Method for redundancy control of controller, computing device and storage medium

Abstract

The embodiment of the invention relates to a redundancy switching method for a controller, computing equipment and a storage medium. The method comprises the following steps: monitoring state information of current main equipment in a first main control unit and a second main control unit by a redundancy interaction switching unit so as to generate a redundancy monitoring signal based on the monitored state information; in response to determining that the redundancy monitoring signal indicates to perform redundancy switching, the switch switching unit cuts off the communication connection with the current master device, and the current slave device in the first master control unit and the second master control unit is switched to a new master device; and a new main device in the first main control unit and the second main control unit processes the data received by the controller, executes the logic control function of the controller, and performs data transmission through the base plate high-speed connector. Therefore, the redundancy switching speed of the single board card and the single module can be effectively improved, the space requirement is small, the redundancy control function can be realized by being carried on the single board card and the single module, and the hardware cost is greatly saved.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to the field of industrial control, and more particularly to a method, a computing device, and a storage medium for redundant control of a controller. Background Art

[0002] In the field of industrial control, redundant design is an effective means to meet the requirements of automated continuous control and improve the reliability and availability of control systems. The traditional method of controlling redundant systems mainly adopts equipment redundancy, which is divided into overall system redundancy and important equipment redundancy.

[0003] In the above-mentioned traditional redundant control schemes, for example, when adopting device-level redundancy, whether it is a controller device redundancy scheme or a rack redundancy scheme, the number of devices and costs of the entire system will increase exponentially, and the installation space requirements of the system will also be greatly increased, which is not suitable for control systems with compact space; for example, the redundant information interaction between devices needs to go through multiple connectors, the interaction rate is not high, and the interaction cycle is generally tens of milliseconds, which is not suitable for occasions with high switching disturbance requirements. In some equipment control systems, which have the characteristics of small space, extremely high availability requirements for short-term continuous operation, and fast redundant switching speed, the above-mentioned traditional redundant schemes are difficult to apply.

[0004] In summary, the traditional methods for redundant control have the following disadvantages: large system space requirements, slow switching speed, and high hardware cost. Summary of the invention

[0005] In response to the above problems, the present invention provides a method, a computing device and a storage medium for redundant control of a controller, which can effectively improve the redundant switching speed of a single board or a single module, has a small system space requirement, and can be mounted on a single board or a single module to realize redundant control functions, thereby greatly saving hardware costs.

[0006] According to a first aspect of the present invention, there is provided a method for redundant control of a controller, wherein the controller comprises a first main control unit and a second main control unit communicatively connected to a switch switching unit, a redundant interactive switching unit coupled to the switch switching unit, the first main control unit and the second main control unit, and a backplane high-speed connector connected to the first main control unit and the second main control unit, wherein the method for redundant control of the controller comprises: the redundant interactive switching unit monitors status information of current master devices in the first main control unit and the second main control unit so as to generate a redundant monitoring signal based on the monitored status information; in response to determining that the redundant monitoring signal indicates redundant switching, the switch switching unit cuts off the communication connection with the current master device, and the current slave devices in the first main control unit and the second main control unit are switched to new master devices; and the new master devices in the first main control unit and the second main control unit process data received by the controller, execute logical control functions of the controller, and transmit data through the backplane high-speed connector.

[0007] In some embodiments, the redundant interactive switching unit monitors the status information of the current master device in the first master control unit and the second master control unit so as to generate a redundant monitoring signal based on the monitored status information, including: receiving a first pulse signal from a first general input / output interface of the current master device, and converting the received first pulse signal into a first level signal via a pulse conversion circuit; receiving a second level signal from a second general input / output interface of the current master device; generating a redundant monitoring signal based on the states of the first level signal and the second level signal; and sending redundant monitoring signals to the current slave devices in the switch switching unit, the first master control unit, and the second master control unit, respectively.

[0008] In some embodiments, generating a redundant monitoring signal based on the states of a first level signal and a second level signal includes: receiving the first level signal and the second level signal via a state judgment circuit; in response to determining that the first level signal and the second level signal are both high level signals, the state judgment circuit outputs a low level signal; in response to at least one of the first level signal and the second level signal being a low level signal, the state judgment circuit outputs a high level signal; and the output signal of the state judgment circuit is a high level signal or a low level signal, respectively indicating that the switch switching unit and the slave device perform redundant switching or not perform redundant switching.

