CN103139060B - Based on the high fault tolerance CAN digital gateway of two CSTR - Google Patents

Abstract

The invention relates to a highly fault-tolerant CAN bus digital gateway based on double DSPs, belonging to the technical field of CAN bus gateways. The invention aims to solve the problem that the existing CAN bus gateway will cause communication interruption when a single sub-node fails as a whole, resulting in data frame loss or large delay. It includes master node, slave node, dual redundant CAN network A, dual redundant CAN network B, non-redundant sub-network bus #E1 and non-redundant sub-network bus #E2, dual redundant CAN network A includes Network bus #A1 and network bus #A2; dual redundant CAN network B includes network bus #B1 and network bus #B2; it provides dual-link redundant CAN backbone network, CAN backbone network and single-link Protocol conversion and data caching and forwarding between non-redundant CAN subnets. The invention serves as a CAN bus digital gateway.

Description

High Fault Tolerance CAN Bus Digital Gateway Based on Double DSP

technical field

The invention relates to a high fault-tolerant CAN bus digital gateway based on double DSPs, and belongs to the technical field of CAN bus gateways.

Background technique

CAN bus technology has been widely used in the field of industrial automation, which has excellent characteristics such as high reliability, anti-interference, simple structure and low cost. With the maturity of technology, CAN bus is gradually moving towards SCS in safety-critical fields such as aerospace, aviation, energy and medical health, and the development prospect is very broad.

However, safety-critical systems not only involve complex cascading and frequent interoperability among a large number of electronic devices, but also require large-scale networking and high transmission performance requirements. Once the system function fails, it will cause heavy loss of life and property. Therefore, the design or operator often puts the reliability of the system in the most important position. The network that constitutes the safety-critical system is not just a LAN with a single structure, but multiple regional subnets interconnected and multiple network topologies and protocols are used to isolate faults, balance bandwidth and simplify wiring; CAN bus with redundant mechanism to enhance the reliability of the system and the certainty of message transmission.

Therefore, as the infrastructure for complex networks, it is very important whether the CAN gateway can effectively support the networking of such safety-critical systems and meet its design constraints, especially the reliability requirements. The existing CAN bus gateway design has the following two defects:

1. Most of the existing CAN bus gateways adopt a local redundant structure, that is, only the links, transceivers and controller hardware of the CAN bus are backed up. Although it can deal with single faults or combination faults in transmission medium damage, loose ports, and bus driver failures, it is powerless against gateway CPU failures, power supply module failures, and even overall failures of control boards.

2. The existing CAN gateway does not realize real hot redundancy in terms of communication mechanism, and only monitors in real time from the backup node or port. Once the master node or port fails, it still needs to switch between the master and slave nodes, which introduces a certain self-healing time, that is, the switching time, so it is easy to cause data frame loss or large delay, which is for It cannot be tolerated by systems with high reliability and certainty requirements.

Contents of the invention

The purpose of the present invention is to solve the problem that the existing CAN bus gateway will cause communication interruption when the overall failure of a single sub-node, resulting in data frame loss or large delay, and provides a high fault-tolerant CAN bus digital bus based on dual DSP. gateway.

The high fault-tolerant CAN bus digital gateway based on dual DSPs of the present invention includes a master node, a slave node, a dual redundant CAN network A, a dual redundant CAN network B, a non-redundant sub-network bus #E1 and a non-redundant sub-network bus #E1. Redundant Subnetwork Bus #E2,

Dual redundant CAN network A includes network bus #A1 and network bus #A2;

Dual redundant CAN network B includes network bus #B1 and network bus #B2;

The master node includes DSP#A1, DSP#A2, CAN bus port #A11, CAN bus port #A12, CAN bus port #A21 and CAN bus port #A22;

The slave nodes include DSP#B1, DSP#B2, CAN bus port #B11, CAN bus port #B12, CAN bus port #B21 and CAN bus port #B22;

Data is transmitted between DSP#A1 and DSP#A2 through SPI data channel, DSP#A1 is connected to network bus #A1 through CAN bus port #A11, DSP#A1 is connected to non-redundant sub-network bus #E1 through CAN bus port #A12 Connection, DSP#A2 is connected to network bus #B2 through CAN bus port #A21, DSP#A2 is connected to non-redundant sub-network bus #E2 through CAN bus port #A22;

