Control method, control system, and readable storage medium

Abstract

The present invention provides a control method, a control system and a readable storage medium. The control method includes: setting a combination unit at the software level, wherein the combination unit includes at least two multi-channel sequencers. Setting a main sequencer and a redundant sequencer and monitoring their working status. And, controlling the controlled object based on the output signal of the main sequencer; when the monitoring result is abnormal, executing subsequent actions according to the fault response logic. With such a configuration, the MCS unit that has not been fully utilized by the general timer module is reasonably utilized, and the operating reliability of each combination unit is increased in a redundant manner. At the same time, the working status of the main sequencer and the redundant sequencer are monitored simultaneously with the assistance of monitoring means to deal with the situation where any one of them is abnormal. The above scheme solves the problem of lack of monitoring and safety mechanism in the control system scheme based on MCS in the prior art, and has higher security than the conventional safety mechanism that can be thought of.

Description

Technical Field

[0001] The present invention relates to the field of automatic control technology, and in particular to a control method, a control system and a readable storage medium. Background Art

[0002] For electric vehicle power electronics, the control frequency directly impacts product performance. Increasing the control frequency improves motor controller efficiency and NVH (Noise, Vibration, Harshness) performance, reduces ripple in DC-DC products, and enhances the grid adaptability and power quality of on-board chargers (OBCs). Furthermore, with the increasing maturity and widespread adoption of SiC (silicon carbide) power devices, increasing the control frequency is imperative. This, in turn, poses greater challenges to the performance of the MCU (Micro Controller Unit).

[0003] The Generic Timer Module (GTM), a core peripheral for PWM (Pulse Width Modulation) output, has become a standard feature in mainstream MCUs. The GTM's embedded programmable core, the Multi-Channel Sequencer (MCS), operates in parallel with the CPU and efficiently accesses GTM internal resources, making it ideal for applications with stringent real-time requirements, such as power electronics control. Existing solutions address the CPU's lack of computing power due to increased control frequencies by migrating some high-frequency control algorithms from the CPU to the MCS. In power electronics, the MCS acquires sampled signals through the AEM (MCS Bus Master) interface, executes a closed-loop control algorithm, and obtains the desired duty cycle. This signal is then transmitted via the AEI (GTM Bus Interface) interface to the ATOM (ARU-connected Timer Output Module) (ARU, Advanced Routing Unit) for PWM output to the gate driver.

[0004] As the core link in the control system, the MCS carries a highly real-time closed-loop control algorithm. Random hardware failures can become single-point failures, posing a threat to personal safety. For example, instruction set failures can result in an incorrect expected duty cycle, leading to unexpected outputs from the power electronics controller. This can cause unexpected torque in the motor controller and overvoltage in the DC-DC converter (a type of automotive battery). Therefore, monitoring of the MCS unit is essential. Furthermore, the AEM and AEI, as crucial components of the control loop, connect the MCS's sampling signal inputs and PWM duty cycle outputs. Random hardware failures can also directly lead to control system failure, potentially causing safety violations. Therefore, monitoring the AEI and AEM is particularly important.

[0005] The current MCS-based control system solution lacks any monitoring for failures, and there is no safety mechanism designed for MCS on the GTM hardware. Therefore, it is necessary to design a safety mechanism implemented by software to meet functional safety requirements. Summary of the Invention

[0006] The object of the present invention is to provide a control method, a control system and a readable storage medium to solve the problem of lack of monitoring and safety mechanisms in the control system solution based on MCS in the prior art.

[0007] In order to solve the above technical problems, according to a first aspect of the present invention, a control method is provided, which is applied to a universal timer module, wherein the universal timer module includes a plurality of multi-channel sequencers, and the control method includes: setting a combination unit at the software level, wherein the combination unit includes at least two of the multi-channel sequencers. Setting one of the multi-channel sequencers in the combination unit as a main sequencer, and setting the remaining multi-channel sequencers in the combination unit as redundant sequencers. Monitoring the working status of the main sequencer and the redundant sequencer according to a preset logic. And, when the monitoring result is normal, controlling the controlled object based on the output signal of the main sequencer; when the monitoring result is abnormal, executing subsequent actions according to the fault response logic.