[0009] In some embodiments, the status information of the master device includes one or more of the following: normal operation, power supply abnormality, system freeze, partial function abnormality; the method also includes: determining the status of the master device based on the status of the first level signal and the second level signal.

[0010] In some embodiments, based on the state of the first level signal and the second level signal, determining the state of the main device includes one of the following: in response to determining that the first level signal and the second level signal are both high level signals, determining that the main device is working normally; in response to determining that the first level signal is a high level signal and determining that the second level signal is a low level signal, determining that some functions of the main device are abnormal; in response to determining that the first level signal is a low level signal and determining that the power supply detection signal of the main device indicates an abnormality, determining that the power supply of the main device is abnormal; in response to determining that the first level signal is a low level signal and determining that the power supply detection signal of the main device indicates an abnormality, determining that the power supply of the main device is abnormal. In response to determining that the first level signal is a low level signal and determining that the voltage detection signal of the main device indicates normal, determining that the system of the main device is stuck.

[0011] In some embodiments, the method for redundant control of a controller also includes: receiving data from a switch switching unit at the first main control unit and the second main control unit, respectively; receiving data processed by the main device at the slave devices in the first main control unit and the second main control unit; and at the slave device, verifying and storing the received data processed by the main device based on a predetermined verification algorithm and the data received from the switch switching unit.

[0012] In some embodiments, the method for redundant control of a controller also includes: supplying power and performing voltage detection to the first main control unit via a first power supply unit, and supplying power and performing voltage detection to the second main control unit via a second power supply unit; the first power supply unit and the second power supply unit are coupled to the baseboard high-speed connector through different interfaces.

[0013] In some embodiments, the method for redundant control of a controller also includes: after the controller is powered on, detecting the working status of the first main control unit and the second main control unit, and reading fault information in the non-volatile memory of the second main control unit; in response to reading the fault information and the second main control unit working normally, switching the second main control unit to a new master device; and in response to not reading the fault information, the second main control unit working normally and the first main control unit working abnormally, switching the second main control unit to a new master device.

[0014] According to a second aspect of the present invention, there is provided a controller, comprising: a first main control unit and a second main control unit connected to a switch switching unit, and configured to receive data from the switch switching unit respectively; a redundant interactive switching unit coupled to the switch switching unit, the first main control unit and the second main control unit, and configured to monitor status information of current master devices in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information; the switch switching unit is configured to perform redundant switching in response to determining that the redundant monitoring signal indicates a redundant switching, and cut off the communication connection with the current master device; wherein the current slave devices in the first main control unit and the second main control unit are configured to perform redundant switching in response to determining that the redundant monitoring signal indicates a redundant switching, and switch to a new master device, and the new master device is configured to process data received by the controller, execute the logic control function of the controller, and transmit data through the backplane high-speed connector.

[0015] In some embodiments, the first main control unit and the second main control unit respectively include multiple general input and output interfaces, and the redundant interactive switching unit includes a pulse conversion circuit and a state judgment circuit; the state judgment circuit is configured to: receive a first pulse signal from the first general input and output interface of the master device and receive a second level signal from the second general input and output interface of the master device; the pulse conversion circuit is configured to convert the received first pulse signal into a first level signal; the state judgment circuit is also configured to: generate a redundant monitoring signal based on the state of the first level signal and the second level signal; and send redundant monitoring signals to the slave devices in the switch switching unit, the first main control unit, and the second main control unit, respectively.

[0016] In some embodiments, the state judgment circuit includes: an AND logic gate circuit, a Schottky diode, a trigger, a comparator, an operational amplifier, a microprocessor or a programmable logic device; the redundant monitoring signal is used to indicate whether the switch switching unit and the slave device perform redundant switching or not.

[0017] In some embodiments, the controller also includes: a first power supply unit, configured to provide power and perform voltage detection for the first main control unit, and the first power supply unit is coupled to the baseboard high-speed connector; a second power supply unit, configured to provide power and perform voltage detection for the second main control unit, and the second power supply unit is coupled to the baseboard high-speed connector.

[0018] In some embodiments, the switch switching unit includes multiple external communication interfaces, multiple internal communication interfaces, FPGA chips, relays, transistors, conversion switches and mechanical switches. The switch switching unit is configured to communicate with the first main control unit and the second main control unit respectively through different internal communication interfaces for the same input signal.

