1067results about "Safety arrangments" patented technology

The invention discloses a radar lifting control method and system based on meteorological monitoring, and relates to the technical field of radar lifting control, and the method comprises the steps: completing the switching of a power supply and communication after a radar is powered on, initializing a controller, collecting the data of a meteorological station, and generating a future fusion wind speed in real time through a Kalman filtering physical model and a residual neural network; future fused wind speed is converted into wind pressure for evaluation, the risk degree is judged according to the evaluation result, early warning is given out, and the controller is preheated to enter a lifting preparation state. The input stability is improved through meteorological data sliding window smoothing and feature extraction, wind speed dynamic prediction and uncertainty quantification are achieved through XGBoost prediction and residual variance estimation, the time sequence consistency and robustness are enhanced through remote API interpolation correction and adaptive extended Kalman filtering, residual correction is conducted through a neural network, the prediction precision is improved, and the prediction accuracy is improved. And a reliable decision basis is provided for radar lifting control.

The invention relates to the technical field of equipment abnormity control, and discloses an equipment abnormity self-closed-loop control system. An anomaly detection engine of the system collects operation state data of target equipment in real time, and performs preliminary anomaly marking according to a preset anomaly judgment rule; the dynamic analysis unit receives the preliminary anomaly marks, generates anomaly feature vectors in combination with historical operation data, and inputs the anomaly feature vectors into a multi-dimensional evaluation model to divide anomaly levels; a strategy generator is matched with a preset repair strategy library according to the abnormal grade division result, and a corresponding repair instruction sequence is generated; the execution control module analyzes the repair instruction sequence, and dispatches hardware resources to execute repair operation according to a preset execution priority; and the feedback verification unit collects the running state data again after restoration, and compares the running state data with the initial abnormal mark to generate a restoration verification result. The system realizes full-process automatic processing of equipment exceptions, and improves exception processing efficiency and equipment operation stability.

A safety device for monitoring at least one machine has at least one sensor for generating sensor data about the machine and a processing unit for the sensor data that is at least indirectly connected to the sensor and the machine. This processing unit is designed as an execution environment with at least one computing node and is configured to run at least one logic unit on the computing node. The logic unit includes at least one safety function unit for safety-oriented evaluation of the sensor data in order to output a safety signal to the machine to trigger a safety response in the event of a safety-relevant event. The processing unit is further configured to generate, modify, and / or resolve logic units based on a safety task.

An in-vehicle system includes: a first in-vehicle device installed in a vehicle; a second in-vehicle device controlled in accordance with a signal output from the first in-vehicle device; a first in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by signal lines; and a second in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by the signal lines. The first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a type different from a type of the signal lines, and a communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU.

The invention discloses an encoder and Hall dual-mode redundancy closed-loop driving method and system, and relates to the technical field of motion control and fault tolerance, and the method comprises the steps: collecting the dual-channel signal data of an encoder and a Hall sensor in parallel in real time, and monitoring the redundancy through consistency detection; carrying out abnormity screening based on a preset rule on the collected double-path signals, carrying out data health assessment by using a machine learning model, and carrying out abnormity identification on the screened double-path signals; and fusing screening and identification results, dividing risk levels, and when an abnormal value exceeds a risk level threshold value, performing intelligent fault-tolerant switching. The dynamic threshold rule, the online incremental learning decision tree and the multi-level fusion grading strategy adopted by the method have sensitive capture capability on progressive and hidden faults. In a high interference scene, the accuracy and continuity of fault detection are effectively ensured through concept drift monitoring and a streaming decision tree online updating mechanism.

A hybrid, redundant, fail-safe architecture provides a unified fail-operational framework for autonomous agents operating across physical and virtual domains. The system employs a multi-modal data source suite, an adaptive hybrid data fusion module, and an intelligent decision-making module. A novel closed-loop interaction enables a health monitoring module that detects an incipient fault in a data source by monitoring ancillary performance metrics. Upon detection, the module generates a fault signature, including a quantitative prognostic estimate of a future failure time, and transmits it to an adaptive data fusion module. The fusion module proactively reconfigures its state estimation algorithm by decreasing reliance on the degrading data source in proportion to the prognostic estimate. This preemptive compensation ensures the system maintains a high-integrity environmental model and achieves true fail-operational continuity. The architecture is applicable to numerous embodiments providing a universal solution for proactive fault management and system resilience.

