CN107122282B - A Functional Safety Communication Method Based on SPI Bus - Google Patents

Abstract

The invention discloses a functional safety communication method based on an SPI bus, comprising: a host packs data to be transmitted into frame data, the frame data includes a frame header, actual data to be transmitted, and a frame tail; the host packs the frame data Write in the SPI transmission register in sequence in units of bytes; the slave receives the frame data from the SPI transmission register in sequence in units of bytes, and monitors the transmission timing of the host based on the received frame data, so The above transmission timing includes the time interval between bytes and frames and the time interval between frames. The monitoring content includes the time interval between bytes is too long and the time interval between frames is too short. , The time interval between frames is too long. The invention can not only ensure that the SPI transmission can be found immediately after the interruption, but also realize the monitoring of the execution sequence of the host software, improve the reliability and stability of the host operation, and improve the safety of the entire electric control system.

Description

A Functional Safety Communication Method Based on SPI Bus

technical field

The invention relates to a safety communication method, in particular to a functional safety communication method based on an SPI bus.

Background technique

With the rapid development of automotive electronics, the complexity of automotive electrical and electronic systems is increasing. How to ensure the safety and reliability of automotive electrical and electronic systems has become a problem faced by all vehicle manufacturers and suppliers. For this reason, the International Standard Organization has formulated the ISO 26262 functional safety standard, which provides guidance for the development of automotive electronic and electrical systems from the aspects of process and technology. In Table D.10 of the fifth part of the ISO 26262 standard, a security mechanism is proposed to monitor the program execution sequence from both logic and time. Using this security mechanism can obtain a higher diagnostic coverage, thereby achieving a higher ASIL rating. This safety mechanism can detect abnormal operation of ECU software caused by internal or external interference during the operation of ECU software. Through the safety monitoring module independent of the ECU main processor, the monitoring of the operating logic and time of the main processor can be realized.

For example, the Chinese utility model patent (authorized announcement number CN 202402149 U, authorized announcement date 2012.08.29) discloses a natural gas engine ECU safety monitoring module, which can monitor external throttle position, throttle position and other signals. However, the patent There is no monitoring of ECU processor internal information. As another example, the Chinese invention patent (application publication number CN103206308 A, application publication date 2013.07.17) discloses a method for a gasoline engine ECU safety monitoring system, which increases the internal information of the ECU host (such as system voltage and host main frequency) monitoring. However, the above two patents only analyze and verify the data content transmitted by SPI. The basis of its realization is that the master and slave can transmit data through SPI correctly and stably. This has the following problems: (1) Consider the unstable and untimely SPI transmission caused by the ECU host due to interruption or CPU load; (2) The sudden interruption caused by external factors during the SPI transmission process is not considered; (3) The slave has only logic for the master On the monitoring, there is no monitoring on the time.

Contents of the invention

For the problems referred to above, the object of the present invention provides a kind of SPI-based functional safety communication method, the method realizes the SPI transmission timing by monitoring the time between bytes and bytes in SPI transmission data and between frames and frames. Monitoring, to meet the requirements of the ISO 26262 standard for monitoring the time aspect of the host software execution sequence.

To achieve the above object, the technical solution adopted in the present invention is:

The embodiment of the present invention provides a kind of functional safety communication method based on SPI bus, comprising:

S1: The SPI master packs the data to be transmitted into frame data, and the frame data includes the frame header, the actual data to be transmitted, and the frame tail;

S2: The SPI master writes the frame data into the SPI transmission register sequentially in bytes;

S3: The SPI slave receives the frame data from the SPI transmission register in order based on the SPI bus in units of bytes, and monitors the data transmission timing of the SPI master during the process of receiving the frame data. The transmission timing includes words The time interval between sections and bytes and the time interval between frames;

Wherein, step S3 specifically includes:

S301: After receiving the byte data, the SPI slave compares the content of the received byte data with the preset frame end data and the preset frame header data, if the received byte data is consistent with the preset frame end If the data is consistent, then enter step S302, if the received byte data is consistent with the preset frame header data, then enter step S303, otherwise enter step S306;

S302: Set the end-of-frame flag to 1, set the timing period of the timer to the minimum time interval allowed between frames, record the current state as detecting timeout between frames, clear the trigger times of the timer to 0, start the timer, and Enter step S307 when the timer is interrupted;