[0019] In some embodiments, the controller also includes: a redundant communication unit, configured to communicatively connect the first master control unit and the second master control unit so that data processed by the master device is transmitted to the slave device; a master-slave detection unit, configured to detect the working status of the first master control unit and the second master control unit after the controller is powered on, and read the fault information in the non-volatile memory of the second master control unit; and determine whether the second master control unit needs to be switched to a new master device based on the working status of the second master control unit and whether the fault information is read.

[0020] According to a third aspect of the present invention, a computing device is provided, comprising: at least one processing unit; and at least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the device to perform the steps of the method according to the first aspect.

[0021] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method according to the first aspect when executed by a machine.

[0022] According to a fifth aspect of the present invention, there is also provided a computer program product, comprising a computer program, wherein when the computer program is executed by a machine, the method of the first aspect of the present invention is performed.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements.

[0025] Figure 1 A schematic diagram of the internal structure of a controller for implementing an embodiment of the present invention is shown.

[0026] Figure 2 A flow chart of a method for redundant control of a controller according to an embodiment of the present invention is shown.

[0027] Figure 3 A flow chart of a method for generating a redundant monitoring signal according to an embodiment of the present invention is shown.

[0028] Figure 4A flow chart of a method for controller startup detection according to an embodiment of the present invention is shown.

[0029] Figure 5 A schematic diagram of the internal structure of a redundant monitoring module of a controller according to an embodiment of the present invention is shown.

[0030] Figure 6 A schematic diagram of the circuit structure between controller main control devices according to an embodiment of the present invention is shown.

[0031] Figure 7 A block diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0032] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0033] As used herein, the term "including" and its variations mean open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "based at least in part on". The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0034] In the above-mentioned traditional redundant control schemes, for example, when adopting device-level redundancy, whether it is a controller device redundancy scheme or a rack redundancy scheme, the number of devices and costs of the entire system will increase exponentially, and the installation space requirements of the system will also be greatly increased, which is not suitable for control systems with compact space; for example, the redundant information interaction between devices needs to go through multiple connectors, the interaction rate is not high, and the interaction cycle is generally tens of milliseconds, which is not suitable for occasions with high switching disturbance requirements. In some equipment control systems, which have the characteristics of small space, extremely high availability requirements for short-term continuous operation, and fast redundant switching speed, the above-mentioned traditional redundant schemes are difficult to apply.

[0035] In summary, the traditional methods for redundant control have the following disadvantages: large system space requirements, slow switching speed, and high hardware cost.

[0036] In order to at least partially solve one or more of the above problems and other potential problems, an exemplary embodiment of the present invention proposes a scheme for redundant control of a controller and a controller. In the scheme of the present invention, the controller includes: a first main control unit and a second main control unit connected to a switch switching unit, and configured to receive data from the switch switching unit respectively; a redundant interactive switching unit coupled to the switch switching unit, the first main control unit and the second main control unit, configured to monitor the status information of the current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information; the switch switching unit is configured to cut off the communication connection with the current master device in response to determining that the redundant monitoring signal indicates redundant switching; wherein the current slave device in the first main control unit and the second main control unit is configured to switch to a new master device in response to determining that the redundant monitoring signal indicates redundant switching, and the new master device is configured to process the data received by the controller, execute the logic control function of the controller, and transmit data through the backplane high-speed connector.

[0037] Therefore, the above scheme uses two independent main control units and the "master device-slave device" functional state switching between the two main control units, so that during normal operation, both the master device and the slave device can receive data from the outside of the controller from the switch switching unit, ensuring the slave device's heating and data reception; wherein, the master device is responsible for processing the data received by the controller, executing the logic control function of the controller, and transmitting data through the backplane high-speed connector; the slave device only receives data in normal working state, does not execute the logic control function of the controller, does not transmit data through the backplane high-speed connector, does not process the data received from the outside, and only performs data storage and verification; when the redundant interactive switching unit monitors If there is an abnormality in the status of the master device, the redundant monitoring signals sent to the switch switching unit, the first main control unit and the second main control unit respectively instruct the receiving device to perform redundant switching, which can make the switch switching power supply disconnect the communication connection with the current master device, thereby avoiding signal interference from the abnormal device in subsequent communications, and can also make the current slave device switch to the new master device, so as to perform data processing, logic control and external communication functions through the new master device; and because the slave device also continuously receives data during operation, after the current master device is abnormal and switched, the new master device has complete data, and can switch smoothly without affecting the data processing function and external communication of the controller device.