[0008] Optionally, the control method further includes: acquiring sampling signals required for the main sequencer and the redundant sequencer to operate based on different signal interfaces.

[0009] Optionally, the step of obtaining the sampling signals required for the operation of the main sequencer and the redundant sequencer based on different signal interfaces includes: obtaining the sampling signals required for the operation of the main sequencer based on a multi-channel sequencer bus host; and obtaining the sampling signals required for the operation of the redundant sequencer based on a universal timer module bus interface.

[0010] Optionally, the step of monitoring the working status of the main sequencer and the redundant sequencer according to a preset logic specifically includes at least one of the following three steps: the redundant sequencer monitors whether a control link is normal based on the output of the main sequencer, the control link starts at a sampling signal input terminal and ends at a control signal output terminal, and the control link includes the main sequencer. Periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or a redundant unit is normal, the redundant unit being a combination structure including the redundant sequencer. Periodically writing a changing test value to the RAM of the main sequencer to monitor whether common cause failures occur in all the multi-channel sequencers.

[0011] Optionally, the step of the redundant sequencer monitoring whether the control link is normal based on the output of the primary sequencer specifically includes: setting the same duty cycle algorithm in the primary sequencer and the redundant sequencer. The redundant sequencer reads back the duty cycle output by the control link and compares it with the duty cycle calculated by itself. If the comparison result is within a reasonable range, the control link is normal; otherwise, the monitoring result is a first abnormality.

[0012] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is the first abnormality, the redundant sequencer requests the CPU to perform independent shutdown.

[0013] Optionally, the step of periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or the redundant unit is normal specifically includes: setting a test instruction set in the redundant sequencer. The CPU periodically sends the changing test request to the redundant sequencer. After receiving the test request, the redundant sequencer calculates and returns a test result according to the test instruction set. In addition, the CPU obtains the returned test result and determines whether the redundant sequencer or the redundant unit is normal or the second abnormality, or, if the CPU does not obtain the returned test result after a preset time period, it determines that the redundant sequencer or the redundant unit is the third abnormality.

[0014] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is the second abnormality or the third abnormality, the CPU directly executes the fault response.

[0015] Optionally, the step of periodically writing a changing test value to the RAM of the master sequencer to monitor whether a common cause failure has occurred in all of the multi-channel sequencers specifically includes: the CPU periodically writing a changing test value to the RAM of the master sequencer; the CPU reading back the test value; and the CPU determining whether the readback test value is consistent with the written test value. If they are consistent, determining that no common cause failure has occurred or continuing the determination; otherwise, the monitoring result is a fourth abnormality.

[0016] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is the fourth abnormality, the CPU directly executes the fault response.

[0017] Optionally, the step of periodically writing changing test values ​​to the RAM of the master sequencer to monitor whether common cause failures occur in all the multi-channel sequencers also includes: after the CPU reads back the test value, the CPU performs a clock failure check based on a clock that is different from the general timer module.

[0018] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is clock failure, the CPU directly executes the fault response.

[0019] To address the above technical issues, according to a second aspect of the present invention, the control system includes a memory, a CPU, and a universal timer module, wherein the universal timer module includes multiple multi-channel sequencers; the CPU is configured to read and execute programs from the memory. The memory and the universal timer module are configured with programs that, when the CPU and the universal timer module work together, execute the above control method.

[0020] In order to solve the above technical problem, according to a third aspect of the present invention, a readable storage medium is provided, on which a program is stored. When the program is run, the above control method is executed.