Data is transmitted between DSP#B1 and DSP#B2 through the SPI data channel, DSP#B1 is connected to the network bus #B1 through the CAN bus port #B11, and DSP#B1 is connected to the non-redundant sub-network bus #E2 through the CAN bus port #B12 Connection, DSP#B2 is connected to network bus #A2 through CAN bus port #B21, DSP#B2 is connected to non-redundant sub-network bus #E1 through CAN bus port #B22;

Between DSP#A1(1-1) of the master node (1) and DSP#B1(2-1) and DSP#B2(2-2) of the slave node (2), DSP#A2 of the master node (1) (1-2) transmits data through the SPI data channel between DSP#B1(2-1) and DSP#B2(2-2) of the slave node (2).

The master node also includes CAN driver #A11, CAN driver #A12, CAN driver #A21 and CAN driver #A22,

CAN driver #A11 is set between DSP#A1 and CAN bus port #A11, CAN driver #A12 is set between DSP#A1 and CAN bus port #A12, CAN driver #A21 is set between DSP#A2 and CAN bus port# Between A21, CAN driver #A22 is set between DSP#A2 and CAN bus port #A22;

The slave node also includes CAN driver #B11, CAN driver #B12, CAN driver #B21 and CAN driver #B22,

CAN driver #B11 is set between DSP#B1 and CAN bus port #B11, CAN driver #B12 is set between DSP#B1 and CAN bus port #B12, CAN driver #B21 is set between DSP#B2 and CAN bus port# Between B21, CAN driver #B22 is set between DSP #B2 and CAN bus port #B22.

The master node also includes main storage #A1 and main storage #A2,

The main memory #A1 is connected to the DSP#A1 through an external expansion interface, and the main memory #A2 is connected to the DSP#A2 through an external expansion interface;

The slave node also includes slave memory #B1 and slave memory #B2,

The slave memory #B1 is connected to the DSP#B1 through the external expansion interface, and the slave memory #B2 is connected to the DSP#B2 through the external expansion interface.

It also includes LCD display and operator,

The liquid crystal display and the manipulator are used as man-machine interface, respectively connected with DSP#A1, DSP#A2, DSP#B1 and DSP#B2.

It also includes a power supply, which is used to provide working power for DSP#A1, DSP#A2, DSP#B1 and DSP#B2.

Advantages of the present invention: the digital gateway of the present invention has high fault tolerance, and it can realize dual-mode thermal redundancy of the whole system including link ports, bus transceivers, bus controllers, gateway CPU and power supply modules, etc. Under the condition of partial or overall failure of a single sub-node inside the gateway, it can still ensure that the communication will not be interrupted, and there will be no self-healing time, which is conducive to comprehensively improving the fault tolerance and reliability of network interconnection.

The present invention has strong compatibility and versatility, and provides protocol conversion and data high-speed buffering between dual-link redundant CAN backbone networks, and between CAN backbone networks and single-link non-redundant CAN subnets. Forwarding can significantly reduce the communication delay between networks, and is suitable for promotion and popularization in the actual industrial field.

The present invention has a double-channel fully thermally redundant network bridging channel, which can still ensure that the real-time connection between the two networks will not be interrupted in the case of a single channel failure, and has extremely high reliability. It adopts a DSP chip integrated with rich control modules and high-performance CPU, which enhances the data processing and the speed of CAN bus transceiver control, and greatly reduces the technical delay of the gateway. The invention uses the SPI interface instead of the dual-port RAM to realize high-speed data exchange between the double DSPs, simplifies the wiring, reduces the cost, reduces the influence of the electromagnetic interference in the board on the high-speed data communication, and improves the reliability of the system.

The invention has a strong fault diagnosis function, and the master node and the slave node can find faults in time through periodic or time-triggered mutual inspection and self-inspection and give an alarm to the upper computer, which is beneficial to the reliable operation and replacement and maintenance of the system. Equipped with a liquid crystal display and an operator, the gateway is easy to use and operate, and the operating status can be monitored and obtained by the user in real time. Compared with other existing products: there is currently no similar technical product on the market that can be applied to industrial fields that require very high reliability.