The invention discloses a ship propulsion control system and method, and relates to the technical field of ship engineering.The ship propulsion control system comprises an acquisition module used for acquiring analog quantity signals during ship propulsion, and a main controller module used for receiving the analog quantity signals and generating a propulsion control instruction; according to the ship propulsion control system, two acquisition channels are arranged for analog quantity signals, a fault channel is rapidly detected and switched in combination with a self-checking mechanism, the fault channel can be rapidly detected, the fault channel can be rapidly switched, the fault channel can be rapidly detected, the fault channel can be rapidly switched, and the reliability of the ship propulsion control system can be improved. A digital quantity output channel fault is found in time and switched to a standby channel, a power supply and communication interface backup strategy is perfected, fault priorities are accurately divided, corresponding measures are taken, the strict requirements of modern ships for high reliability and high safety of propulsion control are met, and powerful technical support is provided for stable navigation of the ships.

The invention relates to the technical field of power equipment, and discloses a power electronic transformer redundant controller switching method, which comprises the following steps of: constructing a redundant control array to collect analog quantity data of a power electronic transformer in real time so as to obtain two groups of instantaneous interaction data; the master controller generates a control logic by any one group of instantaneous interaction data to control the operation state of the power electronic transformer, and sends the other group of instantaneous interaction data to the slave controller in a preset interruption period to dynamically update the data of the slave controller; through the redundancy design of the master controller and the slave controller, when the master controller breaks down, the master controller can be quickly switched to the slave controller in a control period, and the switched master controller continues the last updated instantaneous interaction data of the master controller before switching, so that the non-impact switching is realized, the fluctuation or shutdown risk of the system is avoided, and the reliability of the system is improved. The stable operation of the power electronic transformer is ensured, and the maintenance and shutdown loss caused by faults is reduced, so that the overall maintenance cost is reduced.

The invention discloses a charging pile liquid cooling module intelligent cooperative control system based on an industrial Ethernet, and relates to the technical field of liquid cooling control. The charging pile liquid cooling module intelligent cooperative control system based on the industrial Ethernet comprises a liquid cooling data acquisition and preprocessing unit used for acquiring and preprocessing liquid cooling cooperative operation data; the thermal load sensing and intelligent liquid cooling regulation and control unit is used for dividing independent cooling branches, evaluating the thermal load degree of each cooling branch, judging the real-time thermal load state and generating and executing a control instruction; the anomaly detection and cooling redundancy control unit is used for evaluating the thermal response deviation condition of a cooling branch and judging whether a double-ring redundancy pipeline is started or not; and the fault root cause judgment and recovery enhancement unit is used for evaluating the component fault risk degree in the abnormal branch and executing fault-tolerant control and branch recovery strategies. The problem that a whole set of liquid cooling system is shut down due to the fact that local fault tolerance cannot be achieved when a local branch breaks down in a traditional pipeline structure is solved.

The invention discloses a safety control method and system for an emerging control main body, and belongs to the technical field of power system active control, and the method comprises the steps: carrying out the bidirectional data interaction through a master station AGC and a field station AGC, and carrying out the bidirectional data interaction based on a bidirectional data interaction result and a cooperative anti-error parameter; whether the emerging control main body is in a controllable state or not is judged in real time through collaborative security locking logic; if the control main body is in the controllable state, active measurement data of the emerging control main body are obtained, and jump detection and multi-source checking are carried out on the active measurement data; after verification is passed, a pre-control instruction is generated based on the control strategy, and reasonability verification and control effect simulation verification are carried out; and after the control effect simulation verification is passed, the pre-control instruction is taken as a final control instruction to be issued to the emerging control main body for execution. The method can greatly improve the safety control capability of AGC on an emerging control main body, guarantees the frequency operation safety of a power grid, and improves the safe and reliable power supply capability of the power grid.