[0038] The above scheme can realize the hot standby function of key components in a single module, realize the characteristics of small control system volume, high availability, and fast redundancy switching speed, can be deployed on a single board, and requires little rack space, and does not need to consider the communication problem with other multiple devices in the system, and can realize the senseless switching of a single board (single module, or key component). Therefore, the present invention can effectively improve the redundancy switching speed of a single board or a single module, has a small system space requirement, and can be mounted on a single board or a single module to realize the redundant control function, greatly saving hardware costs.

[0039] Figure 1 FIG. 1 is a schematic diagram showing a structure of a controller 100 for implementing an embodiment of the present invention. Figure 1 As shown in the figure, the controller 100 includes a switch switching unit 110, a first main control unit 120, a second main control unit 130, a power supply unit 140, a baseboard high-speed connector 150, a redundant interactive switching unit 160, a redundant communication unit 170, a master-slave detection unit 180, an internal communication unit 182 and an external communication interface 111.

[0040] Regarding the switch switching unit 110, a plurality of external communication interfaces (eg, Figure 1 111-1, 111-2 and 111-3 shown in the figure are respectively a CAN external communication interface, an RS422 / 485 external communication interface and an Ethernet external communication interface), multiple internal communication interfaces (for example Figure 1 An external communication interface of the switch unit 110 corresponds to multiple internal communication interfaces, for example, the CAN external communication interface 111-1 corresponds to CANA and CANB, the RS422 / 485 external communication interface corresponds to UARTA and UARTB, and the Ethernet external communication interface corresponds to PHYA and PHYB.

[0041] About CAN (Controller Area Network), Figure 1 CANA and CANB represent two different CAN interfaces A and CAN interface B respectively.

[0042] About UART (Universal Asynchronous Receiver / Transmitter), it is a protocol and hardware interface for asynchronous serial communication; UART is commonly used for data communication between microcontrollers, computers and other digital devices. Figure 1 URATA and UARTB represent two different UART interfaces A and UART interfaces B respectively.

[0043] Regarding PHY (Physical Layer, port physical layer) is the physical layer transceiver, Figure 1 PHYA and PHYB in the figure represent two different PHY interfaces A and PHY interfaces B respectively.

[0044] The switch switching unit 110 is configured to: for the same input signal, communicate with the first main control unit 120 and the second main control unit 130 through different internal communication interfaces; the first main control unit 120 and the second main control unit 130 are respectively connected to the switch switching unit 110, and are respectively configured to receive data from the switch switching unit; for example, the first main control unit 120 receives CAN data, RS422 / 485 data and Ethernet data from the switch switching unit 110 through CANA, UARTA and PHYA; for example, the second main control unit 130 receives CAN data, RS422 / 485 data and Ethernet data from the switch switching unit 110 through CANB, UARTB and PHYB. Therefore, in normal operation, there is no need to consider the master-slave state of the first main control unit 120 and the second main control unit 130, and both can receive data independently through the internal communication interface of the switch switching unit 110 to maintain synchronization, independence and non-interference of received data.

[0045] The switch switching unit 110 also includes an FPGA chip, a relay, a transistor, a transfer switch and / or a mechanical switch. It should be understood that the switch components of the switch switching unit are not limited to the switch types listed above. Through switch devices such as FPGA chips, relays, transistors, transfer switches and / or mechanical switches, the switch switching unit 110 can achieve communication connection or communication disconnection with the first main control unit 120 and the second main control unit 130, for example, the first main control unit 120 can be connected or disconnected with the internal communication interface of CANA, and the second main control unit 130 can be connected or disconnected with the internal communication interface of CANB.