Description of drawings

Fig. 1 is the structural block diagram of the high fault-tolerant CAN bus digital gateway based on double DSP of the present invention;

Fig. 2 is the internal structural block diagram of master node and slave node;

Figure 3 is a connection diagram of the dual redundant CAN network A and the dual redundant CAN network B bridging each other through the CAN gateway;

Fig. 4 is a connection relationship diagram of non-redundant sub-network bus #E1 and non-redundant sub-network bus #E2 bridged by CAN gateway;

Fig. 5 takes the bridging between non-redundant sub-network bus #E1 and non-redundant sub-network bus #E2 as an example, the working flow diagram of the master node;

Fig. 6 takes the bridging between non-redundant sub-network bus #E1 and non-redundant sub-network bus #E2 as an example, the work flow chart of the slave node;

Fig. 7 is a schematic diagram of data forwarding channels of a redundant network and a non-redundant network;

Fig. 8 is a schematic diagram of a network of on-board electronic equipment applied to a small commercial regional aircraft according to the present invention.

Detailed ways

Specific embodiment one: the present embodiment is described below in conjunction with Fig. 1, the high fault-tolerant CAN bus digital gateway based on double DSP described in the present embodiment, it comprises master node 1, slave node 2, dual-way redundant CAN network A3, dual redundant CAN network B4, non-redundant sub-network bus #E15 and non-redundant sub-network bus #E26,

Dual redundant CAN network A3 includes network bus #A1 and network bus #A2;

Dual redundant CAN network B4 includes network bus #B1 and network bus #B2;

Master node 1 includes DSP#A11-1, DSP#A21-2, CAN bus port #A111-3, CAN bus port #A121-4, CAN bus port #A211-5 and CAN bus port #A221-6;

Slave node 2 includes DSP#B12-1, DSP#B22-2, CAN bus port #B112-3, CAN bus port #B122-4, CAN bus port #B212-5 and CAN bus port #B222-6;

Data is transmitted between DSP#A11-1 and DSP#A21-2 through SPI data channel, DSP#A11-1 is connected to network bus #A1 through CAN bus port #A111-3, and DSP#A11-1 is connected to network bus #A1 through CAN bus port# A121-4 is connected to non-redundant sub-network bus #E15, DSP#A21-2 is connected to network bus #B2 through CAN bus port #A211-5, DSP#A21-2 is connected to non-redundant subnetwork bus #A221-6 through CAN bus port I sub-network bus #E26 connection;

Data is transmitted between DSP#B12-1 and DSP#B22-2 through the SPI data channel, DSP#B12-1 is connected to the network bus #B1 through the CAN bus port #B112-3, and DSP#B12-1 is connected to the network bus #B1 through the CAN bus port# B122-4 is connected to non-redundant sub-network bus #E26, DSP#B22-2 is connected to network bus #A2 through CAN bus port #B212-5, DSP#B22-2 is connected to non-redundant subnetwork bus #B222-6 through CAN bus port I sub-network bus #E15 connection;

Data is transmitted between DSP#A11-1 and DSP#A21-2 of the master node 1 and DSP#B12-1 and DSP#B22-2 of the slave node 2 through the SPI data channel.

As shown in Figure 1, the interior of the digital gateway is mainly composed of two identical sub-nodes that are independent of each other, which are called the master node 1 and the slave node 2 of the gateway respectively. The master node 1 and the slave node 2 are completely isolated physically, they are powered on at the same time, they have cooperation and division of labor for different tasks, and they are only loosely coupled through the non-redundant sub-network bus #E15 and the non-redundant sub-network bus #E26 The connection is functionally a relationship of hot backup for each other.

Eight independent CAN bus ports are provided in this embodiment, namely CAN bus port #A111-3, CAN bus port #A121-4, CAN bus port #A211-5, CAN bus port #A221-6, CAN bus port #B112-3, CAN bus port #B122-4, CAN bus port #B212-5 and CAN bus port #B222-6, can realize dual redundant CAN network A3 and dual redundant CAN network B4, dual Internet bridge between one-way redundant CAN network A3 and two-way redundant CAN network B4 and non-redundant sub-network bus #E15 and non-redundant sub-network bus #E26, in case of partial or overall failure of master node or slave node In some cases, it can still be downgraded to ensure uninterrupted connectivity between networks.