The invention relates to the technical field of engineering machinery, and discloses an engineering machinery active safety control method and device based on multi-parameter analysis, and the method comprises the steps: collecting the multi-modal data of an environment where the engineering machinery is located based on a multi-modal data collection device, and constructing a dynamic model of the engineering machinery and the environment according to the multi-modal data, analyzing the multi-modal data through a dynamic model to obtain an environment data analysis result and an equipment data analysis result, determining an operation risk level of the engineering machinery according to the environment data analysis result and the equipment data analysis result, and determining an optimal working path of the engineering machinery according to the multi-modal data. And generating a safety control strategy according to the operation risk level and the optimal working path. Therefore, by implementing the method, the evaluation accuracy of the operation risk can be improved, the probability of misoperation of operators is reduced, the operation accuracy and reliability of the engineering machinery are enhanced, and the operation efficiency, the operation stability and the operation safety of the engineering machinery are further improved.

The invention relates to the technical field of verification and evaluation, in particular to a reusable rocket attitude control system redundancy verification and fault tolerance evaluation method, which comprises the following steps: performing multi-dimensional combination on disturbance units according to disturbance types, action time periods and intensity grades to form a disturbance combination set, constructing a group of induction task profiles covering different attitude control abnormal situations; recording a switching state of an internal control path of the attitude control system, a redundant component intervention time sequence and a function takeover sequence in real time, and constructing a dynamic response path map of a redundant link; and generating a response integrity index and a fault tolerance conflict degree criterion of redundancy configuration as a fault tolerance capability evaluation result of the attitude control system. Compared with an existing method which only verifies individual static disturbance scenes, the method has the advantages that systematic design and composite excitation of disturbance conditions can be realized, scene complexity and coverage of redundancy verification are enhanced, and authenticity and representativeness of fault-tolerant testing are improved.

The invention relates to the technical field of motion redundancy parallel robot control, in particular to a method for designing a 2R1T motion redundancy parallel robot high-performance hierarchical synchronous controller based on time delay estimation, which enables a system to estimate current kinetic parameters in real time by introducing a time delay estimation technology, and enables the current kinetic parameters to be estimated in real time in a high-speed motion state. On the basis of the problems of uncertainty, nonlinearity and the like of robot dynamic parameters, dynamic data predicted in real time is used as feed-forward input, so that excessive redundant calculation is avoided, and the efficiency of a control algorithm is optimized; by introducing hierarchical synchronous control, the error difference between redundant degrees of freedom is overcome, the motion precision of a hierarchical driver and the stability of the system are ensured, and the dynamic response of the robot and the robustness of the system are optimized by taking a time delay estimation technology as dynamic feed-forward compensation; and the coordination problem of redundant degrees of freedom is disassembled into a plurality of sub-problems through layered synchronous control, so that the motion coordination and control precision of the robot is improved.

The application relates to a centralized electronic and electrical architecture applied to an electric vehicle and the vehicle, wherein the electronic and electrical architecture comprises multiple domains, each domain having a domain controller and multiple sub-domain controllers connected to the domain controller in the domain; at least part of the functions of the domain controller are redundantly realized in the remaining capacity of the sub-domain controllers in the domain through fallback software or in the remaining capacity of the sub-domain controllers belonging to other domain controllers or other domain controllers across domains; each domain has a domain gateway, which is used for coordinately distributing the functions borne by the domain controller of the domain to the sub-domain controllers in the domain and / or other domain controllers across domains and / or the sub-domain controllers belonging to other domain controllers; and the key domain controller functions are redundantly realized in the other controllers in the sub-domain or the other controllers across domains, so that the situation that the domain controller is irreversibly faulty is solved.

The invention discloses a piece placing sequence mistake proofing device which comprises a multi-dimensional sensing module, an intelligent control module, a reconfigurable positioning module, an execution intervention module, a block chain tracing module and a man-machine interaction module, and all the modules communicate through an industrial Ethernet. The multi-dimensional sensing module and the intelligent control module adopt a time-sensitive network protocol to guarantee the certainty of data transmission, the multi-dimensional sensing module integrates an AI vision assembly, an ultrahigh frequency radio frequency identification read-write unit and a polarized light detection assembly, and parallel acquisition and cross validation of cutting piece multi-dimensional information are realized through a time sequence synchronous triggering mechanism. According to the method, a full-dimensional recognition system can be constructed through cooperation of multi-modal sensing fusion and an intelligent algorithm to avoid a single detection blind area, multi-variety production requirements are adapted by relying on AI incremental learning and rapid remodeling design, non-tampering tracing of quality data is realized in combination with a block chain technology, and the method is suitable for mass production. And meanwhile, reliable operation of the system is guaranteed through redundancy control and emergency design.

