Although the CAN protocol itself has a strong error detection and correction capability, in the industrial control site, the plug connection is not solid, the transmission medium is damaged or the bus driver is damaged, etc. will destroy the reliable communication of CAN. In the application system that requires high reliability, these faults, if not automatically detected and take appropriate measures to overcome, will make the system partially or even completely lose the ability to communicate. An effective way to solve this problem is to use redundant communication control. This ensures that the main functions of the communication system operate normally, thereby improving the reliability of the system.
1 System Hardware Components
The MB90F543 is a 16-bit microcontroller with two CAN controllers from Fujitsu. The system uses two sets of buses (CAN0, CAN1), each of which contains independent bus cables, bus drivers and bus controllers, which can realize full redundancy of physical media, physical layer, data link layer and application layer. The two sets of buses operate in a hot backup mode: one CAN controller serves as the default CAN after the system is powered on (which can be called the master CAN); the other serves as the system's standby CAN (which is called the slave CAN) and serves as a redundancy for the master CAN. When the system works normally, the master CAN bus (CAN0) is put into operation. When the master CAN bus fails, the slave CAN bus (CAN1) goes into operation. If power-up detects a fault in the master CAN bus, the slave CAN bus is automatically put into operation. In this way, when one set of buses fails, the other set of buses will automatically continue to work to ensure the normal operation of the communication function of the whole system, which greatly improves the reliability of the system and realizes the comprehensive redundancy design of the CAN bus. In addition, according to the needs of the software can also be set to take the redundant or non-redundant mode. For the non-redundant mode, only the main CAN bus is used.
System Architecture Block Diagram
RT is the bus termination matching resistor, used to suppress signal emission interference, RT = 100Ω or 120Ω. The network uses shielded twisted pair cable as the communication medium.
The CAN controller integrates the physical layer and data link layer functions of the CAN protocol, and can complete the framing process of data communication, including bit padding, data block coding, CRC checksum and priority discrimination.
The CAN controller has the following main features:
◇ Conforms to CAN2.0A and CAN2.0B protocols.
◇Supports sending and receiving of data frames and remote frames.
◇ 16 send/receive message buffers, supporting 11-bit or 29-bit identifiers and multi-level message buffer structure; ◇ Supports full-bit comparison, full-bit comparison, and full-bit comparison.
◇ Supports three acceptance identification selection methods: full-bit comparison, full-bit masking and bit masking acceptance; ◇ Two acceptance identification registers.
◇ Two acceptance identification registers support standard frame or extended frame format.
◇ The baud rate is programmable from 10Kbps to 1Mbps.
The bus driver adopts PCA82C250 as the interface between the CAN controller and the physical bus to enhance the differential transmission and reception capability of the bus.
2 System Software Design
2.1 Realization of dual CAN redundant control function
In the dual CAN redundancy system, compared with the hardware structure, the software design is relatively more complex. The general CAN bus communication program must include three basic parts: CAN initialization program, CAN transmission program and CAN reception program. In this redundant system software design, the above three parts are used as the three most basic modules for other software modules of the system to call.
MB90F543 can handle 256 kinds of interrupt sources, and there are four hardware interrupts related to the CAN controller: CAN0 RX (CAN0 receive complete interrupt), CAN0 TX /NS (CAN0 send complete/node state change interrupt), CAN1 RX (CAN1 receive complete interrupt), CAN1 TX /NS (CAN1 send complete/node state change interrupt). CAN1 TX /NS (CAN1 transmit complete/node status change interrupt). In this software design, query send and interrupt receive are used. The node state change interrupt subroutine is used for the processing of node state change. This is because the CAN2.0 protocol specifies that the node is in one of the following three states: error-activated state, error-ignored state, and off-bus state. In the MB90500 series, there is also an additional warning state, which indicates that the value of the transmit/receive error counter has exceeded 96, and a change in the node state will cause a corresponding interrupt.
Since the system operates with dual CAN redundancy hot standby, both CAN controllers must be in the hot standby state. Both CAN controllers of all nodes in the system are initialized to be ready to receive messages at any time, but one and only one CAN controller is sending messages. In other words, at one point in time, one and only one of the CAN channels is active, while the other one is listening (in normal operation) or in a fault state (in the event of a failure).