Specific embodiment two: The present embodiment will be described below in conjunction with Fig. 1 and Fig. 2, and this embodiment will further explain the first embodiment, the master node 1 described in this embodiment also includes CAN driver #A111-7, CAN driver #A121-8 , CAN driver #A211-9 and CAN driver #A221-10,

CAN driver #A111-7 is set between DSP#A11-1 and CAN bus port #A111-3, CAN driver #A121-8 is set between DSP#A11-1 and CAN bus port #A121-4, CAN driver #A211-9 is set between DSP#A21-2 and CAN bus port #A211-5, CAN driver #A221-10 is set between DSP#A21-2 and CAN bus port #A221-6;

Slave node 2 also includes CAN driver #B112-7, CAN driver #B122-8, CAN driver #B212-9 and CAN driver #B222-10,

CAN driver #B112-7 is set between DSP#B12-1 and CAN bus port #B112-3, CAN driver #B122-8 is set between DSP#B12-1 and CAN bus port #B122-4, CAN driver #B212-9 is set between DSP#B22-2 and CAN bus port #B212-5, CAN driver #B222-10 is set between DSP#B22-2 and CAN bus port #B222-6.

In this embodiment, the DSP chip is used as the core module of the gateway sub-node, and the CPU and the CAN bus control module are integrated inside. Its operation speed is fast and its reliability is high. And data cache, and through three data channels of SPI, CAN#E1 and CAN#E2, based on certain algorithms such as information redundancy, information redundancy, data shaping, scheduling control, etc., according to actual needs, different network Protocol conversion and data forwarding between.

Specific implementation mode 3: The following describes this implementation mode in conjunction with FIG. 2 . This implementation mode further explains implementation mode 2. The master node 1 in this implementation mode also includes a main memory #A11-11 and a main memory #A21-12.

The main memory #A11-11 is connected with the DSP#A11-1 through the external expansion interface, and the main memory #A21-12 is connected with the DSP#A21-2 through the external expansion interface;

Slave node 2 also includes from memory #B12-11 and from memory #B22-12,

The slave memory #B12-11 is connected with the DSP#B12-1 through the external expansion interface, and the slave memory #B22-12 is connected with the DSP#B22-2 through the external expansion interface.

The two DSPs are interconnected through the SPI serial port, which not only provides data exchange at a rate of up to 10M/b, but also takes into account the anti-interference and reliability of transmission. The CAN driver can realize the physical layer function of differential code and binary data conversion. Each DSP is equipped with a memory SRAM for buffering data frames to be forwarded, and the DSP and the memory SRAM are connected through an external expansion interface XINTF.

Specific embodiment four: the present embodiment will be described below in conjunction with FIG. 2 . This embodiment will further describe embodiment one, two or three. This embodiment also includes a liquid crystal display and an operator 7.

The liquid crystal display and manipulator 7 are used as the man-machine interface, respectively connected with DSP#A11-1, DSP#A21-2, DSP#B12-1 and DSP#B22-2.

The liquid crystal display and the manipulator 7 are used as the man-machine interface for configuration and fault alarm of the sub-nodes of the gateway.

Specific embodiment five: the present embodiment is described below in conjunction with Fig. 1 to Fig. 8, and present embodiment is further described to embodiment one, two, three or four, and present embodiment also includes power supply 8, and power supply 8 is used for DSP#A11 -1, DSP#A21-2, DSP#B12-1 and DSP#B22-2 provide working power.

Working principle and operation process of the present invention:

Bridge between dual redundant CAN network A3 and dual redundant CAN network B4:

The dual-channel redundant CAN network A3 and the dual-channel redundant CAN network B4 are bridged to each other through the CAN gateway, as shown in FIG. 3 . At this time, the master node 1 and slave node 2 of the gateway work synchronously to realize bidirectional forwarding of data frames of the two networks. and The two data channels are hot backup for each other, and the on-off of links P, Q, and Z is connected to the CAN#A11 port, CAN#A21 port, CAN transceiver, DSP#A1, DSP#A2 and SPI between the dual DSPs of the gateway master node. The health status of the interface is related, and the on-off of the links L, M and N is related to the CAN#B21 port, CAN#B11 port, CAN transceiver, DSP#B1, DSP#B2 and the SPI interface between the dual DSPs of the gateway slave node. related to health status.

Because the slave node and the master node are completely independent of each other, it is assumed that some kind of software or hardware failure occurs on the master node of the gateway to cause the The data channel is disconnected, then the data channel of the gateway It can still work normally and will not cause interruption of data transmission between the two networks, that is, the communication nodes in the dual redundant CAN network A3 and the dual redundant CAN network B4 can still pass the link Similarly, when a partial or global failure occurs in a slave node, the master node of the gateway can also complete the interconnection between the two networks.