[0021] Compared to the prior art, the present invention provides a control method, control system, and readable storage medium. The control method includes: configuring a combination unit at the software level, wherein the combination unit includes at least two multi-channel sequencers. One of the multi-channel sequencers in the combination unit is configured as a primary sequencer, and the remaining multi-channel sequencers in the combination unit are configured as redundant sequencers. The operating status of the primary and redundant sequencers is monitored according to a preset logic. Furthermore, when the monitoring result is normal, the controlled object is controlled based on the output signal of the primary sequencer; when the monitoring result is abnormal, subsequent actions are executed according to the fault response logic. This configuration effectively utilizes the underutilized MCS units of the general timer module and increases the operational reliability of each combination unit through redundancy. Monitoring measures are also used to simultaneously monitor the operating status of the primary and redundant sequencers to address the possibility of an abnormality in either. This solution addresses the lack of monitoring and safety mechanisms in prior MCS-based control systems and offers higher security than conventionally conceivable safety mechanisms. The control method, control system, and readable storage medium also have the beneficial effect of requiring no modifications to existing hardware and resulting in low implementation costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Those skilled in the art will appreciate that the accompanying drawings are provided for a better understanding of the present invention and do not constitute any limitation on the scope of the present invention.

[0023] Figure 1 is a flow chart of a control method according to an embodiment of the present invention;

[0024] Figure 2 1 is a schematic structural diagram of a universal timer module according to an embodiment of the present invention;

[0025] Figure 3 is a flowchart of step S41 and step S50 according to an embodiment of the present invention;

[0026] Figure 4 is a flowchart of step S42 and step S50 according to an embodiment of the present invention;

[0027] Figure 5 4 is a flow chart of step S43 and step S50 according to an embodiment of the present invention.

[0028] In the attached figure:

[0029] 1-CPU; 2-Universal timer module; 3-Sampling signal; 4-Controlled object; 21-Master sequencer; 22-Redundant sequencer; 23-Universal timer module bus interface; 24-Multi-channel sequencer bus master; 25-Clock output unit connected to ARU; 26-Clock capture module; 27-Advanced routing unit;

[0030] 101-CPU side process; 102-MCS side process. DETAILED DESCRIPTION

[0031] To make the objects, advantages, and features of the present invention more clearly apparent, the present invention is further described below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the drawings are all in a very simplified form and are not drawn to scale. They are only used to conveniently and clearly assist in illustrating the purposes of the embodiments of the present invention. In addition, the structures shown in the drawings are often part of the actual structure. In particular, different drawings may need to illustrate different focuses and sometimes use different scales.

[0032] As used in the present invention, the singular forms "a", "an", and "the" include plural referents, the term "or" is generally used to include "and / or", the term "several" is generally used to include "at least one", and the term "at least two" is generally used to include "two or more". In addition, the terms "first", "second", and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features specified as "first", "second", and "third" may explicitly or implicitly include one or at least two of the features, "one end" and "the other end" and "proximal end" and "distal end" generally refer to two corresponding parts, which not only include endpoints, and the terms "mounted", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be a communication between two elements or an interaction relationship between two elements. In addition, as used in the present invention, "one element is disposed on another element" generally only indicates that there is a connection, coupling, cooperation, or transmission relationship between the two elements, and the connection, coupling, cooperation, or transmission between the two elements may be direct or indirect through an intermediate element. It should not be understood as indicating or implying a spatial positional relationship between the two elements. That is, one element can be in any orientation, such as inside, outside, above, below, or to one side of another element, unless the content clearly indicates otherwise. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0033] The core idea of ​​the present invention is to provide a control method, a control system and a readable storage medium to solve the problem of lack of monitoring and safety mechanisms in the control system solution based on MCS in the prior art.

[0034] The following description is given with reference to the accompanying drawings.

[0035] Please refer to Figure 1 This embodiment provides a control method applied to a universal timer module 2, wherein the universal timer module 2 includes multiple multi-channel sequencers (MCSs). The control method includes:

[0036] S10 sets a combination unit at a software level, wherein the combination unit includes at least two of the multi-channel sequencers.

[0037] S20 sets one of the multi-channel sequencers in the combination unit as a main sequencer, and sets the remaining multi-channel sequencers in the combination unit as redundant sequencers.

[0038] S30 acquires sampling signals required for the main sequencer and the redundant sequencer to work based on different signal interfaces.

[0039] S40 monitors the working status of the main sequencer and the redundant sequencer according to a preset logic.