The key to the complexity of the software design of a dual CAN redundant control system compared to a single CAN control system lies in the CAN system fault detection and automatic switching of the CAN system. Due to the use of two sets of completely independent transmission media, bus drivers and bus controllers, so they can be detected independently of their own channel faults, such as CANH and CANL short-circuit, CANH or CANL disconnect, CANH and ground short-circuit, CANL and power short-circuit, bus driver damage, and so on. In the actual debugging, it is found that if CANH, CANL is disconnected or there is only one transmitter on the bus, it will cause the transmit/receive error counter to increase to 128, which puts the node in the ignored error state; and a short-circuit between CANH and CANL, a short-circuit between CANH and ground, or a short-circuit between CANL and the power supply will cause the transmit/receive error counter to increase to 256, which puts the node in the bus Disconnected state. Therefore, by calling the CAN redundancy module in the node state change interrupt subroutine, we can achieve the above purpose of automatic fault detection and automatic switching of the CAN system.The CAN0 node state change interrupt subroutine is as follows:
__interrupt void NodeStateTransmitInt0 (void)
{
if (CSR0_NT) /* node state change */
{
CSR0_NT = 0; /*Interrupt flag reset */
if ( (CSR0_NS = =2 ) (CSR0_NS = =3 ) ) /* interrupt or short circuit caused */
{
NoWaitFlg = 1; /* a mutually exclusive flag */
Bus0Error( ) ; /* Bus0Error( ) stops CAN0 and starts the redundant CAN1 subroutine */ { NoWaitFlg = 1; /* a mutex flag */
}
}
ICR00 =3; /* change interrupt priority to Timer0 interrupt priority */ }
ICR03 =2; /* Change interrupt priority to prioritize timer 0 interrupt */ }
}
In addition, in the CAN bus communication process, when the data transmission of a certain information buffer is completed, the corresponding bit in the transmission completion register will be set to 1. In the process of querying the transmission, by judging this register, you can know whether the transmission is completed or not. However, if the sending is not successful, it will make the system wait all the time and cause the system to crash. Therefore, the software must set a waiting period here, beyond which the CAN redundancy system will be called to stop the master CAN channel and enable the slave CAN channel.
The software design should also pay attention to the problem of how to restore the original communication task after the backup CAN switching is completed. The solution is to prepare a list of task flags, standby CAN switching, read the table to get the original task of the system, to achieve the original communication task of reliable switching.
2.2 Realization of bus management function
In the software design of this system, in addition to the real-time data communication program for data transmission and reception, it also includes the communication management program for the management of each node. All nodes are divided into master nodes and slave nodes. The difference between them is that the master node has a bus management function, which allows it to perform online node statistics, recognize offline nodes and take measures to deal with them; while the slave node does not have this function. There is only one master node, while multiple slave nodes are allowed. Bus management function program for the master node called every once in a while, to determine whether all the nodes are online: if all the nodes are online, the bus is considered normal; otherwise, identify offline nodes, and deal with it accordingly. The design idea is that the system master node sends a remote frame to all slave nodes on the bus at regular intervals, and each slave node receives it, puts its own node number in a data frame and sends it to the master node, and the master node determines whether there is a node failure offline according to the node number it receives. In this system, the node number (module address) is set by a DIP switch on the module.
In the process of software debugging, although the hardware structure of each node is the same, due to the differences in circuit board wiring and component dispersion, it is often the case that not all slave nodes can receive the information sent by the master node, or the master node does not receive all the information sent by the slave nodes, i.e., there is a frame loss problem. This problem has been solved by software delay and optimization of receiving interrupt program.
3 Development environment and application should pay attention to several issues
Softune V3 software workbench is an integrated software development environment for Fujitsu FFMC-8L, FFMC-16L/LX and FR series microcontroller program development, including development management, emulator debugging, soft simulation and an integrated development environment. Its development toolkit includes Softune Workbench, C compiler, Assembler, Linker, C Checker, C Analyzer. Softune V3 supports both C and assembly languages.
During the actual use of MB90F543, the following issues should be noted.
① The setting of the Acceptance Mark Selection Register (AMSR). Each message buffer can select one acceptance marking method: full bit comparison, full bit mask or bit mask acceptance. Full-bit comparison means that the ID of the information received by the node needs to be exactly the same as the ID set by the information buffer in order for the information to pass the acceptance identifier; full-bit masking does not need to compare the ID of the information, which can be interpreted as the unconditional passing of the acceptance identifier; bit-masking acceptance can specify the ID bits to be compared and the ID bits to be masked, i.e., partially comparing the acceptance. In practice, this acceptance identifier method is used most often, so two such methods are set in the CAN controller of MB90F543 chip. the setting of AMSR provides great flexibility for the developer to process the buffer information.
② Acceptance Marking Register (AMR) setting. After AMSR is set to the bit-masked acceptance method, AMR must be set to set which bits of the ID are to be compared and which bits are to be masked.AMR has a total of four bytes and supports 29-bit ID characters. However, it is worth noting that for the 29-bit ID character, AM28~AM0 is used; while for the 11-bit ID character, AM28~AM18 is used. therefore, the user must be careful when setting AMR, or it will result in reception error. The author has suffered here.
③ One of the features of Fujitsu's CAN controller is that it supports the use of multi-level message buffers. In the case where reception occurs frequently, or several different ID information frames are received, it is possible that the CPU does not have enough time to process the received information, so multiple information buffers can be formed into a multi-level information buffer to ensure that the information can be processed in a timely and efficient manner. In this way, information larger than 8 bytes can be sent in 1 frame. Another advantage of this arrangement is that the CPU can read the information of a certain information buffer without having to worry about the buffer information being rewritten and lost immediately.
4 Conclusion
In the development process of CAN application layer protocol, some mechanisms of DeviceNet specification are borrowed, such as supporting multiple forms of data transmission (selective pass, polling, state change, etc.); however, due to the limitations of many factors such as the development cycle, the diagnostic function of the device as well as the interoperability with similar products need to be improved and expanded. The dual CAN redundant communication system works stably in the experimental stage, the data transmission is reliable, the redundancy switching is practicable, and the reliability of the bus management is good; it can be applied to the locomotive control system or other industrial control sites that require high reliability.