Bridge between non-redundant subnet bus #E15 and non-redundant subnet bus #E26:

The non-redundant sub-network bus #E15 and the non-redundant sub-network bus #E26 are bridged to each other through the CAN gateway, as shown in FIG. 4 . At this time, the master node and the slave node of the gateway work at the same time, monitor each other, and each has a division of labor. The master node is responsible for the real-time two-way forwarding of data frames between the two networks, while the slave node does not forward the data frames temporarily after receiving the data frames, but monitors the data frames forwarded by the master node within the waiting time window Skew_Max, and compares the data frames received by itself The data frame and the content and serial number of the data frame forwarded by the master node are monitored to determine whether the master node has a frame error, frame loss, transmission interruption or large delay during the data frame forwarding process. If it is monitored that the above-mentioned errors occur on the master node, the slave node will reissue the correct data frame in real time, send a fault query frame to the master node and alarm the host computer. At this time, the slave node can be manually set as the master node under failure conditions, or the slave node can automatically switch to the master node when the master node repeatedly fails, and the switching process will not cause communication interruption. Taking the bridging between the non-redundant sub-network bus #E15 and the non-redundant sub-network bus #E26 as an example, the workflows of the master node and the slave node are shown in Figure 5 and Figure 6 respectively.

According to the above principle, even if the master node or the slave node has a partial failure or a serious situation of overall failure, the mutual communication between the non-redundant sub-network bus #E15 and the non-redundant sub-network bus #E26 will still not be interrupted, and the waiting time The setting of the window Skew_Max does not exceed 1ms, that is, once the master node fails, the technical delay introduced by the reissued data frame of the slave node will not exceed 1ms, and the CAN bus communication at this time is still determined at the millisecond level. This maximum structure redundancy method and hot backup work method have greatly improved the reliability of the CAN gateway.

Bridging redundant and non-redundant networks:

The invention can realize the bridging between redundant CAN network and non-redundant CAN network. The network bus #A1 and the network bus #A2 are mutually thermally redundant, as shown in Figure 7, the channel (1) in the figure realizes the data forwarding between the network bus #A1 and the non-redundant sub-network bus #E15, and the channel (2 ) realizes the data forwarding between the network bus #A2 and the non-redundant sub-network bus #E15, and the two data channels are mutually hot backup. Similarly, channels (3) and (4) implement data forwarding between network bus #B1 or network bus #B2 and non-redundant sub-network bus #E2.

The bridging between redundant network and non-redundant network is divided into redundant process and non-redundant process. The following is an example of bridging between redundant network bus #A1 or network bus #A2 and non-redundant sub-network bus #E15 Specific instructions:

Redundant process:

The non-redundant sub-network bus #E15 to the network bus #A1 or the network bus #A2 is a redundant process, which involves the CAN gateway to perform information redundancy on the data frame on the non-redundant sub-network bus #E15 and forward it to the network at the same time The bus #A1 and the network bus #A2 are on two mutually hot redundant communication links. In the redundancy process, the gateway master node and the slave node are equal, and complete the same data frame forwarding process. Moreover, in order to minimize the technical delay introduced by gateway data processing, no real-time comparative monitoring is performed during the forwarding process. Regardless of whether it is the master node or the slave node, when receiving the data frame of the non-redundant sub-network bus #E15, it will forward it immediately as long as the verification is correct. At the same time, in order to ensure the synchronization between the master node and the slave node of the gateway, the two nodes will perform periodic synchronization and status mutual check through the non-redundant sub-network bus #E15 during the working process.