[0040] And, in S50, when the monitoring result is normal, the controlled object is controlled based on the output signal of the main sequencer; when the monitoring result is abnormal, subsequent actions are executed according to the fault response logic.

[0041] With such configuration, on the one hand, the overall reliability of the universal timer module 2 is increased through redundant sequencers, and on the other hand, new problems caused by multiple multi-channel sequencers can be avoided through monitoring.

[0042] For ease of understanding, Figure 2 A possible structure of the universal timer module 2 is shown in FIG. It is understandable that, based on the design concept of the present invention, in other embodiments, some details of the structure of the universal timer module 2 can be different from those in FIG. Figure 2 different.

[0043] exist Figure 2 In the embodiment shown, the general timer module 2 (ie, GTM) works in conjunction with the CPU 1. It is understandable that CPU CORE and CPU can be considered equivalent concepts in different embodiments. Figure 2 In the figure, only the content of one of the combination units is shown. In one of the combination units, one MCS is set as the main sequencer 21, and the other MCSs are set as the redundant sequencers 22. The number of the redundant sequencers 22 can be one or more than one.

[0044] In various embodiments, the main sequencer 21 and the redundant sequencer 22 can obtain the sampling signal 3 via the same or different interfaces. Preferably, to further enhance system reliability, the sampling signal 3 required for the operation of the main sequencer 21 is obtained via the multi-channel sequencer bus host 24; and the sampling signal 3 required for the operation of the redundant sequencer 22 is obtained via the universal timer module bus interface 23. In other embodiments, the sampling signal 3 can also be obtained via other interfaces, and is not limited to the above scheme.

[0045] When the monitoring result is normal, the master sequencer 21 outputs a PWM signal through the universal timer module bus interface 23 and the ATOM (i.e., the clock output unit 25 connected to the ARU) to control the controlled object 4. The controlled object 4 is Figure 2 The object in the figure is a door driver. In other embodiments, it may be other controlled objects.

[0046] In the design of the present invention, possible failures that may occur during the generation process of the sampling signal 3 and the execution process of the controlled object 4 are not taken into consideration.

[0047] In this embodiment, three types of failures are mainly concerned. The first is whether the control link fails. The control link starts at the sampling signal input end and ends at the control signal output end, and the control link includes the main sequencer. In this embodiment, it is AEM+MCS+AEI+ATOM. In other embodiments, it may have other structures. The second is the latent failure caused by the addition of the redundant sequencer and ARU. For example, if the main sequencer is in a normal state and the redundant sequencer is in an abnormal state, the redundant sequencer may mistakenly judge the main sequencer as an abnormal state, or if the main sequencer is in an abnormal state and the redundant sequencer is also in an abnormal state, the redundant sequencer should judge the main sequencer as an abnormal state but does not perform the relevant judgment. The anomalies caused by the ARU are similar to the above situations, and these anomalies also need to be eliminated. The third is common cause failure, that is, the situation where the main sequencer and the redundant sequencer fail at the same time due to specific conditions, environment, etc.

[0048] Therefore, please continue to refer to Figure 1The step of monitoring the operating status of the main sequencer and the redundant sequencer according to the preset logic in step S40 specifically includes the following steps: S41, the redundant sequencer monitoring whether the control link is normal based on the output of the main sequencer. S42, periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or the redundant unit is normal, the redundant unit being a combination structure including the redundant sequencer. And, S43, periodically writing a changing test value to the RAM of the main sequencer to monitor whether all the multi-channel sequencers have common cause failures.

[0049] In this embodiment, the redundant unit refers to a structure consisting of an ARU and the redundant sequencer. In other embodiments, it refers to a combined structure including the redundant sequencer for implementing redundancy. It is understood that in other embodiments, step S40 may include only at least one of S41, S42, and S43. Such embodiments can be designed for specific operating conditions, thereby balancing development costs and safety.

[0050] Please refer to Figure 3 In step S41, the redundant sequencer monitors whether the control link is normal based on the output of the main sequencer, and the steps specifically include:

[0051] S411 reads the duty cycle captured by the TIM (Timer Input Module) through the ARU.