[0046] For example, taking CAN data as an example, two CAN signals, namely CANA and CANB signals, are respectively derived from the first main control unit 120 and the second main control unit 130, and are connected to the switch switching unit 110 at the same time. Under normal working conditions (for example, the first main control unit 120 is the master device by default), the first main control unit 120 works normally, the first main control unit 120 controls the CAN enable switch device to connect to the CANA signal, and the second main control unit 130 controls the CAN enable switch to connect to the CANB signal. When the first main control unit 120 fails, the second main control unit 130 takes over the CAN enable switch, and the second main control unit 130 becomes the working master (i.e., the master device). At the same time, the switch switching unit 110 no longer receives the control signal of the first main control unit 120 to prevent the first main control unit 120 from interfering with the CAN enable controller when it fails. After the second main control unit 130 controls the switch switching unit 110, it switches from a slave device to a master device, processes the data received through CANB, and realizes CAN data redundancy communication through the CAN transceiver. Other communication protocols can achieve similar data receiving, processing and switching functions by setting two signals, which will not be described here.

[0047] Regarding the redundant interactive switching unit 160, coupled to the switch switching unit 110, the first main control unit 120 and the second main control unit 130, the redundant interactive switching unit 160 is configured to monitor the status information of the current main device in the first main control unit 120 and the second main control unit 130 so as to generate a redundant monitoring signal based on the monitored status information.

[0048] Regarding the new master device in the first master control unit and the second master control unit, it is, for example, configured to receive data from the switch switching unit 110, process data received by the controller, execute the logic control function of the controller, and transmit data through the backplane high-speed connector; before the slave device becomes the new master device, it does not execute the aforementioned data processing function, but only receives data, such as receiving data from outside the system from the switch switching unit 110, such as receiving data processed by the master device from the master device.

[0049] Regarding the new slave device in the first master control unit and the second master control unit, it is, for example, configured to receive data from the switch switching unit 110, and in response to determining that the redundant monitoring signal indicates redundant switching, switch to a new master device; the slave device switches to the new master device, and executes the functions that the master device needs to execute (including processing data received by the controller, executing the logic control functions of the controller, and transmitting data through the backplane high-speed connector).

[0050] The switch switching unit 110 is also configured to perform redundant switching in response to determining that the redundant monitoring signal indicates that the communication connection with the current master device is cut off; thereby, interference signals from abnormal master devices can be avoided, ensuring that the controller 100 can continue to communicate, process data, and execute the functions of the controller 100 normally based on the new master device.

[0051] The power supply unit 140 includes a first power supply unit 142 and a second power supply unit 144. The two power supply groups independently supply power to the main control units connected to them. For example, two independent 24V power supplies are provided through the baseboard high-speed connector 150 to supply power to the entire controller 100. Two independent 24V power supply trees supply power to the first main control unit 120 and the second main control unit 130 respectively. At the same time, the two independent power supply trees are respectively subjected to power supply topology and converted into the power rails required by each unit module.

[0052] In some embodiments, two sets of power rails are generated between the first power supply unit 142 and the first main control unit 120; and two sets of power rails are generated between the second power supply unit 144 and the second main control unit 130. Thus, when one set of power rails is abnormal, power can be supplied through the other set of power rails, so that the power supply of the controller 100 is more stable.

[0053] In some embodiments, the first power supply unit 142 performs power supply detection and / or voltage fault detection on the first main control unit 120, and the second power supply unit 144 performs power supply detection and / or voltage fault detection on the second main control unit 130. For example, when the first power supply unit 142 detects that the power rail of the first main control unit 120 fails, a fault feedback signal is generated and sent to the switch switching unit 110, the second main control unit 130, and the redundant interactive switching unit 160; so that the switch switching unit 110 and the second main control unit 130 perform redundant switching, for example, switching from the first main control unit 120 as the main device to the second main control unit 130 as the main device, and then performing IO (In / Out, input and output) data communication and data processing through the new main device (the second main control unit 130), while keeping the switched first main control unit 120 in a silent state (in this state, the main control unit does not send data to other devices).

[0054] In some embodiments, the first power supply unit 142 is configured to provide power and perform voltage detection for the first main control unit 120, and the first power supply unit 142 is coupled to the baseboard high-speed connector 150; the second power supply unit 144 is configured to provide power and perform voltage detection for the second main control unit 130, and the second power supply unit 144 is coupled to the baseboard high-speed connector 150.

[0055] Therefore, through two independent power trees that do not affect each other, when a power supply system failure occurs in the main device, the slave device can automatically switch to the master device to automatically take over the work without affecting the system function of the entire controller 100, thereby ensuring long-term stable and reliable operation of the equipment.