De-redundancy process: from network bus #A1 and network bus #A2 to non-redundant sub-network bus #E15 is a de-redundancy process. Master node 1 and slave node 2 are based on a certain de-redundancy control algorithm, and the control algorithm It is related to the specific protocol adopted by the CAN network. Here, taking the ARINC825 protocol as an example, the data frames on the network bus #A1 and the network bus #A2 are de-redundant, and then forwarded to the non-redundant sub-network bus #E15. During the de-redundancy process, the master node of the gateway is responsible for data forwarding, while the slave node only forwards the data frame received by its CAN bus port #B212-5 to the master node when the gateway is working normally, and the master node completes For the two paths with the same serial number, that is, the comparison check of the data frames that are mutually backup, the removal of redundant information and the forwarding to the non-redundant sub-network bus #E15. During the de-redundancy process, due to the transmission delay and failure of the dual redundant link, the following three situations will occur, corresponding to the three working modes of the gateway:

1 Assuming that due to the failure of the slave node or the delay of the network bus #A2, the CAN bus port #A111-3 of the master node first receives the data frame sent by the network bus #A1 to the non-redundant sub-network bus #E1, then its It will wait for the backup frame forwarded from the slave node through the non-redundant subnetwork bus #E1 within the waiting time window Skew_Max. If the master node can receive the backup frame from the slave node within the waiting time window and can pass the comparison check, the master node will forward the frame externally and update the sequence number judgment threshold PSN=PSN+1, at this time it can be regarded as a gateway and link status are in good range. If the backup frame sent by the slave node is received within the time window but the comparison check fails, then it is considered that there is a disturbance on the link or inside the slave node, and the master node will report an error to the host computer and request the dual redundant CAN network A3 The corresponding end node resends the frame. If the backup frame of the slave node is not received within the waiting window, the master node will directly forward the received data frame to the non-redundant sub-network bus #E15, and then send a status query frame to the slave node and troubleshoot the upper computer. Alarm to inform the user that a frame loss has occurred.

2 Assuming that due to the failure of the master node port or the delay of the network bus #A1, the master node first receives the backup frame forwarded by the slave node through the non-redundant sub-network bus #E15, then it will wait within the waiting time window Data frames with the same sequence number on network bus #A1. Then, if the data frame is received within the waiting time window and passes the comparison check, the master node will forward the frame externally. If the frame is not received within the waiting time window, the backup frame sent from the node is forwarded to the non-redundant subnetwork bus #E15, and the sequence number judgment threshold PSN=PSN+1 is updated, and the upper computer is faulted Call the police.

3 Assuming that due to the permanent failure of the master node or the disconnection of the network bus #A1, etc., after the slave node successfully forwards the backup frame on the network bus #A2 to the master node, it will not monitor the external forwarding of the master node within the waiting time window At this time, the slave node will directly forward the backup frame to the outside, and update the sequence number judgment threshold PSN=PSN+1, and at the same time issue a fault alarm to the upper computer.

The invention can be applied to the networking of airborne electronic equipment of small-scale commercial regional aircraft, and completes the bridging between the backbone network of the avionics system and the partition sub-network based on the aviation CAN bus, that is, the ARINC825 bus. As shown in Figure 8, CAN#A1/CAN#A2 and CAN#B1/CAN#B2 constitute two dual-redundant backbone networks of a small commercial branch aircraft electronic system, among which CAN#A1/#A2 are airborne electronic equipment The actuator network of CAN is redundant with each other, while CAN#A1/#A2 is the sensor network. The cockpit control system is the control terminal of the entire avionics system, and its internal aviation computer is interconnected with two backbone networks through four independent CAN ports, and is responsible for managing all onboard electronic resources. Each avionics system in the cabin must be connected to the backbone network through network equipment to complete control command transmission and high-level information sharing. The digital gateway of the invention can effectively support the ARINC825 protocol, and can provide reliable guarantee for the high-speed interconnection between the subsystem network and the backbone network. Through the conversion of the digital gateway, the backbone redundant network CAN#A1/CAN#A2 and CAN#B1/CAN#B2 of the avionics system are interconnected and bridged with the non-redundant network CAN#E1 and CAN#E2 inside the subsystem #3 respectively , and as long as one of the two child nodes inside the gateway is functioning properly, then and data communication without any interruption.