S303: Determine whether the end-of-frame flag is 1 and whether the number of interruptions of the timer is 0, if the end-of-frame flag is 1 and the number of interruptions of the timer is 0, then enter step S304, otherwise enter step S306;

S304: It is determined that the time interval between frames is too short, increase the error count of too short between frames, and enter step S305;

S305: judging whether the inter-frame too short error count is greater than the allowable inter-frame too short error maximum number of times, if greater, then reset the SPI master, if not greater, then enter step S306;

S306: set the end-of-frame flag to 0, set the timing period of the timer to the maximum time interval between bytes allowed, record the current state as detecting timeout between bytes, start the timer, and enter step S307 when the timer is interrupted ;

S307: Judging whether the current state is timeout between detected bytes, if yes, proceed to step S308, otherwise proceed to step S310;

S308: determine that the time interval between bytes is too long, increase the timeout error count between bytes, and enter step S309;

S309: Determine whether the timeout error count between bytes is greater than the maximum number of timeout errors allowed between bytes, if greater, then reset the SPI host;

S310: increase the interrupt count of the timer, and enter step S311;

S311: Determine whether the product of the interrupt count of the timer and the allowed minimum time interval between frames is greater than the allowed maximum time interval between frames, if greater, then enter step S312;

S312: Determine that the inter-frame time interval is too long, increase the inter-frame timeout error count, and enter step S313;

S313: Determine whether the inter-frame timeout error count is greater than the allowed maximum number of inter-frame timeout errors, and if so, reset the SPI master.

Optionally, in step S302, if the timer is not triggered and the next SPI interrupt data is received, then step S301 is performed; in step S306, if the timer is not triggered and the next SPI interrupt data is received, then step S301 is performed S301.

Optionally, in step S309, if the timeout error count between bytes is not greater than the allowable maximum number of timeout errors between bytes, then when the timer triggers again, step S307 is performed, and when the next SPI interrupt data is received, Execution of step S301; in step S311, if the product of the interrupt count of the timer and the allowed minimum time interval between frames is not greater than the allowed maximum time interval between frames, then when the timer is triggered again, step S307 is executed, when receiving When the next SPI interrupts data, execute step S301; in step S313, if the interframe timeout error count is not greater than the maximum number of interframe timeout errors allowed by the system, then when the timer triggers again, execute step S307. When an SPI interrupts data, execute step S301.

Optionally, the SPI transmission bit width is 8 bits, and the SPI master and the SPI slave carry out data communication with a single byte, and each frame of data includes 4 bytes, wherein the first byte is a frame header, The middle two bytes are the actual data to be transmitted, and the last byte is the end of the frame.

Optionally, the SPI master uses the MPC564X chip, and the SPI slave uses the MC9S12GN32 chip.

Optionally, the output end of the SPI master is connected to the input of the SPI slave, the input of the SPI master is connected to the output of the SPI slave, and the clock end of the SPI master is connected to the The clock end of the SPI slave, the chip select end of the SPI master is connected to the chip select end of the SPI slave, and the reset end of the SPI master is connected to the IO port of the SPI slave.

Optionally, the SPI slave resets the SPI master through the IO port.

Optionally, the baud rates of the SPI master and the SPI slave are the same.

Optionally, the baud rates of the SPI master and the SPI slave are both 1.5Mbit/s.

Compared with the prior art, the beneficial effects of the present invention are: the present invention can detect that the time interval between bytes is too long by monitoring the time interval of byte data and frame data transmitted between the SPI master and the SPI slave , the time interval between frames is too short, and the time interval between frames is too long, etc., which can not only ensure that the SPI transmission can be found immediately after the interruption, but also realize the timing monitoring of the host software execution, which improves the The reliability and stability of the main engine operation improves the safety of the entire electronic control system. In addition, the present invention only uses one timer resource in the SPI slave machine, has lower requirements on hardware resources, and is beneficial to expand the application scope of the present invention.

Description of drawings

Fig. 1 is a schematic structural diagram of the SPI safety communication system of the present invention.

FIG. 2 is a schematic diagram of the data transmission sequence transmitted by the SPI master of the present invention.

FIG. 3 is a schematic flowchart of the SPI-based functional safety communication method of the present invention.

FIG. 4 and FIG. 5 are schematic flow diagrams illustrating in detail the SPI slave monitoring the transmission timing of the SPI master according to the present invention.

Detailed ways

In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will describe in detail with reference to the drawings and specific embodiments.