[0052] S412 determines whether the redundant expected duty cycle of the previous cycle is equal to the TIM captured duty cycle, where the redundant expected duty cycle is the duty cycle calculated by the redundant sequencer itself, and the TIM captured duty cycle is the duty cycle output by the main sequencer through ATOM.

[0053] S413: If the determination result of S412 is yes, read the sampling signal 3.

[0054] S414: After step S413, a redundancy control algorithm is executed to obtain a redundant expected duty cycle of the current cycle for comparison in the next cycle.

[0055] In step S50 , when the monitoring result is abnormal, the step of executing subsequent actions according to the fault response logic specifically includes: if the judgment result of step S412 is no, requesting the CPU to execute the fault response.

[0056] The specific fault response logic can be set according to actual needs, such as shutting down or temporarily replacing the output of the main sequencer with the output of the redundant sequencer, etc.

[0057] The above content can also be summarized as follows:

[0058] The step of the redundant sequencer monitoring whether the control link is normal based on the output of the primary sequencer specifically includes: setting the same duty cycle algorithm in the primary sequencer and the redundant sequencer. The redundant sequencer reads back the duty cycle output by the control link and compares it with the duty cycle calculated by itself. If the comparison result is within a reasonable range, the control link is normal; otherwise, the monitoring result is a first abnormality.

[0059] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is the first abnormality, the redundant sequencer requests the CPU to perform independent shutdown.

[0060] Please refer to Figure 4 The step of periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or redundant unit is normal in step S42 includes a CPU side process 101 and an MCS side process 102, specifically including:

[0061] S421: The CPU generates a test request and sends it to the redundant sequencer.

[0062] S422: The CPU reads the test result from the redundant sequencer.

[0063] If the reading is successful, the CPU executes S423 to determine whether the read test result is equal to the expected test result.

[0064] If the reading is not successful after the preset time, the timeout detection in S424 is performed, and S425 determines whether the timeout has occurred.

[0065] If the determination in S425 is no, step S422 is executed again.

[0066] S427 The redundant sequencer reads the test request.

[0067] At S428, the redundant sequencer determines whether a new test request is read.

[0068] If the judgment result of S428 is yes, execute S429 to execute the instruction set test code to obtain the test result.

[0069] After step S429, execute S4210 to read the test result via the ARU.

[0070] S4211 sends the test result to the CPU.

[0071] If the judgment result of S428 is no, or step S4211 is completed, step S427 is executed again.

[0072] In step S50, when the monitoring result is abnormal, the subsequent actions according to the fault response logic are specifically executed: if the judgment result of S425 is yes, or the judgment result of S423 is no, the fault response of step S426 is executed. The specific content of the fault response can be set according to actual needs.

[0073] The above content can also be summarized as follows: the step of periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or redundant unit is normal in S42 specifically includes: setting a test instruction set in the redundant sequencer. The CPU periodically sends the changing test request to the redundant sequencer. After receiving the test request, the redundant sequencer calculates and returns a test result according to the test instruction set. In addition, the CPU obtains the returned test result and determines whether the redundant sequencer or redundant unit is normal or the second abnormality, or, if the CPU does not obtain the returned test result after a preset time period, it determines that the redundant sequencer or redundant unit is the third abnormality.

[0074] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is the second abnormality or the third abnormality, the CPU directly executes the fault response.

[0075] The step of periodically writing the changing test value to the RAM of the master sequencer in S43 to monitor whether common cause failure occurs in all the multi-channel sequencers specifically includes:

[0076] S431 writes the magic value to the RAM of the master sequencer, where the magic value is a set test value. In other embodiments, other test values ​​may also be selected.

[0077] S432 reads back the magic value.

[0078] S433 determines whether the read magic value is consistent with the written magic value.

[0079] If the result of S433 is consistent, step S434 is executed to determine whether the GTM clock is within a reasonable range.

[0080] In step S50, when the monitoring result is abnormal, the steps of executing subsequent actions according to the fault response logic specifically include: if the judgment result of step S433 is no, or the judgment result of step S434 is no, executing step S435 to execute fault response.

