A dual-redundancy control method based on a high-performance multi-core processor and related devices

Abstract

The application discloses a kind of dual-redundancy control method and related device based on high-performance multicore processor belongs to engine controller technical field, the system dual-redundancy controller includes main control unit and slave control unit, main control unit and slave control unit respectively include DSP and FPGA, between DSP and FPGA through EMIF bus connection, between core 0 through SRIO connection, between core 1 through UART connection, core 0 communication connection core 1;The FPGA of main control unit and slave control unit is connected corresponding core 1, the core 1 of main control unit is connected to the FPGA of slave control unit by STATE signal, and the core 1 of slave control unit is connected to the FPGA of main control unit by STATE signal;Between the core 1 and FPGA of main control unit and slave control unit, there are two connections, one is connected by DOG signal, and the other is connected by WORK signal.The application not only can solve the conventional switching problem by hot standby redundancy switching, but also solve the switching problem under the condition of processor crash and recovery.

Description

Technical Field

[0001] This invention belongs to the field of engine controller technology, specifically relating to a dual-redundancy control method and related devices based on a high-performance multi-core processor. Background Technology

[0002] The engine is the heart of an aircraft, and the engine controller is the core device for engine control. It controls the engine's operation by collecting sensor data and receiving flight commands from the flight control equipment, ensuring the engine operates at its optimal state. Firstly, due to the nature of the industry, aero engines have high reliability and safety requirements. Most engines use a single controller, which cannot effectively prevent engine runaway caused by unexpected controller failure. Secondly, if the processor performance is poor, it cannot effectively handle increasingly complex and sophisticated engine control algorithms, nor can it promptly handle unexpected events under complex operating conditions. This leads to longer redundancy switching times, and the inability to exchange data accurately and promptly between master and slave control units also causes delays in switching operating states, preventing timely transitions between redundant units. Furthermore, in cases of processor crashes or abnormal program crashes, controller switching and crash recovery control also need to be handled. Therefore, handling single-engine crashes in a dual-engine system is also crucial. Summary of the Invention

[0003] The purpose of this invention is to provide a dual-redundancy control method and related device based on a high-performance multi-core processor, in order to solve the problem that the existing technology uses a single controller to control the engine, which cannot effectively avoid the engine going out of control due to unexpected controller failure. It realizes timely switching between dual-redundant master and slave devices, rapid interaction of data and control status, and can handle more complex and advanced engine control algorithms, as well as state switching in complex situations such as DSP crashes and malfunctions, ensuring that the engine can operate stably and reliably.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, a dual-redundant control system based on a high-performance multi-core processor is characterized in that it comprises: a dual-redundant controller, a flight control device, a switching actuator, and an engine, wherein the dual-redundant controller is communicatively connected to the flight control device, and the switching actuator is connected to the dual-redundant controller and the engine; The dual-redundant controller includes a master control unit (ECU) and a slave control unit (ECU). The master control unit and the slave control unit each include a DSP (Digital Signal Processor) and an FPGA (Field-Programmable Gate Array), respectively. The DSP and the FPGA are connected via an EMIF (External Memory Interface) bus. Each DSP includes core 0 and core 1. Cores 0 are connected to each other via SRIO (Serial RapidIO), and cores 1 are connected to each other via UART (Universal Asynchronous Receiver / Transmitter). Core 0 is communicatively connected to core 1 in its own DSP. The core 0 is connected to the flight control equipment. The FPGAs of the main control unit and the slave control unit are respectively connected to the corresponding core 1. The core 1 of the main control unit is connected to the FPGA of the slave control unit through the STATE signal, and the core 1 of the slave control unit is connected to the FPGA of the main control unit through the STATE signal. The master control unit and slave control unit have two connections between their core 1 and FPGA: one is a DOG signal connection, and the other is a WORK signal connection.