The invention discloses a redundancy control device and system for a valve actuating mechanism of a pneumatic isolating valve, and belongs to the technical field of industrial automation and process control. The device comprises a triple gas source supply system which comprises a main gas source, a standby gas source A and a standby gas source B adopting a high-pressure gas storage tank; the distributed intelligent control module comprises a main controller, a hot standby controller and a cold standby controller and adopts a 2oo3 voting mechanism; the triple modular execution mechanism system comprises an electro-pneumatic execution unit, a pure pneumatic execution unit and a mechanical standby execution unit; the invention discloses a self-adaptive fault diagnosis and recovery system. The control system comprises an intelligent self-learning system, an undisturbed switching control system and the like, and has a layered software architecture and a multi-level control strategy. Multiple redundancy is achieved, the reliability of extreme conditions is improved, fault prediction is accurate, response is fast, switching disturbance is small, the method adapts to working condition changes, and the safety and the intelligent level of the system are improved.

A plastics processing system is described. This system comprises at least one plastics processing machine (100) and a control and operating system (10) for controlling and operating this plastics processing machine (100). The control and operating system includes a cycle control unit, which, in a production mode, controls the plastics processing machine at least indirectly and which, for this purpose, uses a first computing unit (20) equipped with a first operating system. Furthermore, the control and operating system includes a first interface device (30), which has at least one first input device, at least one visualization device, and a second computing unit (34) equipped with a second operating system and in communication with the first input device and the visualization device. The first computing unit (20) and the second computing unit (34) communicate via A bidirectional first communication device (36) is provided. This allows the plastics processing machine (100) to continue operating even if the first interface device (30) fails, for example, to process an existing production order. To ensure minimum communication with the cycle control system even if the first interface device (30) fails, a second interface device (50) is also provided, which has at least one second input device (52). The signals generated by the second input device (52) are transmitted to the first processing unit by means of a second communication device (54) that operates at least unidirectionally.

The invention relates to a working method of a vehicle control system of a redundant electrical architecture, belongs to the technical field of redundant control systems, and solves the problem that an existing control system is poor in reliability. The method provided by the invention comprises the following steps: during starting, the main controller is defaulted to be an effective controller in the controller group with the backup, the hot backup controller monitors whether the main controller is in an abnormal state or not through a heartbeat signal, a fault signal and a first verification signal of the main controller, and if the main controller is in the abnormal state, the main controller is controlled to be powered off; the hot backup controller is switched to an effective controller; the cold backup controller monitors whether the hot backup controller is in an abnormal state or not through a fault signal, a heartbeat signal and a second verification signal of the hot backup controller; if the hot backup controller is in the abnormal state, the hot backup controller is controlled to be powered off, the control mode of the cold backup controller is activated, and the cold backup controller is switched to the effective controller. According to the invention, the reliability of the system is improved through effective arbitration of the effective controller.

The invention relates to a valve arrangement (1; 81; 91) with several functional modules arranged in series from the group: valve disc group (8), safety valve group (7), throttle valve (171), wherein the valve disc group (8) has one or more valve discs (101, 102), each with at least one electrically controllable valve (103, 104) which is connected to an electrical supply line (17) and to a fluid supply line (18), wherein the throttle valve (171) is arranged upstream of the safety valve group (7) between a fluid connection (36) and the fluid supply line (18) of the valve disc group (8), wherein the safety valve group (7) has two safety valves (51, 52) which are designed to influence a fluid flow between the fluid connection (36) and the fluid supply line (18),wherein the safety control (7) is designed for the safety-oriented blocking of electrical control signals for the safety valves (51, 52), wherein the throttle valve is designed for a temporary reduction of a working pressure in the fluid supply line (18), and wherein a valve control (5) is designed to control the valve disc group (8) and the safety valve group (7).

The invention discloses a cascade energy storage system-oriented collaborative test control method, and relates to the technical field of cascade energy storage system collaborative test control. Detecting the state of the energy storage module, verifying communication delay, marking an overtime module, triggering self-inspection, and recording initial parameters of a normal module; selecting a test mode, and configuring cooperative control and data acquisition parameters; the main controller generates a total power instruction and dynamically distributes the total power instruction, sends a synchronous clock signal to trigger the module to perform synchronous execution, gradually reduces power for charging and discharging and performs soft cut-off, and sends an isolation instruction for fault simulation; receiving real-time data, calculating indexes such as voltage balance and SOC deviation, and analyzing efficiency and communication stability; balancing current is dynamically adjusted according to a result, and a shutdown instruction is sent abnormally; and if a termination condition is met, stopping testing, and generating a report containing performance indexes and fault records. According to the invention, the test collaboration and precision are improved, the fault early warning and data utilization are optimized, the safety is enhanced, and the operation and maintenance cost is reduced.

