A master-slave switching method for dual-redundancy controller

Abstract

The present invention provides a master-slave power grabbing switching method for a dual-redundancy controller, including powering on two controllers in the dual-redundancy controller and performing self-test, recording the execution time and result of the power-on self-test; judging whether the two controllers in the dual-redundancy controller are loaded with a master configuration table or a slave configuration table according to the power-on self-test result, the execution time of the power-on self-test, and the differential power grabbing discrete quantity; setting the master-slave role of each controller according to the feeding time of the network watchdog when the configuration tables of the two controllers in the dual-redundancy controller are loaded, and completing the master-slave power grabbing process; the two controllers in the dual-redundancy controller are working, and if the controller fails, the master-slave switching is performed. The above method is oriented to the high-reliability working requirements of the dual-redundancy controller, and can avoid the imbalance and other problems caused by the traditional static setting.

Description

Technical Field

[0001] The invention belongs to the technical field of avionics system application, and in particular relates to a master-slave right-grabbing switching method for a dual-redundancy controller. Background Art

[0002] In the field of airborne embedded systems, a system controller is generally set up to manage the entire system. In order to improve the availability of the controller, dual-redundancy controllers are often used, and master and slave roles are set up through certain mechanisms to work together.

[0003] At present, the traditional method of setting the master and slave roles of controllers is to set them statically, that is, to set one as the master and the other as the slave, and automatically switch to the slave controller when the master controller fails. This method often causes the master controller to often carry more tasks, resulting in load imbalance, and even when the master controller has obvious problems and abnormalities, it is still set as the master controller "with problems", which makes the system have hidden dangers. Summary of the invention

[0004] The purpose of the present invention is to solve the problems of load imbalance between the master controller and the slave controller, "defective" operation of the master controller, and safety hazards caused by the traditional static method of setting the master controller and the slave controller in the dual-redundancy controller, and a master-slave switching method of the dual-redundancy controller is designed.

[0005] The technical solution to achieve the purpose of the invention is as follows: A master-slave switching method of a dual-redundancy controller comprises the following steps:

[0006] S1. The controller is powered on and performs a self-test, recording the execution time and results of the power-on self-test;

[0007] S2. Determine whether the role can be set based on the power-on self-test result;

[0008] S21, if the power-on self-test result is wrong, it will be automatically set as a slave controller, and the differential grabbing discrete output is set to floating state 1, reporting the controller power-on self-test error, the controller fails, and enters S6;

[0009] S22, if the power-on self-test result is correct, enter S3;

[0010] S3. Determine whether a role can be set according to the differential dispersion state;

[0011] S31, if the differential grabbing power discrete quantity input is in the grounding state 0, it means that the other party is the master controller, then the current controller is set as the slave controller, and the differential grabbing power discrete quantity output is set to the floating state 1, and enter S6;

[0012] If the differential grabbing power discrete quantity input is in floating state 1, the current control needs to grab power with the other controller and enter S4;

[0013] S4. According to the execution time of the power-on self-test, determine whether the controller is loaded with the main configuration table or the slave configuration table;

[0014] S5. According to the feeding time, historical role and location ID of the network watchdog in the configuration table, the master and slave roles of the controller are set to complete the power grabbing process and enter S6;

[0015] S6. When a failure occurs during the operation of this controller and the other controller, a master-slave switch is performed.

[0016] In one embodiment, in step S4, the method for determining whether the controller loads the main configuration table or the slave configuration table is:

[0017] The controller compares the execution time of the current power-on self-test of the controller with the last power-on self-test execution time of the other controller stored locally;

[0018] If this controller is powered on for the first time or has not obtained the last power-on self-test execution time of the other controller, this controller loads the main configuration table;

[0019] When the execution time of the current power-on self-test of the controller is shorter than the execution time of the previous power-on self-test of the other controller, the controller loads the main configuration table;

[0020] When the execution time of the current power-on self-test of the controller is longer than the execution time of the previous power-on self-test of the other controller, the controller loads the slave configuration table.

[0021] In one embodiment, in step S5, according to the feeding time, historical role and location ID of the network watchdog in the configuration table, the master-slave role of the controller is set, and the method for completing the power grabbing process is:

[0022] S501, when the controller loads the main configuration table and does not time out, and receives the timeout information of the other controller, the controller is set as the master role, and the differential grabbing discrete quantity input is set to the ground state 0;

[0023] S502: When both the current controller and the other controller have timed out or have not timed out, determine the last role information of the current controller and the other controller;

[0024] If the roles are inconsistent, the controller is set as the master controller or slave controller according to the last role status;

[0025] If the roles are the same, set the master or slave role of each controller according to the location ID of the two controllers, including:

[0026] Set the controller with a smaller position ID as the master role, and set its differential discrete output to ground state 0; set the controller with a larger position ID as the slave role, and set its differential discrete output to floating state 1;

[0027] S303, if the controller itself times out but the other controller does not time out, the role of the controller is set to be a slave controller, and the differential discrete quantity output is set to a floating state 1.