Fig. 1 is a schematic structural diagram of the SPI safety communication system of the present invention. FIG. 2 is a schematic diagram of the data transmission sequence transmitted by the SPI master of the present invention. FIG. 3 is a schematic flowchart of the SPI-based functional safety communication method of the present invention. FIG. 4 and FIG. 5 are schematic flow diagrams illustrating in detail the SPI slave monitoring the transmission timing of the SPI master according to the present invention.

Hereinafter, the SPI safety communication system of the present invention will be introduced first with reference to FIG. 1 . As shown in FIG. 1 , the SPI safety communication system of the present invention includes an SPI master and an SPI slave communicating through the SPI bus. In an embodiment of the present invention, the SPI master adopts the MPC564X chip, the SPI slave adopts the MC9S12GN32 chip, and the baud rates of the SPI master and the SPI slave are the same, for example, both are 1.5M bit/s. The output (DSPI_B_SOUT) of the SPI master is connected to the input (MOSI) of the SPI slave, and the input (DSPI_B_SIN) of the SPI master is connected to the output (MISO) of the SPI slave. The clock end (DSPI_B_SCK) of the SPI master is connected to the clock end (SCK) of the SPI slave, and the chip select end (SDPI_B_PCS[0]) of the SPI master is connected to the chip select end (SS) of the SPI slave, The reset terminal of the SPI master is connected to the IO port (PT1) of the SPI slave, so that the SPI master and the SPI slave can communicate with each other, and the SPI slave can reset the SPI master through the IO port.

The SPI master packs the data to be transmitted to the SPI slave into frame data, and the frame data includes the frame header, the actual data to be transmitted, and the frame tail. In this embodiment, the SPI transmission bit width between the SPI master and the SPI slave is 8 bits, so the SPI master and the SPI slave carry out data communication with a single byte, as shown in Figure 2, the SPI master sends the SPI slave Each frame of data transmitted includes four bytes, the first byte is the frame header, the last byte is the frame tail, the middle two bytes are the actual data to be transmitted, and the sending time difference between the two bytes is The time interval between bytes and the time interval between two frames is the time interval between frames.

As shown in Figure 3, the data transmission between the SPI master and the SPI slave may include the following steps:

S1: The SPI master packs the data to be transmitted into frame data;

S2: The SPI master writes the frame data into the SPI transmission register sequentially in bytes;

S3: The SPI slave receives the frame data from the SPI transmission register in sequence based on the SPI bus in units of bytes, and monitors the data transmission timing of the SPI master.

In the present invention, the SPI slave realizes the monitoring of the data transmission timing of the SPI master by monitoring the byte-to-byte and frame-to-frame time in the SPI master transmission data, so as to monitor the entire SPI transmission timing the goal of. The transmission timing includes the time interval between SPI byte and byte, the time interval between SPI frame and frame; the monitoring content includes the time interval between SPI byte and byte is too long, the time interval between SPI frame and frame is too short, The time interval between SPI frames is too long. The SPI slave machine of the present invention mainly monitors through the SPI interrupt program and the timer interrupt program.

The monitoring of the data transmission timing of the SPI master to the SPI master by the SPI slave of the present invention will be described in detail below with reference to FIG. 4 and FIG. 5 .

As shown in Figure 4 and Figure 5, the monitoring of the data transmission timing of the SPI master by the SPI slave specifically includes the following steps:

S1: The SPI master packs the data to be transmitted into frame data, and the frame data includes the frame header, the actual data to be transmitted, and the frame tail;

S2: The SPI master writes the frame data into the SPI transmission register sequentially in bytes;

S3: The SPI slave receives the frame data from the SPI transmission register in order based on the SPI bus in units of bytes, and monitors the data transmission timing of the SPI master during the process of receiving the frame data. The transmission timing includes words The time interval between sections and bytes and the time interval between frames.

Wherein, step S3 specifically includes:

S301: After receiving the byte data, the SPI slave compares the content of the received byte data with the preset frame end data and the preset frame header data, if the received byte data is consistent with the preset frame end If the data is consistent, go to step S302, if the received byte data is consistent with the preset header data, go to step S303, otherwise go to step S306.