[0005] Secondly, a dual-redundancy control method based on a high-performance multi-core processor, comprising the following steps based on the aforementioned dual-redundancy control system: After the dual-redundant controller is powered on, the main control unit or the slave control unit connects to the switching actuator to control the engine operation. At this time, the main control unit or the slave control unit is the on-duty unit. When the main control unit is the on-duty unit, the slave control unit is disconnected from the switching actuator. At this time, the slave control unit is the hot standby unit. When the slave control unit is the on-duty unit, the main control unit is disconnected from the switching actuator. At this time, the main control unit is the hot standby unit. The dual-redundant controller has two switching modes: the first switching mode is the normal switching of the controller, and the second switching mode is the switching mode after the controller crashes and is reset. When the dual-redundant controller receives a switching command from the flight control device, or when the core 0 detects an abnormality in the dual-redundant controller, the dual-redundant controller performs a normal controller switching. When the DSP of the dual-redundant controller crashes, or when the core 0 program runs out of control, the dual-redundant controller performs a controller crash reset switch.

[0006] In some implementations, when the dual-redundant controller receives a switching command from the flight control device, the dual-redundant controller performs a routine controller switching, specifically including the following steps: The flight control equipment sends a switching command to core 0 of the on-duty unit and the hot standby unit. Core 0 of the on-duty unit and the hot standby unit respectively sends the switching command to core 1 of the on-duty unit and the hot standby unit, respectively, and turns off the WORK signal of core 1 of the on-duty unit. At the same time, core 1 of the on-duty unit sends the switching command to core 1 of the hot standby unit through UART. At this time, the WORK signal of core 1 of the hot standby unit is turned on, and the switching is completed.

[0007] In some implementations, when the core 0 detects an anomaly in the dual-redundant controller, the dual-redundant controller performs a routine switchover, specifically including the following steps: The core 0 of the on-duty unit sends a switching command to the core 1 of the on-duty unit, turns off the WORK signal of the core 1 of the on-duty unit, and at the same time, the core 1 of the on-duty unit sends the switching command to the core 1 of the hot standby unit through UART. At this time, the WORK signal of the core 1 of the hot standby unit is turned on, and the controller switching is completed.

[0008] In some implementations, when the DSP of the dual-redundant controller crashes, the dual-redundant controller performs a controller crash reset switch, specifically including the following steps: When the DSP of the on-duty unit crashes, the FPGA of the on-duty unit does not detect the DOG and WORK signals, and only detects the STATE signal. At this time, the FPGA of the hot standby unit does not detect the STATE signal and changes the working state of the hot standby unit to the working state of the on-duty unit. At the same time, the core 1 of the hot standby unit turns on the WORK signal to complete the controller switching. After the on-duty unit is reset, it does not take over its own WORK signal and maintains a low level.

[0009] In some implementations, the following steps are also included: When the DSP of the hot standby unit crashes, the FPGA of the on-duty unit does not detect the STATE signal, and the FPGA of the hot standby unit does not detect the DOG and WORK signals. If only the STATE signal is detected, no controller switching is performed. After being reset, the hot standby unit does not take over its own WORK signal and maintains a low level.

[0010] In some implementations, the following steps are also included: When both the on-duty unit and the hot standby unit crash simultaneously, both units will be reset and maintain their previous normal operating state.

[0011] In some implementations, when the core 0 program crashes, the dual-redundant controller is reset and the controller is switched, specifically including the following steps: If core 1 of the on-duty unit does not detect the periodic instruction of core 0 of the on-duty unit within a preset time, core 1 of the on-duty unit turns off the DOG signal, and the DSP of the on-duty unit is reset at this time.

[0012] In some implementations, if the DSP of the on-duty unit crashes after a reset, the FPGA of the on-duty unit does not detect the DOG and WORK signals, and only detects the STATE signal. At this time, the FPGA of the hot standby unit does not detect the STATE signal and changes the working state of the hot standby unit to the working state of the on-duty unit. At the same time, the core 1 of the hot standby unit turns on the WORK signal to complete the controller switching. After the on-duty unit is reset, it does not take over its own WORK signal and keeps it at a low level.