The invention provides a master-slave redundancy control method and system, a medium and a product, and relates to the technical field of redundancy control, and the method comprises the steps: controlling a master controller to generate a PWM heartbeat signal and a CAN heartbeat signal based on the current operation state of the master controller in each control period, the PWM heartbeat signal and the CAN heartbeat signal are simultaneously sent to the slave controller through a hard wire and a CAN bus; and after the slave controller receives the PWM heartbeat signal and the CAN heartbeat signal, the slave controller is controlled to start a built-in redundancy control switching logic, and the redundancy control switching logic is configured to control the slave controller to enter a working mode to take over a control task of the master controller when the master controller is identified to have a fault based on the PWM heartbeat signal and the CAN heartbeat signal. According to the method, through a heartbeat signal detection scheme of dual redundancy of the hard wire and the CAN bus, the reliability and the anti-interference capability of heartbeat signals are enhanced, and misoperation during redundancy switching control can be effectively prevented.

A motion control system and methods. The motion control system comprises: a control platform (102) and at least one mobile device (104), the control platform (102) communicating with each mobile device (104) by means of at least two communication links. Upon detecting that a security event is triggered, the control platform (102) is configured to generate an emergency stop instruction, and transmit the emergency stop instruction to the mobile device (104) by means of a first communication link (103), the first communication link (103) being a communication link amongst the at least two communication links having a preset secure communication protocol. The mobile device (104) is configured to receive the emergency stop instruction by means of the first communication link (103), analyze the emergency stop instruction by using the preset security communication protocol, and execute a shutdown operation on the basis of an analysis result. The at least two communication links are provided between the control platform (102) and the mobile device (104), and the emergency stop instruction is transmitted by using the first communication link (103) conforming to the preset security communication protocol, such that the occurrence probability of transmission failure is reduced when the emergency stop instruction is transmitted to the mobile device (104), thus improving the transmission security of the emergency stop instruction.

The invention relates to the technical field of satellites, in particular to a three-super platform actuator eddy current sensor fault autonomous reconstruction method. Comprising the following steps: according to a parallel mechanism kinematics relationship of each actuator, determining a first relationship between axial displacement measured by an actuator eddy current sensor and a load relative to a six-degree-of-freedom pose of a satellite platform; determining a parallel mechanism kinematics relationship of the fault-free eddy current sensor, and determining a second relationship between the axial displacement and the load measured by the fault-free eddy current sensor and the six-degree-of-freedom pose of the satellite platform; according to the first relation and the second relation, matrix reconstruction is carried out on the remaining fault-free actuator eddy current sensors, and an autonomous reconstruction matrix is obtained; and according to the autonomous reconstruction matrix and the measurement of the fault-free actuator eddy current sensor, obtaining all actuator eddy current measurement values of the actuator where the fault eddy current sensor is located. According to the method, when the eddy current sensor has a fault, the eddy current sensor distribution array is reconstructed, and three-super control is recovered.

The invention is suitable for the technical field of liquid cooling systems, and provides a liquid cooling CDU online control method and device, a group control system and a data center. The method is suitable for a liquid cooling CDU group control system comprising a plurality of online liquid cooling CDUs, and the liquid cooling CDUs are host machines or slave machines. The method comprises the following steps: when a host detects that any running slave is offline and a standby machine exists, controlling the standby machine to start, and controlling a running liquid cooling CDU to run with the same preset running parameters; the off-line slave is started and stopped according to the number of liquid cooling CDUs needing to be operated recorded before off-line; and when the host detects that any running liquid cooling CDU sends out a fault alarm and a standby machine exists, the standby machine is controlled to be started, and the liquid cooling CDU sending out the fault alarm is controlled according to the level of the fault alarm. Different control strategies are adopted for different faults, a one-step control mode is avoided, stable and reliable operation of the liquid cooling CDU group control system is effectively maintained, and cooling and heat dissipation of the data center are guaranteed.