S302: Set the end-of-frame flag to 1, set the timing period of the timer to the minimum time interval allowed between frames, record the current state as detecting timeout between frames, clear the trigger times of the timer to 0, start the timer, and When the timer is interrupted, enter step S307; if the next SPI interrupt data is received from the SPI master before the timer is triggered, then execute step S301. That is, after receiving the frame end data, if the timer does not trigger and directly receives the frame header data, at this time, the SPI interrupt program starts to work, which means that the transmission time interval between two frames of data is less than the allowable frame interval The minimum time interval, from which it can be judged that the time interval between frames is too short.

The allowed minimum time interval between frames can be determined according to the requirements of the system (ECU system), for example, in an example, it is 1ms, so the timing period of the timer can be set to 1ms, like this, after receiving the next frame Before data, the timer will fire every 1ms.

S303: Determine whether the end-of-frame flag is 1 and the number of interruptions of the timer is 0, if the end-of-frame flag is 1 and the number of interruptions of the timer is 0, go to step S304, otherwise go to step S306.

S304: It is determined that the time interval between frames is too short, increase the error count of too short between frames, and enter step S305.

S305: Judging whether the inter-frame too short error count is greater than the allowed maximum number of inter-frame too short errors, if greater, then reset the SPI host, if not greater, then enter step S306; the allowed inter-frame too short error maximum number of times can be determined as required to set, in an example it can be set to 7 times.

S306: set the end-of-frame flag to 0, set the timing period of the timer to the maximum time interval between bytes allowed, record the current state as detecting timeout between bytes, start the timer, and enter step S307 when the timer is interrupted ; If the timer is not triggered and the next SPI interrupt data is received, then step S301 is executed. That is, if the next SPI interrupt data is received from the SPI master before the timer triggers, this indicates that the next byte of data (the data actually transmitted by the SPI) will be received, thus indicating that the time interval between bytes and bytes is in Within the range allowed by the system, at this time, the SPI interrupt program starts to work.

The maximum time interval between allowed bytes can be determined according to the requirements of the system (ECU system), for example, in an example, it is about 200us, so the timing period of the timer can be set to 200us, like this, after receiving Before a byte of data, the timer will trigger every 200us.

S307: Judging whether the current state is to detect timeout between bytes, if yes, go to step S308, otherwise go to step S310.

S308: It is determined that the time interval between bytes is too long, increase the timeout error count between bytes, and enter step S309.

S309: Determine whether the timeout error count between bytes is greater than the maximum number of timeout errors between bytes allowed, if greater, then reset the SPI master; if not greater, then when the timer is triggered again, step S307 is executed, and when the next When the SPI interrupts data, execute step S301. That is, if the inter-byte timeout error count is not greater than the maximum number of allowed inter-byte timeout errors, if the timer is triggered again within the next time, indicating that no byte data has been received, continue to increase the timer interrupt Error counting, return to the SPI interrupt program after receiving the next SPI interrupt data, or reset the SPI master after the interrupt error count is greater than the maximum number of allowable inter-byte timeout errors.

The maximum number of allowable inter-byte timeout errors can be set as required, and can be set to 7 times in an example.

S310: Increase the interrupt count of the timer, and go to step S311.

S311: Determine whether the product of the interrupt count of the timer and the allowed minimum time interval between frames is greater than the allowed maximum time interval between frames, if greater, then enter step S312; if not greater, then when the timer triggers again, execute step S307. When the next SPI interrupt data is received, step S301 is executed. That is, if the product of the timer's interrupt count and the allowed minimum time interval between frames is less than or equal to the allowed maximum time interval between frames, if the timer is triggered again in the next time, continue to calculate the timer's interrupt count Judging by the product of the minimum time interval allowed between frames, if the timer is not triggered again and the next SPI interrupt data is received, it means that the time interval between frames is within the range allowed by the system, and the SPI interrupt program is returned.

The allowable maximum time interval between frames may be determined according to the requirements of the system (ECU system). For example, in an example, the maximum allowable time interval between frames of the system is about 500 ms.

S312: Determine that the inter-frame time interval is too long, increase the inter-frame timeout error count, and enter step S313.

S313: Determine whether the inter-frame timeout error count is greater than the allowed inter-frame timeout error maximum number of times, if greater, then reset the SPI master; if not greater, then when the timer is triggered again, step S307 is executed, and when the next SPI interrupt is received data, execute step S301. That is, if the inter-frame timeout error count is not greater than the allowed maximum number of inter-frame timeout errors, if the timer is triggered again in the next time, it means that the frame header data has not been received after the frame tail data is received, then continue Increase the timer interrupt error count until returning to the SPI interrupt program after receiving the next SPI interrupt data, or reset the SPI master after the interrupt error count is greater than the maximum number of allowable inter-frame timeout errors.