Claims (5)

1. the high fault tolerance CAN digital gateway based on two CSTR, it is characterized in that, it comprises host node (1), from node (2), two-way redundancy CAN network A (3), two-way redundancy CAN network B (4), nonredundancy sub-network bus #E1 (5) and nonredundancy sub-network bus #E2 (6)

Two-way redundancy CAN network A (3) comprises network-bus #A1 and network-bus #A2;

Two-way redundancy CAN network B (4) comprises network-bus #B1 and network-bus #B2;

Host node (1) comprises DSP#A1 (1-1), DSP#A2 (1-2), CAN port #A11 (1-3), CAN port #A12 (1-4), CAN port #A21 (1-5) and CAN port #A22 (1-6);

DSP#B1 (2-1), DSP#B2 (2-2), CAN port #B11 (2-3), CAN port #B12 (2-4), CAN port #B21 (2-5) and CAN port #B22 (2-6) is comprised from node (2);

By SPI data channel transmission data between DSP#A1 (1-1) and DSP#A2 (1-2), DSP#A1 (1-1) is connected with network-bus #A1 by CAN port #A11 (1-3), DSP#A1 (1-1) is connected with nonredundancy sub-network bus #E1 (5) by CAN port #A12 (1-4), DSP#A2 (1-2) is connected with network-bus #B2 by CAN port #A21 (1-5), and DSP#A2 (1-2) is connected with nonredundancy sub-network bus #E2 (6) by CAN port #A22 (1-6);

By SPI data channel transmission data between DSP#B1 (2-1) and DSP#B2 (2-2), DSP#B1 (2-1) is connected with network-bus #B1 by CAN port #B11 (2-3), DSP#B1 (2-1) is connected with nonredundancy sub-network bus #E2 (6) by CAN port #B12 (2-4), DSP#B2 (2-2) is connected with network-bus #A2 by CAN port #B21 (2-5), and DSP#B2 (2-2) is connected with nonredundancy sub-network bus #E1 (5) by CAN port #B22 (2-6);

The DSP#A1 (1-1) of host node (1) and between the DSP#B1 (2-1) and DSP#B2 (2-2) of node (2), the DSP#A2 (1-2) of host node (1) and transmit data by SPI data channel between the DSP#B1 (2-1) and DSP#B2 (2-2) of node (2).

2. the high fault tolerance CAN digital gateway based on two CSTR according to claim 1, it is characterized in that, host node (1) also comprises CAN driver #A11 (1-7), CAN driver #A12 (1-8), CAN driver #A21 (1-9) and CAN driver #A22 (1-10)

CAN driver #A11 (1-7) is arranged between DSP#A1 (1-1) and CAN port #A11 (1-3), CAN driver #A12 (1-8) is arranged between DSP#A1 (1-1) and CAN port #A12 (1-4), CAN driver #A21 (1-9) is arranged between DSP#A2 (1-2) and CAN port #A21 (1-5), and CAN driver #A22 (1-10) is arranged between DSP#A2 (1-2) and CAN port #A22 (1-6);

CAN driver #B11 (2-7), CAN driver #B12 (2-8), CAN driver #B21 (2-9) and CAN driver #B22 (2-10) is also comprised from node (2),

CAN driver #B11 (2-7) is arranged between DSP#B1 (2-1) and CAN port #B11 (2-3), CAN driver #B12 (2-8) is arranged between DSP#B1 (2-1) and CAN port #B12 (2-4), CAN driver #B21 (2-9) is arranged between DSP#B2 (2-2) and CAN port #B21 (2-5), and CAN driver #B22 (2-10) is arranged between DSP#B2 (2-2) and CAN port #B22 (2-6).

3. the high fault tolerance CAN digital gateway based on two CSTR according to claim 2, is characterized in that, host node (1) also comprises main storage #A1 (1-11) and main storage #A2 (1-12),

Be connected by external expansion interface between main storage #A1 (1-11) with DSP#A1 (1-1), be connected by external expansion interface between main storage #A2 (1-12) with DSP#A2 (1-2);

Also comprise from memory #B1 (2-11) with from memory #B2 (2-12) from node (2),

Be connected by external expansion interface between memory #B1 (2-11) with DSP#B1 (2-1), be connected by external expansion interface between memory #B2 (2-12) with DSP#B2 (2-2).

4. the high fault tolerance CAN digital gateway based on two CSTR according to claim 1,2 or 3, is characterized in that, it also comprises liquid crystal display and operator (7),

Liquid crystal display and operator (7), as man-machine interface, are connected with DSP#A1 (1-1), DSP#A2 (1-2), DSP#B1 (2-1) and DSP#B2 (2-2) respectively.

5. the high fault tolerance CAN digital gateway based on two CSTR according to claim 4, it is characterized in that, it also comprises power supply (8), and power supply (8) is for providing working power for DSP#A1 (1-1), DSP#A2 (1-2), DSP#B1 (2-1) and DSP#B2 (2-2).