[0081] The above steps can also be summarized as follows:

[0082] The step of periodically writing a changing test value to the RAM of the master sequencer to monitor whether a common cause failure has occurred in all of the multi-channel sequencers specifically includes: the CPU periodically writing a changing test value to the RAM of the master sequencer; the CPU reading back the test value; and the CPU determining whether the readback test value is consistent with the written test value. If they are consistent, determining that no common cause failure has occurred or continuing the determination; otherwise, the monitoring result is a fourth abnormality.

[0083] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is the fourth abnormality, the CPU directly executes the fault response.

[0084] The step of periodically writing changing test values ​​to the RAM of the master sequencer to monitor whether common cause failures occur in all the multi-channel sequencers also includes: after the CPU reads back the test value, the CPU performs a clock failure check based on a clock different from the general timer module.

[0085] The step of executing subsequent actions according to the fault response logic when the monitoring result is abnormal specifically includes: if the monitoring result is clock failure, the CPU directly executes the fault response.

[0086] When there are at least two redundant sequencers, the step of monitoring the operating status of the primary and redundant sequencers according to a preset logic in step S40 may further include: at least one of the redundant sequencers monitoring the operating status of the other. For example, there are three redundant sequencers, named A, B, and C. A monitors B, B monitors C, and C monitors A; alternatively, A monitors B and C, B monitors A, and C monitors A, and so on. The specific monitoring method can be the same as the method used by the redundant sequencer to monitor the primary controller, or other monitoring methods can be configured to further enhance security.

[0087] This embodiment also provides a control system comprising a memory, a CPU, and a universal timer module, wherein the universal timer module includes multiple multi-channel sequencers. The CPU is configured to read and execute a program from the memory. The memory and the universal timer module are configured with programs that, when working in conjunction with the CPU and the universal timer module, execute the control method described above.

[0088] This embodiment further provides a readable storage medium, on which a program is stored. When the program is run, the above-mentioned control method is executed.

[0089] Since the above-mentioned control system and readable storage medium can also execute or assist in executing the above-mentioned control method, the problem of lack of monitoring and safety mechanisms in the control system solution of MCS in the prior art can also be solved.

[0090] In summary, this embodiment provides a control method, a control system, and a readable storage medium. The control method includes: configuring a combination unit at the software level, wherein the combination unit includes at least two multi-channel sequencers. One of the multi-channel sequencers in the combination unit is configured as a primary sequencer, and the remaining multi-channel sequencers in the combination unit are configured as redundant sequencers. The operating status of the primary and redundant sequencers is monitored according to a preset logic. Furthermore, when the monitoring result is normal, the controlled object is controlled based on the output signal of the primary sequencer; when the monitoring result is abnormal, subsequent actions are executed according to the fault response logic. This configuration effectively utilizes the underutilized MCS units of the general timer module and increases the operational reliability of each combination unit through redundancy. Monitoring measures are also used to simultaneously monitor the operating status of the primary and redundant sequencers to address the possibility of an abnormality in either. This solution addresses the lack of monitoring and safety mechanisms in existing MCS-based control system solutions and offers higher security than conventionally conceivable safety mechanisms. This embodiment also has the beneficial effect of requiring no modifications to existing hardware and low implementation cost.

[0091] The above description is only a description of the preferred embodiment of the present invention and does not limit the scope of the present invention. Any changes and modifications made by ordinary technicians in the field of the present invention based on the above disclosure are within the scope of protection of the technical solution of the present invention.