The maximum allowed number of inter-frame timeout errors can be set as required, and can be set to 7 times in an example.

The above steps S301 to S306 are executed in the SPI interrupt program, and the above steps S307 to S313 are executed in the timer interrupt program. According to the description of the above steps S301 to S313, it can be seen that the present invention can realize in the SPI slave that the time interval between frames and frames of the data transmitted by the SPI master is too long, the time interval between frames and frames is too short, and the time interval between bytes and bytes is too short. The monitoring time interval is too long, and each monitoring is as follows:

[Monitoring of too long time interval between frames]

In the SPI interrupt service program, if the byte data currently received from the SPI register of the SPI master is consistent with the scheduled end-of-frame data, the end-of-frame flag is set to 1, indicating that the end-of-frame data has been received, and the cycle value of the timer is set to Set it as the minimum time interval between frames allowed by the system, update the current monitoring status to detect timeout between frames, and finally start the timer. In this way, before the SPI slave receives the next frame of data, the time interval between two frames can be calculated by the number of interrupts of the timer. In the timer interrupt service program, if the product of the number of timer interrupts and the timing cycle exceeds the maximum time interval between frames allowed by the system, it is judged as a frame-to-frame timeout, and the system error count is increased. If the error count exceeds the predetermined maximum number of times, the SPI slave resets the SPI master through the IO port.

[Monitoring that the time interval between frames is too short]

In the SPI interrupt service program, if the byte data currently received from the SPI register is consistent with the predetermined frame end data, the frame end flag is set to 1, and the period value of the timer is set to the frame-to-frame interval allowed by the system. The minimum time interval, update the current monitoring status to detect inter-frame timeout, and finally start the timer. In this way, before receiving the next frame of data, the time interval between two frames can be calculated by the number of interrupts of the timer. When the byte data received from the SPI register is consistent with the predetermined frame header data, and the frame end flag is 1, if the number of timer interrupts is 0, it means that the timer has not entered the timer interrupt handler since the frame end started the timer , thus indicating that the time interval between the frame head and the frame tail is less than the timer period, thus it is judged that the time interval between the frame and the frame is too short, and the system error count is increased. If the error count exceeds the predetermined maximum number of times, the SPI slave resets the SPI master through the IO port.

[Byte and byte time interval is too long monitoring]

In the SPI interrupt service program, if the byte data currently received from the SPI register is consistent with the predetermined frame header data, and the number of timer interrupts is greater than 1, it means that the time interval between the frame header and the last frame end is in the system within the allowable range. At this time, the period value of the timer is set as the maximum time interval between bytes allowed by the system, and the current monitoring status is updated to detect timeout between bytes, and finally the timer is started. In this way, before receiving the next byte of data, if the timer interrupt service routine is not entered, it means that the time interval between bytes is within the allowable range of the system. In the timer interrupt service program, if the current monitoring status is to detect timeout between bytes, it means that the time interval between bytes has exceeded the maximum time allowed by the system, and it is judged as timeout between bytes, and the system error count is increased. If the error count exceeds the predetermined maximum number of times, the SPI slave resets the SPI master through the IO port.

In summary, the present invention monitors the time interval between the bytes transmitted between the SPI master and the SPI slave and the time interval between the frame and the frame through the SPI slave, and can detect that the time interval between the byte and the byte is too long , the time interval between frames is too short, and the time interval between frames is too long, etc., which can not only ensure that the SPI transmission can be found immediately after the interruption, but also realize the timing monitoring of the host software execution, which improves the The reliability and stability of the main engine operation improves the safety of the entire electronic control system. In addition, the present invention only uses one timer resource of the SPI slave machine for judgment, and has lower requirements on hardware resources, which is beneficial to expand the application scope of the present invention.

The above description is a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, these improvements and modifications It should also be regarded as the protection scope of the present invention.