[0056] In some embodiments, the first main control unit 120 and the second main control unit 130 respectively include multiple general-purpose input / output interfaces GPIO (General-purpose input / output), and the redundant interactive switching unit 160 includes a pulse conversion circuit 162 and a state judgment circuit 164, and the state judgment circuit 164 is configured to: receive a first pulse signal from the first general-purpose input / output interface of the master device and receive a second level signal from the second general-purpose input / output interface of the master device; the pulse conversion circuit 162 is configured to convert the received first pulse signal into a first level signal; the state judgment circuit 164 is also configured to: generate a redundant monitoring signal based on the states of the first level signal and the second level signal; and send redundant monitoring signals to the slave devices in the switch switching unit 110, the first main control unit 120 and the second main control unit 130 respectively.

[0057] For example, see Figure 5 , illustrates the GPIO receiving and sending situation with the first main control unit 120 as the master device and the second main control unit 130 as the slave device. For example, the GPIO-11 interface of the first main control unit 120 outputs a pulse signal to the pulse conversion circuit 162, and the pulse conversion circuit 162 converts the pulse signal to generate a converted level signal and then sends it to the state judgment circuit 164. The GPIO-12 interface of the first main control unit 120 outputs a level signal to the state judgment circuit 164. The state judgment circuit 164 judges the state of the master device (such as the first main control unit 120) based on the level signal converted by the pulse conversion circuit 162 and the level signal directly output by GPIO-12, so as to generate a redundant monitoring signal and send the redundant monitoring signal to the switch switching unit 110 and the current slave device (such as the second main control unit 130).

[0058] Thus, the redundant interactive switching unit can judge the working state of the main device by combining the GPIO level signal and the pulse signal to solve the problems of slow redundant switching speed, main control system stuck and partial abnormality of the main control communication system. For example, the traditional fault detection mode uses a reset circuit to detect system faults. From detecting that the main control unit system is stuck, triggering the reset detection circuit to giving a reset signal, it takes a long detection time, and it cannot guarantee active redundant switching when the main control unit works abnormally. The solution provided by the present invention can effectively solve such problems.

[0059] In some embodiments, the state judgment circuit 164 includes: an AND logic gate circuit, a Schottky diode, a trigger, a comparator, an operational amplifier, a microprocessor or a programmable logic device. In some embodiments, the redundancy monitoring signal is used to indicate whether the switch switching unit 110 and the slave device perform redundant switching or not.

[0060] The first main control unit 120 and the second main control unit 130 may each have one or more processing units, including dedicated processing units such as GPU, FPGA and ASIC, and general processing units such as CPU. In addition, one or more virtual machines may also be running on each main control unit.

[0061] In some embodiments, the controller 100 further includes a redundant communication unit 170 and a master-slave detection unit 180. The redundant communication unit 170 is configured to communicate with the first main control unit 120 and the second main control unit 130 so that data processed by the master device is transmitted to the slave device; the master-slave detection unit 180 is configured to detect the working status of the first main control unit 120 and the second main control unit 130 after the controller is powered on, and read the fault information in the non-volatile memory of the second main control unit 130; and determine whether the second main control unit 130 needs to be switched to a new master device based on the working status of the second main control unit 130 and whether the fault information is read. It should be understood that the default working state of the controller 100 in the above example is to use the first main control unit 120 as the master device and the second main control unit 130 as the slave device. If the default setting is changed, the master-slave detection unit 180 reads the fault information in the non-volatile memory of the first main control unit 120 and makes a corresponding judgment.

[0062] In some embodiments, the PCIE bus is preferably used for data redundancy communication between the main control units. The PCIE bus has the advantages of high transmission rate, good real-time performance, strong anti-interference ability, etc., and can facilitate rapid data backup and redundant switching. Therefore, it can meet the requirements of quickly backing up a large amount of data from the first main control unit 120 to the second main control unit 130 in a short time, and has good real-time performance. For example, when the redundant communication unit 170 uses PCIE for communication, the first main control unit 120 and the second main control unit 130 communicate through the PCIE bus. The first main control unit 120 and the second main control unit 130 are in RC mode (master mode, responsible for data transmission and processing), and the second main control unit 130 is in EP mode (endpoint mode, responsible for data reception). The first main control unit 120 is a master device, and the second main control unit 130 is a slave device. The data in the first main control unit is regularly transmitted to the second main control unit, and the data in the first main control unit 120 and the second main control unit 130 are regularly checked to prevent data packet loss and other phenomena. Among them, RC (Root Complex) mode and EP (Endpoint) mode are two different working modes in PCIE (Peripheral Component Interconnect Express) devices; regarding RC mode, the device is used to connect the CPU / memory subsystem and I / O devices. In RC mode, the type value in the PCIe configuration header is 1; in EP mode, the type value in the PCIE configuration header is 0.