[0013] Compared with the prior art, the present invention has the following beneficial effects: This invention provides a dual-redundant control system based on a high-performance multi-core processor. The dual-redundant controller includes a master control unit and a slave control unit, each comprising a DSP and an FPGA, respectively. Cores 0 are connected via SRIO, and cores 1 are connected via UART. Core 0 communicates with core 1 within its own DSP and with the flight control equipment. The FPGAs of the master and slave control units are connected to their respective cores 1. Core 1 of the master control unit is connected to the FPGA of the slave control unit via a STATE signal, and vice versa. There are two connections between cores 1 and the FPGA of the master and slave control units: one via a DOG signal and the other via a WORK signal. Based on this system, when the dual-redundant controller receives a switching command from the flight control equipment, or when core 0 detects an abnormality in the dual-redundant controller, the dual-redundant controller performs a normal controller switching. When the DSP of the dual-redundant controller crashes, or when the program on core 0 malfunctions, the dual-redundant controller resets and switches controllers. Therefore, this invention not only realizes timely switching between master and slave devices under dual redundancy control, but also achieves rapid interaction of data and control status to ensure seamless switching between master and slave control units. It can handle relatively complex and advanced engine control algorithms, and can also handle state switching and crash reset recovery in complex situations such as DSP crashes and malfunctions, ensuring that the engine can operate stably and reliably. Attached Figure Description

[0014] Figure 1 A block diagram of a dual-redundant control system based on a high-performance multi-core processor is provided for an embodiment. Figure 2A dual-redundant controller structure diagram of a dual-redundant control system based on a high-performance multi-core processor is provided for an embodiment; Figure 3 This is a diagram illustrating the setup of a simulation experimental environment for a dual-redundancy control method based on a high-performance multi-core processor, provided as an example. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] It should be noted that the control units mentioned in this manual refer to either the main control unit or the slave control unit.

[0017] Example 1 like Figures 1-3 As shown, this embodiment takes the DSP6678+FPGAZ7 platform as an example to provide a dual-redundant control system based on a high-performance multi-core processor. The system uses a high-performance multi-core processor to realize dual-redundant switching control and data exchange of the engine, including: a dual-redundant controller, flight control equipment, a switching actuator and the engine. The dual-redundant controller is communicatively connected to the flight control equipment, and the switching actuator is connected to the dual-redundant controller and the engine. The two control units, Core 0, are connected via SRIO. Core 1 controls the switching by controlling signals such as GPIO and UART. They are connected to the flight controller via two 1553B buses to form a hardware platform. Core 0 and Core 1 communicate through an inter-core IPC module.

[0018] The dual-redundant controller includes a master control unit and a slave control unit. Each control unit consists of a high-performance multi-core DSP processor and an FPGA processor. The FPGA expands the hardware interfaces, including sensor data AD acquisition interfaces, speed acquisition interfaces, switch and actuator control, 1553B communication interfaces, watchdog timers, KIKO interfaces, and other hardware interfaces. The DSP and FPGA are connected via an EMIF bus to access and control the hardware interfaces, and use GPIO to detect the operating status and switch the actuators. The DSP is a high-performance multi-core processor; core 0 runs the engine control software, implementing engine control algorithms and data exchange, while core 1 runs the switching control software to achieve dual-redundant switching control.

[0019] The master control unit and slave control unit's core 0 communicate via SRIO. The control unit in on-duty mode and the control unit in hot standby mode exchange data and control status signals via SRIO. During switching, high-speed SRIO communication enables real-time exchange of data such as engine control status parameters, achieving seamless switching. Furthermore, the master control unit and slave control unit's core 0 each communicate with the flight controller via I553B. The two control units' core 1s exchange switching commands and status via UART. Core 0 and core 1 exchange commands and data through inter-core communication.