Claims (9)

1. A functional safety communication method based on SPI bus, characterized in that, comprising: S1: The SPI master packs the data to be transmitted into frame data, and the frame data includes the frame header, the actual data to be transmitted, and the frame tail; S2: The SPI master writes the frame data into the SPI transmission register sequentially in bytes; S3: The SPI slave receives the frame data from the SPI transmission register in order based on the SPI bus in units of bytes, and monitors the data transmission timing of the SPI master during the process of receiving the frame data. The transmission timing includes words The time interval between sections and bytes and the time interval between frames; Wherein, step S3 specifically includes: S301: After receiving the byte data, the SPI slave compares the content of the received byte data with the preset frame end data and the preset frame header data, if the received byte data is consistent with the preset frame end If the data is consistent, then enter step S302, if the received byte data is consistent with the preset frame header data, then enter step S303, otherwise enter step S306; S302: Set the end-of-frame flag to 1, set the timing period of the timer to the minimum time interval between frames allowed, record the current state as detecting timeout between frames, clear the interrupt count of the timer to 0, start the timer, and Enter step S307 when the timer is interrupted; S303: determine whether the end-of-frame flag is 1 and whether the interrupt count of the timer is 0, if the end-of-frame flag is 1 and the interrupt count of the timer is 0, then enter step S304, otherwise enter step S306; S304: It is determined that the time interval between frames is too short, increase the error count of too short between frames, and enter step S305; S305: judging whether the inter-frame too short error count is greater than the allowable inter-frame too short error maximum number of times, if greater, then reset the SPI master, if not greater, then enter step S306; S306: set the end-of-frame flag to 0, set the timing period of the timer to the maximum time interval between bytes allowed, record the current state as detecting timeout between bytes, start the timer, and enter step S307 when the timer is interrupted ; S307: Judging whether the current state is timeout between detected bytes, if yes, proceed to step S308, otherwise proceed to step S310; S308: determine that the time interval between bytes is too long, increase the timeout error count between bytes, and enter step S309; S309: Determine whether the timeout error count between bytes is greater than the maximum number of timeout errors allowed between bytes, if greater, then reset the SPI host; S310: increase the interrupt count of the timer, and enter step S311; S311: Determine whether the product of the interrupt count of the timer and the allowed minimum time interval between frames is greater than the allowed maximum time interval between frames, if greater, then enter step S312; S312: Determine that the inter-frame time interval is too long, increase the inter-frame timeout error count, and enter step S313; S313: Determine whether the inter-frame timeout error count is greater than the allowed maximum number of inter-frame timeout errors, and if so, reset the SPI master. 2. the functional safety communication method based on SPI bus according to claim 1, is characterized in that, In step S302, if the timer is not triggered and the next SPI interrupt data is received, then step S301 is performed; In step S306, if the timer is not triggered and the next SPI interrupt data is received, then step S301 is executed. 3. the functional safety communication method based on SPI bus according to claim 1, is characterized in that, In step S309, if the overtime error counting between bytes is not greater than the allowed maximum number of times between bytes, then when the timer is triggered again, step S307 is executed, and when the next SPI interrupt data is received, step S301 is executed; In step S311, if the product of the interrupt count of the timer and the allowed minimum time interval between frames is not greater than the allowed maximum time interval between frames, then when the timer triggers again, step S307 is executed, and when the next SPI interrupt is received data, execute step S301; In step S313, if the interframe timeout error count is not greater than the maximum number of interframe timeout errors allowed by the system, then when the timer is triggered again, step S307 is executed, and when the next SPI interrupt data is received, step S301 is executed. 4. the functional safety communication method based on SPI bus according to claim 1, is characterized in that, SPI transmission bit width is 8, and described SPI master and described SPI slave carry out data communication with single byte, every frame The data includes 4 bytes, among which, the first byte is the frame header, the middle two bytes are the actual data to be transmitted, and the last byte is the frame tail. 5. the functional safety communication method based on SPI bus according to claim 1, is characterized in that, described SPI master adopts MPC564X chip, and described SPI slave adopts MC9S12GN32 chip. 6. the functional safety communication method based on SPI bus according to claim 5, is characterized in that, The output end of the SPI master is connected to the input of the SPI slave, the input of the SPI master is connected to the output of the SPI slave, and the clock end of the SPI master is connected to the SPI slave. clock end, the chip select end of the SPI master is connected to the chip select end of the SPI slave, and the reset end of the SPI master is connected to the IO port of the SPI slave. 7. The functional safety communication method based on the SPI bus according to claim 6, wherein the SPI slave resets the SPI master through the IO port. 8. The functional safety communication method based on the SPI bus according to claim 1, wherein the baud rate of the SPI master and the SPI slave is the same. 9. the functional safety communication method based on SPI bus according to claim 8, is characterized in that, Both the baud rate of the SPI master and the SPI slave are 1.5Mbit/s.