[0028] Furthermore, both the master configuration table and the slave configuration table are provided with a network watchdog, and the feeding time T1 of the network watchdog in the master configuration table is less than the feeding time T2 of the network watchdog in the slave configuration table.

[0029] Furthermore, the dog feeding time T1 is less than half of the watchdog timeout period, and the dog feeding time T2 is equal to twice the watchdog timeout period.

[0030] In one embodiment, this controller and the other controller are designed to be redundant with each other, have the same structure and are respectively provided with their own unique location IDs, both include a power supply unit, a processing unit, and a network unit, and there will be no single point failure that will cause the loss of redundancy of the controller.

[0031] In one embodiment, in step S6, when a failure occurs during the operation of the controller and the other controller, the method for performing master-slave switching includes:

[0032] S61: If the slave controller fails in the controller and the other controller, the master-slave switch is not performed, and the master controller reports the failure information of the slave controller;

[0033] S62. If the master controller fails between this controller and the other controller, a master-slave switch is performed: after the master controller fails, the grabbing discrete quantity output automatically recovers from the grounded state 0 to the default floating state 1. After the controller finds that the grabbing discrete quantity input changes from the grounded state 0 to the floating state 1, it automatically sets the role to the master controller and sets the grabbing discrete quantity output to the grounded state 0. At this time, the master-slave switch is completed; the original master controller will automatically enter S3 after restarting alone.

[0034] In one embodiment, in step S6, when the controller and the other controller are working, if both are master controllers, the controller with the larger position ID is automatically set as slave, and its differential dispersion output is set to floating state 1;

[0035] If both controllers are slaves at the same time, the controller with the smaller position ID is automatically set as the master, and its differential discrete output is set to ground state 0.

[0036] Compared with the prior art, the beneficial effects of the present invention are: the master-slave power grabbing switching method of the dual-redundancy controller designed by the present invention is mainly aimed at the high-reliability working requirements of the dual-redundancy controller, and the power grabbing is completed through a combination of power-on self-detection, differential power grabbing discrete quantity, configuration table, historical role, position ID, etc., which can avoid the imbalance and other problems brought about by traditional static settings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention or the prior art. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 It is a schematic diagram of the master-slave grabbing power process of the dual-redundancy controller in a specific implementation mode;

[0039] Figure 2 A schematic diagram of a master-slave switching process of a dual-redundancy controller in a specific implementation manner;

[0040] Figure 3 It is a schematic diagram of the master-slave switching process of another dual-redundancy controller in a specific implementation manner. DETAILED DESCRIPTION

[0041] The present invention will be further described below in conjunction with specific embodiments, and the advantages and features of the present invention will become clearer as the description proceeds. However, these embodiments are exemplary only and do not constitute any limitation to the scope of the present invention. It should be understood by those skilled in the art that the details and forms of the technical solution of the present invention may be modified or replaced without departing from the spirit and scope of the present invention, but these modifications and replacements all fall within the scope of protection of the present invention.

[0042] In the description of this embodiment, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside" and "outside" etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the invention.

[0043] In addition, the terms "first", "second", "third", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0044] This specific implementation provides a master-slave switching method for a dual-redundancy controller. In this specific implementation, the controller and the other controller in the dual-redundancy controller are designed to be redundant with each other, have the same structure and are respectively provided with their own unique location IDs, and both controllers include a power supply unit, a processing unit, and a network unit, and there will be no single point failure that will cause the loss of redundancy of the controller, so as to ensure that there will be no other single point failure that will cause the loss of redundancy of the controller.

[0045] In the master-slave grabbing and switching design of the two controllers in this specific implementation method, grabbing and switching are completed through a combination of power-on self-detection of each controller, differential grabbing discrete quantity, configuration table, historical role, position ID, etc.