[0020] In addition, the core 1 of the two control units controls the two GPIO signals of DOG-A or DOG-B to send square waves to their respective FPGAs to implement watchdog feeding. When the DSP crashes, it can be reset and restarted.

[0021] Core 1 of the two control units controls the switcher and actuator by controlling the WORK-A or WORK-B GPIO signals. The channel with a square wave signal output is the on-duty unit, and the switcher controls the actuator to connect to the corresponding on-duty unit; otherwise, it is a hot standby unit. Furthermore, Core 1 of the two control units connects to the peer FPGA via STATE-A2B and STATE-B2A respectively. When the FPGA detects a square wave signal, it indicates that the peer program is running and DSP Core 1 has not crashed. Core 0 sends periodic instructions to Core 1 via inter-core communication. If Core 1 does not detect any instructions from Core 0 for a certain period of time, it considers Core 0 to have crashed.

[0022] When the controller is powered on, the main control unit is connected to the actuator by default to control the engine operation. The main control unit is the on-duty unit, and at this time, DOG-A, STATE-A2B, and WORK-A send square waves. When the controller unit is disconnected from the actuator, it becomes a hot standby unit. At this time, DOG-B and STATE-B2A send square waves, and WORK-B has no square wave output.

[0023] Example 2 Based on the dual-redundant control system provided in Embodiment 1, this embodiment provides a dual-redundant control method based on a high-performance multi-core processor. Engine control software is programmed into core 0, and switching control software is programmed into core 1. The flight control equipment is simulated and tested using the accompanying host computer software. The flight control equipment sends master-to-slave and slave-to-master commands via 1553B, allowing normal switching between the master and slave control units. When the simulated core 0 detects a 1553B communication acquisition failure, it can switch from the master control unit to the slave control unit. The simulated master control unit is the on-duty unit, and the slave control unit is the hot standby unit. When the master control unit's DSP crashes, it can switch to the slave control unit; when the slave control unit's DSP crashes, its state remains unchanged; when both the master and slave control unit's DSPs crash, after reset, the master control unit becomes the on-duty unit, and the slave control unit becomes the hot standby unit. When the simulated core 0 crashes, an interrupt is sent to core 1 with a periodic command, allowing the master control unit to switch to the slave control unit, while the master control unit resets and becomes a hot standby unit. Specifically, the method includes the following steps: After the dual-redundant controller is powered on, the main control unit or the slave control unit connects to the switching actuator to control the engine operation. At this time, the main control unit or the slave control unit is the on-duty unit. When the main control unit is the on-duty unit, the slave control unit is disconnected from the switching actuator. At this time, the slave control unit is the hot standby unit. When the slave control unit is the on-duty unit, the main control unit is disconnected from the switching actuator. At this time, the main control unit is the hot standby unit. When the dual-redundant controller receives a switching command from the flight control device, or when the core 0 detects an abnormality in the dual-redundant controller, the dual-redundant controller performs a normal controller switching. When the DSP of the dual-redundant controller crashes or the core 0 program runs out of control, the dual-redundant controller is reset and the controller is switched.

[0024] Therefore, the dual-redundancy control method has two switching modes: mode one is normal controller switching, and mode two is controller crash reset switching. Normal switching includes flight control command switching and fault switching; controller crash reset switching includes reset recovery and switching caused by abnormal program crashes or abnormal processor crashes.

[0025] Regular handover can be divided into the following two cases: (1) The flight control equipment sends a command to control the switching. The flight control equipment sends a switching command to core 0 of the two control units through two 1553B channels. Core 0 sends the switching command to core 1 through inter-core communication to execute the switching. When the master control unit switches to the slave control unit, the master control unit core 0 sends a switching command to core 1 to shut down WORK-A, and at the same time sends a master-slave switching command through UART; the slave control unit sends a switching command to core 1 through 1553B and core 0, and at the same time receives the switching status change through UART. After recognizing the master-slave switching command, it turns on WORK-B and completes the switching.