[0063] Figure 2 FIG. 2 is a flow chart of a method 200 for redundant control of a controller according to an embodiment of the present invention. The method 200 may be performed as follows: Figure 1 The controller 100 shown in FIG. Figure 7 The method 200 is executed at the electronic device 700. It should be understood that the method 200 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0064] In step 202, the redundant interactive switching unit monitors the status information of the current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information.

[0065] The status information of the main device includes one or more of the following: normal operation, power supply abnormality, system freeze, and partial function abnormality.

[0066] In some embodiments, the redundant interactive switching unit monitors the status information of the current master device in the first master control unit and the second master control unit so as to generate a redundant monitoring signal based on the monitored status information, including: receiving a first pulse signal from a first general input / output interface of the current master device, and converting the received first pulse signal into a first level signal via a pulse conversion circuit; receiving a second level signal from a second general input / output interface of the current master device; generating a redundant monitoring signal based on the states of the first level signal and the second level signal; and sending redundant monitoring signals to the current slave devices in the switch switching unit, the first master control unit, and the second master control unit, respectively.

[0067] Please refer to Figure 5 The redundant interactive switching unit 160 monitors the current master device (eg, Figure 5 The state information of the master device in which the master device is the first master control unit 120, so as to generate a redundant monitoring signal based on the monitored state information includes: receiving a first pulse signal from a first general input and output interface (GPIO-11) of the current master device (the first master control unit 120), and converting the received first pulse signal into a first level signal via a pulse conversion circuit 162; receiving a second level signal from a second general input and output interface (GPIO-12) of the current master device (the first master control unit 120); generating a redundant monitoring signal based on the states of the first level signal and the second level signal; and respectively sending a redundant monitoring signal to the current slave device ( Figure 5 For example, the slave device is the second main control unit 130) sending a redundant monitoring signal.

[0068] In some embodiments, the redundancy monitoring signal is used to instruct the switch unit 110 and the slave device to perform redundant switching or not to perform redundant switching.

[0069] In some embodiments, the redundant interactive switching unit, the slave device and / or the master device determines the state of the master device based on the states of the first level signal and the second level signal.

[0070] Thus, multiple devices in each device controller 100 can determine whether the current operating state of the master device is normal according to the pulse signal and level signal output by the GPIO interface of the master device, and determine whether the redundancy monitoring signal indicates redundancy switching.

[0071] The following will combine Figure 3 The method of generating redundant monitoring signals is described in detail and will not be repeated here.

[0072] In step 204, if it is determined that the redundancy monitoring signal indicates redundancy switching, the switch unit cuts off the communication connection with the current master device, and the current slave device in the first master control unit and the second master control unit is switched to a new master device.

[0073] For example, the current master device is the first main control unit 120, and the slave device is the second main control unit 130. The state judgment circuit 164 determines that the master device is in a certain abnormal state according to the first level signal and the second level signal, and generates a redundant monitoring signal (for example, the redundant monitoring signal is also expressed in the form of a level signal, 1 indicates redundant switching, and 0 indicates no redundant switching). At this time, the master device is in an abnormal state, and the redundant monitoring signal is 1; the switch switching unit 110 determines to perform redundant switching based on the received redundant monitoring signal being 1, and cuts off the communication connection with the first main control unit 120 to avoid the abnormal first main control unit 120 from sending interference data and affecting the normal operation of the controller 100; the second main control unit 130 switches to a new master device to execute various data processing, logic control and external communication functions of the controller 100.

[0074] In step 206, the new master device in the first master control unit and the second master control unit processes the data received by the controller, executes the logic control function of the controller, and transmits data through the backplane high-speed connector.

[0075] In some embodiments, at the first main control unit and the second main control unit, data are received from the switch switching unit respectively; at the slave devices in the first main control unit and the second main control unit, data processed by the master device is received via the redundant communication unit 170; and at the slave device, based on a predetermined verification algorithm and the data received from the switch switching unit, the received data processed by the master device is verified and stored.