[0046] For details, see Figures 1 to 3 As shown, the master-slave switching method of the dual-redundancy controller includes the following steps:

[0047] S1. The controller is powered on and performs a self-test, recording the execution time and results of the power-on self-test;

[0048] S2. Determine whether the role can be set based on the power-on self-test result;

[0049] S21, if the power-on self-test result is wrong, it will be automatically set as a slave controller, and the differential grabbing discrete output is set to floating state 1, reporting the controller power-on self-test error, the controller fails, and enters S6;

[0050] S22, if the power-on self-test result is correct, enter S3;

[0051] S3. Determine whether a role can be set according to the differential dispersion state;

[0052] S31, if the differential grabbing power discrete quantity input is in the grounding state 0, it means that the other party is the master controller, then the current controller is set as the slave controller, and the differential grabbing power discrete quantity output is set to the floating state 1, and enter S6;

[0053] If the differential grabbing power discrete quantity input is in floating state 1, the current control needs to grab power with the other controller and enter S4;

[0054] S4. According to the execution time of the power-on self-test, determine whether the controller is loaded with the main configuration table or the slave configuration table;

[0055] S5. According to the feeding time, historical role and location ID of the network watchdog in the configuration table, the master and slave roles of the controller are set to complete the power grabbing process and enter S6;

[0056] S6: When a failure occurs during the operation of this controller and the other controller, the master-slave switch is performed.

[0057] In one embodiment, in the above step S4, the method for determining whether the controller loads the main configuration table or the slave configuration table is:

[0058] The controller compares the execution time of the current power-on self-test of the controller with the last power-on self-test execution time of the other controller stored locally;

[0059] If this controller is powered on for the first time or has not obtained the last power-on self-test execution time of the other controller, this controller loads the main configuration table;

[0060] When the execution time of the current power-on self-test of the controller is shorter than the execution time of the previous power-on self-test of the other controller, the controller loads the main configuration table;

[0061] When the execution time of the current power-on self-test of the controller is longer than the execution time of the previous power-on self-test of the other controller, the controller loads the slave configuration table.

[0062] In one embodiment, in step S5, according to the feeding time, historical role and location ID of the network watchdog in the configuration table, the master-slave role of the controller is set, and the method for completing the power grabbing process is:

[0063] S501, when the controller loads the main configuration table and does not time out, and receives the timeout information of the other controller, the controller is set as the master role, and the differential grabbing discrete quantity input is set to the ground state 0;

[0064] S502: When both the current controller and the other controller have timed out or have not timed out, determine the last role information of the current controller and the other controller;

[0065] If the roles are inconsistent, the controller is set as the master controller or slave controller according to the last role status;

[0066] If the roles are the same, set the master or slave role of each controller according to the location ID of the two controllers, including:

[0067] Set the controller with a smaller position ID as the master role, and set its differential discrete output to ground state 0; set the controller with a larger position ID as the slave role, and set its differential discrete output to floating state 1;

[0068] S303, if the controller itself times out but the other controller does not time out, the role of the controller is set to be a slave controller, and the differential discrete quantity output is set to a floating state 1.

[0069] Furthermore, both the master configuration table and the slave configuration table are provided with a network watchdog, and the feeding time T1 of the network watchdog in the master configuration table is less than the feeding time T2 of the network watchdog in the slave configuration table.

[0070] Furthermore, the dog feeding time T1 is less than half of the watchdog timeout period, and the dog feeding time T2 is equal to twice the watchdog timeout period.

[0071] In one embodiment, this controller and the other controller are designed to be redundant with each other, have the same structure and are respectively provided with their own unique location IDs, both include a power supply unit, a processing unit, and a network unit, and there will be no single point failure that will cause the loss of redundancy of the controller.

[0072] In one embodiment, in step S6, see Figure 3 As shown, during the operation of the controller and the other controller, when a failure occurs, the method for performing master-slave switching includes:

[0073] S61: If the slave controller fails in the controller and the other controller, the master-slave switch is not performed, and the master controller reports the failure information of the slave controller;

[0074] S62. If the master controller fails between this controller and the other controller, a master-slave switch is performed: after the master controller fails, the grabbing discrete quantity output automatically recovers from the grounded state 0 to the default floating state 1. After the controller finds that the grabbing discrete quantity input changes from the grounded state 0 to the floating state 1, it automatically sets the role to the master controller and sets the grabbing discrete quantity output to the grounded state 0. At this time, the master-slave switch is completed; the original master controller will automatically enter S3 after restarting alone.

[0075] In one embodiment, in step S6, when the controller and the other controller are working, if both are master controllers, the controller with the larger position ID is automatically set as slave, and its differential dispersion output is set to floating state 1;

[0076] If both controllers are slaves at the same time, the controller with the smaller position ID is automatically set as the master, and its differential discrete output is set to ground state 0.

[0077] The master-slave grabbing switching method of the dual-redundancy controller designed by the present invention is mainly aimed at the high-reliability working requirements of the dual-redundancy controller. The grabbing is completed through a combination of power-on self-detection, differential grabbing discrete quantity, configuration table, historical role, position ID, etc., which can avoid the imbalance and other problems caused by traditional static settings.