The invention discloses a reciprocating type passenger ropeway constant deceleration control system, and relates to the technical field of brake control. According to the method, the first-stage constant deceleration braking mode and the second-stage constant torque braking mode are set, analysis is carried out through the second-stage braking conversion algorithm, the deceleration abnormal index, the speed tracking abnormal index and the response abnormal index are output, then the mode abnormal total value is obtained, the braking state is judged, self-adaptive mode switching is achieved, and the braking efficiency is improved. Constant braking deceleration is maintained, swinging of a hanging box is reduced, comfort of passengers is improved, brake rubber abrasion is reduced, meanwhile, regional debugging is not needed, and the operation difficulty of a construction site is reduced; hydraulic loop parameters are analyzed through a failure judgment logic algorithm set by the hydraulic redundancy protection module, a loop abnormal total value is output, and hydraulic loop switching is carried out based on the loop abnormal total value; and through visual display of the fault memory interaction module, the safety redundancy of the braking system is improved, fault tracing and maintenance are facilitated, and the running reliability of the cableway is guaranteed.

A cloud-based industrial safety system executes safety applications and interfaces with industrial assets on the plant floor using software encoded processing (SEP). The use of SEP ensures safety reliable execution of safety applications and data communication software by redundantly executing native code, thereby implementing a level of software-based fault detection that is independent of the hardware on which the safety application operates. This allows the cloud-based industrial safety applications to achieve at least SIL3 safety ratings for safety services even though the safety applications are executed using standard COTS hardware that is commonplace in the server market. The use of SEP to reliably execute safety software on the cloud can make possible a wide variety of safety applications that would be difficult to implement using purely localized industrial safety systems.

The invention relates to a carrier rocket secondary reusable electrical system based on a modular TTE-TSN bus, and aims to solve the problems of reliability, light weight and maintenance efficiency in high-speed reentry and precise recovery of a secondary rocket. The system comprises a modular comprehensive control unit, a redundant TTE-TSN high-speed bus, a distributed thermal protection monitoring network and an intelligent health assessment module. Through the modular design, electrical equipment is greatly reduced, and the mass is obviously reduced; the redundant TTE-TSN high-speed bus realizes high-bandwidth and high-reliability transmission of messages on the rocket; the thermal protection monitoring network and the attitude coordination system dynamically optimize reentry thermal load distribution; the intelligent health assessment model predicts the structural life and reuse feasibility based on machine learning. According to the method, the reuse economy and reliability of the two-stage rocket are remarkably improved, and the method is suitable for commercial spaceflight and hypersonic flight vehicle tasks.

The invention provides a carrier rocket time sequence control full redundancy implementation method, and aims to improve the fault adaptability and the working reliability of a time sequence control system. The full-redundancy design method of three-path information source redundancy, three-path transmission line redundancy, two-out-of-three voting control redundancy and five-tube relay instruction driving redundancy is adopted in the sequential control system, the capacity of adapting to all first-degree faults and most second-degree faults is achieved, a single-point failure link does not exist, and the reliability is high. Normal work of the sequential control system can be ensured in the flight process of the carrier rocket. Based on a three-bus communication electrical architecture of a new generation carrier rocket electrical system, a full-redundancy design implementation method of information source redundancy, transmission line redundancy, voting control redundancy and instruction driving redundancy is adopted, high-reliability carrier rocket time sequence control is completed, the fault adaptive capacity of the time sequence control system is improved, and the time sequence control system has a wide application prospect. And the working reliability of the system in the rocket flight process is ensured.

The invention provides an intelligent circuit breaker fault detection and maintenance method based on double MCUs, and the method achieves the automatic uninterrupted switching when a single MCU breaks down through the main and standby redundancy design, avoids the system breakdown, and greatly improves the usability and reliability. Quantitative scoring of the state of the main control MCU is achieved through a health assessment self-checking algorithm, and the accuracy of fault judgment is guaranteed. Through an intelligent switching arbitration mechanism, on the basis of switching probability calculation and confidence evaluation (health degree stability), a secondary confirmation mechanism is matched, and the error switching risk is effectively reduced. Line fault and MCU hardware fault detection is supported, and fault self-healing is achieved. And after the faulted MCU is recovered, the master and standby roles are automatically returned, so that the manual operation and maintenance cost is reduced.