI interface
Data, the data of the first safe MCU chip (U1) and the data of the second safe MCU chip (U2) pass through dual port RAM chip (U3)
Decide by vote, if read two scopes that data allow in error, it is believed that be correct temperature acquisition, continue executing with after
Code, if error not allow scope, then it is assumed that being wrong, two MCU can report an error, and is not carried out journey below
Sequence, thus take failure to safety principle, will not outwards export any data and control command.
It addition, safe MCU chip is RM48L952 chip, dual port RAM chip is CY7C024AV chip, and isolated can is received and dispatched
Device is ADM3053 chip, and it is PCF8574APW chip that station address reads chip, and the first temperature acquisition chip is LM75AIMME core
Sheet, the second temperature acquisition chip is ADT7302ARTZ chip, and hot plug chip is LTC4231IUD chip, and redundancy chip is
LTC4353IDE chip, the first power management chip is LM2852XMXA-3.3 chip, and second source managing chip is
LM2852XMXA-1.2 chip.
The above, be only presently preferred embodiments of the present invention, and the present invention not makees any pro forma restriction.This area
Those of ordinary skill it should be understood that every technical spirit according to the present invention any simply repairing that above example is made
Change, equivalent variations and modification, the most still belong to the protection domain of technical solution of the present invention.