[0026] A similar process is executed when switching from the slave to the master. For example, when switching from the slave control unit to the master control unit, the slave control unit core 0 sends a switching command to core 1 to shut down WORK-B, and at the same time sends a slave-to-master switching command via UART. The master control unit sends a switching command to core 1 via 1553B and core 0, and at the same time receives the switching status change via UART. After recognizing the slave-to-master switching command, it turns on WORK-A and completes the switching.

[0027] (2) Fault Status Detection and Switching. When Core 0 detects an abnormality in the dual-redundant controller, i.e., an abnormality in AD acquisition, 1553 communication, or other control status that has a fatal impact on control, it sends a switching command to Core 1 to perform the switch. If the main control unit is the on-duty unit and the slave control unit is the hot standby unit, when the main control unit Core 0 detects an abnormality in AD acquisition, the main control unit Core 0 sends a switching command to Core 1 to shut down WORK-A, and at the same time sends a master-slave switching command through UART. After receiving the switching status change through UART, the slave control unit turns on WORK-B to complete the switch.

[0028] A similar process is executed when switching from the control unit to the main control unit. For example, if the control unit is the on-duty unit and the main control unit is the hot standby unit, the control unit core 0 detects an AD acquisition abnormality, sends a switching command to core 1 to shut down WORK-B, and simultaneously sends a slave-to-master switching command via UART. After receiving the switching status change via UART, the main control unit turns on WORK-A to complete the switch.

[0029] The controller crash reset switching can be categorized into the following situations: When the main control unit is the on-duty unit and the slave control unit is the hot standby unit, the operating status is recorded as 0x10. The main control unit's DOG-A, STATE-A2B, and WORK-A all transmit square waves normally; the slave control unit's DOG-A and STATE-B2A transmit square waves, while the WORK-B signal remains low. Core 1 controls the watchdog timer, on-duty switching signal, and operating status signal.

[0030] When the DSP of the dual-redundant controller crashes, the dual-redundant controller is reset and the controller is switched, mainly due to the following situations: (1) When the main control unit is the on-duty unit and the slave control unit is the hot standby unit, the working state is recorded as 0x10. If the main controller unit DSP crashes, FPGA-A cannot detect DOG-A and WORK-A, but detects STATE-B2A and sets the state to 0x01; FPGA-B cannot detect STATE-A2B and changes the state to 0x01. At the same time, core 1 detects the state change and opens WORK-B, switching to the slave control unit for execution. After the main control unit watchdog is reset, it reads the state as 0x01, does not take over control, keeps WORK-A at a low level, and maintains the hot standby state.

[0031] (2) When the main control unit is the on-duty unit and the slave control unit is the hot standby unit, the working status is recorded as 0x10. If the slave controller unit DSP crashes, FPGA-A cannot detect STATE-B2A, the status remains 0x10, and no switch is made. The slave control unit FPGA-B cannot detect DOG-B and WORK-B, but detects STATE-A2B, and the status is recorded as 0x10. After the slave control unit watchdog is reset, the status is read as 0x01, and it does not take over control to keep WORK-B at a low level, maintaining the hot standby status.

[0032] (3) When the main control unit is the on-duty unit and the slave control unit is the hot standby unit, the working state is recorded as 0x10. If the main control unit and the slave control unit DSP crash at the same time, neither FPGA-A nor FPGA-B can detect any signals. After resetting, the state remains 0x10. By default, the main control unit will run again and the slave control unit will be in hot standby state.

[0033] When the slave control unit is running and the master control unit is in hot standby, a similar switching process as described above is performed.