[0078] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

[0079] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A master-slave switching method for a dual-redundancy controller, characterized in that: The following steps are involved: S1. The controller is powered on and performs a self-test, recording the execution time and results of the power-on self-test; S2. Determine whether the role can be set based on the power-on self-test result; S21, if the power-on self-test result is wrong, it will be automatically set as a slave controller, and the differential grabbing discrete output is set to floating state 1, reporting the controller power-on self-test error, the controller fails, and enters S6; S22, if the power-on self-test result is correct, enter S3; S3. Determine whether a role can be set according to the differential dispersion state; S31, if the differential grabbing power discrete quantity input is in the grounding state 0, it means that the other party is the master controller, then the current controller is set as the slave controller, and the differential grabbing power discrete quantity output is set to the floating state 1, and enter S6; If the differential grabbing power discrete quantity input is in floating state 1, the current control needs to grab power with the other controller and enter S4; S4, judging whether the controller is loading a master configuration table or a slave configuration table according to the power-on self-test execution time, including: the controller compares the current power-on self-test execution time of the controller with the last power-on self-test execution time of the other controller stored locally; If this controller is powered on for the first time or the last power-on self-test execution time of the other controller is not obtained, this controller loads the main configuration table; when the current power-on self-test execution time of this controller is shorter than the last power-on self-test execution time of the other controller, this controller loads the main configuration table; when the current power-on self-test execution time of this controller is longer than the last power-on self-test execution time of the other controller, this controller loads the slave configuration table; S5. According to the feeding time, historical role and location ID of the network watchdog in the configuration table, the master and slave roles of the controller are set to complete the power grabbing process and enter S6; S6. When a failure occurs during the operation of this controller and the other controller, a master-slave switch is performed.

2. The master-slave switching method of the dual-redundancy controller according to claim 1 is characterized in that: In step S5, according to the feeding time, historical role and location ID of the network watchdog in the configuration table, the master-slave role of the controller is set to complete the power grabbing process as follows: S501, when the controller loads the main configuration table and does not time out, and receives the timeout information of the other controller, the controller is set as the master role, and the differential grabbing discrete quantity input is set to the ground state 0; S502: When both the current controller and the other controller have timed out or have not timed out, determine the last role information of the current controller and the other controller; If the roles are inconsistent, the controller is set as the master controller or slave controller according to the last role status; If the roles are the same, set the master or slave role of each controller according to the location ID of the two controllers, including: Set the controller with a smaller position ID as the master role, and set its differential discrete output to ground state 0; set the controller with a larger position ID as the slave role, and set its differential discrete output to floating state 1; S303, if the controller itself times out but the other controller does not time out, the role of the controller is set to be a slave controller, and the differential discrete quantity output is set to a floating state 1.

3. The master-slave switching method of the dual-redundancy controller according to claim 1 or 2 is characterized in that: Both the master configuration table and the slave configuration table are provided with a network watchdog, and the feeding time T1 of the network watchdog in the master configuration table is less than the feeding time T2 of the network watchdog in the slave configuration table.

4. The master-slave switching method of the dual-redundancy controller according to claim 3 is characterized in that: The dog feeding time T1 is less than half of the watchdog timeout time, and the dog feeding time T2 is equal to twice the watchdog timeout time.

5. The master-slave switching method of the dual-redundancy controller according to claim 1 is characterized in that: This controller and the other controller are designed for mutual redundancy, have the same structure and are respectively provided with their own unique location IDs, both include a power supply unit, a processing unit, and a network unit, and there will be no single point failure that will cause the loss of redundancy of the controller.

6. The master-slave switching method of the dual-redundancy controller according to claim 1 is characterized in that: In step S6, when a failure occurs during the operation of the controller and the other controller, the method for performing master-slave switching includes: S61: If the slave controller fails in the controller and the other controller, the master-slave switch is not performed, and the master controller reports the failure information of the slave controller; S62. If the master controller fails between this controller and the other controller, a master-slave switch is performed: after the master controller fails, the grabbing discrete quantity output automatically recovers from the grounded state 0 to the default floating state 1. After the controller finds that the grabbing discrete quantity input changes from the grounded state 0 to the floating state 1, it automatically sets the role to the master controller and sets the grabbing discrete quantity output to the grounded state 0. At this time, the master-slave switch is completed; the original master controller will automatically enter S3 after restarting alone.

7. The master-slave switching method of the dual-redundancy controller according to claim 1 or 6, characterized in that: In step S6, when the current controller and the other controller are working, if both are master controllers, the controller with the larger position ID is automatically set as slave, and its differential discrete output is set to floating state 1; If both controllers are slaves at the same time, the controller with the smaller position ID is automatically set as the master, and its differential discrete output is set to ground state 0.

Images