Claims

1. A control method, characterized in that: Applied to a universal timer module, the universal timer module includes multiple multi-channel sequencers, and the control method includes: Setting a combination unit at the software level, the combination unit comprising at least two of the multi-channel sequencers; Setting one of the multi-channel sequencers in the combination unit as a main sequencer, and setting the remaining multi-channel sequencers in the combination unit as redundant sequencers; Monitor the working status of the main sequencer and the redundant sequencer according to a preset logic; and When the monitoring result is normal, the controlled object is controlled based on the output signal of the main sequencer; when the monitoring result is abnormal, subsequent actions are executed according to the fault response logic; The step of monitoring the working status of the main sequencer and the redundant sequencer according to the preset logic specifically includes: Periodically writing a changing test value into the RAM of the master sequencer to monitor whether all the multi-channel sequencers have common cause failures; The step of periodically writing a changing test value into the RAM of the master sequencer to monitor whether common cause failures occur in all the multi-channel sequencers specifically includes: The CPU periodically writes the changing test values ​​into the RAM of the master sequencer; The CPU reads back the test value; and The CPU determines whether the read-back test value is consistent with the written test value. If they are consistent, it is determined that no common cause failure has occurred or the determination is continued. Otherwise, the monitoring result is a fourth abnormality. When the monitoring result is abnormal, the steps of executing subsequent actions according to the fault response logic specifically include: If the monitoring result is the fourth abnormality, the CPU directly executes a fault response; The step of periodically writing a changing test value into the RAM of the master sequencer to monitor whether common cause failures occur in all the multi-channel sequencers further includes: After the CPU reads back the test value, the CPU performs a clock failure check based on a clock different from a general timer module; When the monitoring result is abnormal, the steps of executing subsequent actions according to the fault response logic specifically include: If the monitoring result is that the clock fails, the CPU directly executes a fault response.

2. The control method according to claim 1, characterized in that: The control method further includes: Sampling signals required for the main sequencer and the redundant sequencer to work are obtained based on different signal interfaces.

3. The control method according to claim 2, characterized in that: The step of obtaining sampling signals required for the main sequencer and the redundant sequencer to work based on different signal interfaces includes: Acquiring a sampling signal required for the main sequencer to work based on a multi-channel sequencer bus host; and The sampling signal required for the redundant sequencer to work is obtained based on the universal timer module bus interface.

4. The control method according to any one of claims 1 to 3, characterized in that: The step of monitoring the working status of the main sequencer and the redundant sequencer according to the preset logic specifically includes at least one of the following two steps: The redundant sequencer monitors whether a control link is normal based on an output of the main sequencer, the control link starts at a sampling signal input terminal and ends at a control signal output terminal, and the control link includes the main sequencer; Periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or a redundant unit is normal, wherein the redundant unit is a combined structure including the redundant sequencer.

5. The control method according to claim 4, characterized in that: The step of the redundant sequencer monitoring whether the control link is normal based on the output of the main sequencer specifically includes: Setting the same duty cycle algorithm in the main sequencer and the redundant sequencer; The redundant sequencer reads back the duty cycle output by the control link and compares it with the duty cycle calculated by itself; and If the comparison result is within a reasonable range, the control link is normal; otherwise, the monitoring result is the first abnormality; When the monitoring result is abnormal, the steps of executing subsequent actions according to the fault response logic specifically include: If the monitoring result is the first abnormality, the redundant sequencer requests the CPU to perform independent shutdown.

6. The control method according to claim 4, characterized in that: The step of periodically sending a changing test request to the redundant sequencer to monitor whether the redundant sequencer or the redundant unit is normal specifically includes: A test instruction set is set in the redundant sequencer; The CPU periodically sends the changed test request to the redundant sequencer; After receiving the test request, the redundant sequencer calculates and returns the test result according to the test instruction set; and The CPU obtains the returned test result and determines whether the redundant sequencer or redundant unit is normal or has a second abnormality, or, if the CPU does not obtain the returned test result after a preset time, determines that the redundant sequencer or redundant unit has a third abnormality; When the monitoring result is abnormal, the steps of executing subsequent actions according to the fault response logic specifically include: If the monitoring result is the second abnormality or the third abnormality, the CPU directly executes a fault response.

7. A control system, characterized in that: The control system includes a memory, a CPU and a universal timer module, wherein the universal timer module includes a plurality of multi-channel sequencers; the CPU is used to read and execute the program in the memory; Programs are set in the memory and the universal timer module, so that when the CPU and the universal timer module work together, the control method according to any one of claims 1 to 6 is executed.

8. A readable storage medium, characterized in that: The readable storage medium stores a program, and when the program is run, the control method according to any one of claims 1 to 6 is executed.

Images