[0034] When the core 0 program crashes, the dual-redundant controller is reset and the controller is switched, specifically including the following steps: The process switches between core 0 (CPU 0) programs that crash or freeze. If the main control unit is the on-duty unit and the slave control unit is a hot standby unit, core 1 of the main control unit will not detect core 0's periodic instructions for a certain period. Core 1 will actively shut down DOG-A, causing the main control unit's DSP to reset. At this point, the crash reset switching procedure is executed. When the main control unit is the on-duty unit and the slave control unit is a hot standby unit, the operating state is recorded as 0x10. If the main control unit's DSP freezes, FPGA-A will not detect DOG-A and WORK-A, but will detect STATE-B2A, setting its state to 0x01. FPGA-B will not detect STATE-A2B and will change its state to 0x01. Simultaneously, core 1 will detect the state change, open WORK-B, and switch to the slave control unit for execution. After the main control unit's watchdog resets, it reads the state as 0x01, does not take over control, and keeps WORK-A low, maintaining the hot standby state and completing the switchover. A similar procedure is executed when switching from the slave control unit to the main control unit.

[0035] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A dual-redundancy control method based on a high-performance multi-core processor, characterized in that, A dual-redundant control system based on a high-performance multi-core processor includes: a dual-redundant controller, flight control equipment, a switching actuator, and an engine. The dual-redundant controller is communicatively connected to the flight control equipment, and the switching actuator is connected to the dual-redundant controller and the engine. The dual-redundant controller includes a master control unit and a slave control unit. The master control unit and the slave control unit each include a DSP and an FPGA, respectively. The DSP and the FPGA are connected via an EMIF bus. Each DSP includes core 0 and core 1. The core 0s are connected via SRIO, and the core 1s are connected via UART. The core 0 communicates with the core 1 in its own DSP. The core 0 is connected to the flight control equipment. The FPGAs of the main control unit and the slave control unit are respectively connected to the corresponding core 1. The core 1 of the main control unit is connected to the FPGA of the slave control unit through the STATE signal, and the core 1 of the slave control unit is connected to the FPGA of the main control unit through the STATE signal. The main control unit and the slave control unit have two connections between their core 1 and FPGA, one of which is connected via the DOG signal and the other via the WORK signal. The dual-redundant control system based on the high-performance multi-core processor includes the following steps: After the dual-redundant controller is powered on, the main control unit or the slave control unit connects to the switching actuator to control the engine operation. At this time, the main control unit or the slave control unit is the on-duty unit. When the main control unit is the on-duty unit, the slave control unit is disconnected from the switching actuator. At this time, the slave control unit is the hot standby unit. When the slave control unit is the on-duty unit, the main control unit is disconnected from the switching actuator. At this time, the main control unit is the hot standby unit. The dual-redundant controller has two switching modes: the first switching mode is the normal switching of the controller, and the second switching mode is the switching mode after the controller crashes and is reset. When the dual-redundant controller receives a switching command from the flight control device, or when the core 0 detects an abnormality in the dual-redundant controller, the dual-redundant controller performs a normal controller switching. When the DSP of the dual-redundant controller crashes, or the core 0 program runs out of control, the dual-redundant controller performs a controller crash reset switch. When the DSP of the hot standby unit crashes, the FPGA of the on-duty unit does not detect the STATE signal, and the FPGA of the hot standby unit does not detect the DOG and WORK signals. If only the STATE signal is detected, no controller switching is performed. After being reset, the hot standby unit does not take over its own WORK signal and maintains a low level.

2. The dual redundancy control method based on a high-performance multi-core processor according to claim 1, characterized in that, When the dual-redundant controller receives the switching command from the flight control device, the dual-redundant controller performs a routine controller switching, specifically including the following steps: The flight control equipment sends a switching command to core 0 of the on-duty unit and the hot standby unit. Core 0 of the on-duty unit and the hot standby unit respectively sends the switching command to core 1 of the on-duty unit and the hot standby unit, respectively, and turns off the WORK signal of core 1 of the on-duty unit. At the same time, core 1 of the on-duty unit sends the switching command to core 1 of the hot standby unit through UART. At this time, the WORK signal of core 1 of the hot standby unit is turned on, and the switching is completed.

3. The dual redundancy control method based on a high-performance multi-core processor according to claim 2, characterized in that, When core 0 detects an anomaly in the dual-redundant controller, the dual-redundant controller performs a routine switchover, specifically including the following steps: The core 0 of the on-duty unit sends a switching command to the core 1 of the on-duty unit, turns off the WORK signal of the core 1 of the on-duty unit, and at the same time, the core 1 of the on-duty unit sends the switching command to the core 1 of the hot standby unit through UART. At this time, the WORK signal of the core 1 of the hot standby unit is turned on, and the controller switching is completed.

4. The dual redundancy control method based on a high-performance multi-core processor according to claim 1, characterized in that, When the DSP of the dual-redundant controller crashes, the dual-redundant controller performs a controller crash reset switch, which specifically includes the following steps: When the DSP of the on-duty unit crashes, the FPGA of the on-duty unit does not detect the DOG and WORK signals, and only detects the STATE signal. At this time, the FPGA of the hot standby unit does not detect the STATE signal and changes the working state of the hot standby unit to the working state of the on-duty unit. At the same time, the core 1 of the hot standby unit turns on the WORK signal to complete the controller switching. After the on-duty unit is reset, it does not take over its own WORK signal and maintains a low level.

5. The dual redundancy control method based on a high-performance multi-core processor according to claim 1, characterized in that, It also includes the following steps: When both the on-duty unit and the hot standby unit crash simultaneously, both units will be reset and maintain their previous normal operating state.

6. The dual redundancy control method based on a high-performance multi-core processor according to claim 1, characterized in that, When the core 0 program crashes, the dual-redundant controller performs a controller crash reset switch, specifically including the following steps: If core 1 of the on-duty unit does not detect the periodic instruction of core 0 of the on-duty unit within a preset time, core 1 of the on-duty unit turns off the DOG signal, and the DSP of the on-duty unit is reset at this time.

7. The dual redundancy control method based on a high-performance multi-core processor according to claim 6, characterized in that, If the DSP of the on-duty unit crashes after a reset, the FPGA of the on-duty unit does not detect the DOG and WORK signals, and only detects the STATE signal. At this time, the FPGA of the hot standby unit does not detect the STATE signal and changes the working state of the hot standby unit to the working state of the on-duty unit. At the same time, the core 1 of the hot standby unit turns on the WORK signal to complete the controller switching.

8. The dual redundancy control method based on a high-performance multi-core processor according to claim 7, characterized in that, After the on-duty unit is reset, it does not take over its own WORK signal and maintains a low level.

9. A dual-redundant control system based on a high-performance multi-core processor, characterized in that, The dual-redundancy control method according to any one of claims 1 to 8 includes: a dual-redundancy controller, a flight control device, a switching actuator, and an engine, wherein the dual-redundancy controller is communicatively connected to the flight control device, and the switching actuator is connected to the dual-redundancy controller and the engine; The dual-redundant controller includes a master control unit and a slave control unit. The master control unit and the slave control unit each include a DSP and an FPGA, respectively. The DSP and the FPGA are connected via an EMIF bus. Each DSP includes core 0 and core 1. The core 0s are connected via SRIO, and the core 1s are connected via UART. The core 0 communicates with the core 1 in its own DSP. The core 0 is connected to the flight control equipment. The FPGAs of the main control unit and the slave control unit are respectively connected to the corresponding core 1. The core 1 of the main control unit is connected to the FPGA of the slave control unit through the STATE signal, and the core 1 of the slave control unit is connected to the FPGA of the main control unit through the STATE signal. The main control unit and the slave control unit have two connections between their core 1 and FPGA, one of which is connected via the DOG signal and the other via the WORK signal.

Images