[0076] The redundant communication unit 170 has been specifically introduced above and will not be described here. In the above scheme, the controller 100 has an internal communication unit, and the controller 100 and the IO (In / Out, input and output, i.e., the switch switching unit 110) module need to exchange data and communicate through an internal communication bus. In the present invention, the two main control units are used as two main nodes for internal communication. Under normal working conditions, the first main control unit and the second main control unit communicate with the IO module (i.e., the switch switching unit 110) through the internal bus at the same time. When the first main control unit (for example, as a master device) works normally, the first main control unit communicates data with the IO module; the second main control unit (at this time, a slave device) does not issue communication instructions and is only used to receive data; when the communication between the first main control unit and the IO module is abnormal, the first main control unit sends fault diagnosis information to the second main control unit for subsequent fault analysis and processing, and at the same time, the switch switching unit performs redundant switching and switches the master device to the second main control unit, so that the second main control unit (as the master device) communicates and processes data with the IO module, while keeping the first main control unit in a silent state to prevent interference with other units of the controller 100.

[0077] In the above scheme, the controller redundancy method provided by the present invention realizes the hot standby redundancy function of key components in a single module, has the characteristics of stable and fast redundant switching, does not need to multiply the same controller modules, and the control system is small in size and high in availability; and through the dual judgment of GPIO level signal and GPIO pulse signal, it realizes fast and accurate detection of various abnormal states of the main device, and has the characteristics of fast switching speed and strong anti-interference ability; in this judgment mode, the main control unit only needs to perform level signal detection and switching through interruption, and the main control unit does not need to collect detection pulse signals in real time, thereby saving system resources and improving system operation efficiency.

[0078] In addition, in the above scheme, the redundant interactive switching unit includes a pulse conversion circuit, which adjusts the GPIO pulse signal sent by the main device into a high and low level signal through the pulse conversion circuit, thereby reducing the system resource occupation, improving the system operation efficiency, and having strong stability and reliability; and the PCIE bus is used for data redundant communication between the main control units inside the controller 100, which has good real-time performance, can quickly interact with data, meet the requirements of fast redundant switching, and have strong anti-interference ability and stability.

[0079] Figure 3 FIG. 3 is a flow chart of a method 300 for generating a redundant monitoring signal according to an embodiment of the present invention. The method 300 may be performed as follows: Figure 1 The controller 100 shown in FIG. Figure 7The method 300 is executed at the electronic device 700 shown. It should be understood that the method 300 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0080] In step 302, a first level signal and a second level signal are received via a state determination circuit.

[0081] In step 304 , in response to determining that the first level signal and the second level signal are both high level signals, the state determination circuit outputs a low level signal.

[0082] In step 306 , in response to at least one of the first level signal and the second level signal being a low level signal, the state determination circuit outputs a high level signal.

[0083] In step 308, the output signal of the state judgment circuit is a high level signal or a low level signal, which instructs the switch unit and the slave device to perform redundant switching or not to perform redundant switching respectively.

[0084] In some embodiments, the redundant interactive switching unit, the slave device and / or the master device determines the state of the master device based on the states of the first level signal and the second level signal.

[0085] In some embodiments, determining the status of the main device includes one of the following: if it is determined that the first level signal and the second level signal are both high level signals, it is determined that the main device is operating normally; if it is determined that the first level signal is a high level signal and the second level signal is a low level signal, it is determined that some functions of the main device are abnormal; if it is determined that the first level signal is a low level signal and the power supply detection signal of the main device indicates an abnormality, it is determined that the power supply of the main device is abnormal; if it is determined that the first level signal is a low level signal and the voltage detection signal of the main device indicates normal, it is determined that the system of the main device is stuck.

[0086] For example, the master device (taking the first master control unit 120 as an example) operates normally, sends a pulse signal through GPIO-11, and after being conditioned into a high-level signal by the pulse conversion circuit 162, outputs it to the state judgment circuit 164 (for example, including an AND gate logic circuit), and at the same time sends a high-level signal to the state judgment circuit 164 through GPIO-12. After the two GPIO signals are logically judged by the state judgment circuit 164, the output redundant monitoring signal is a high-level signal; at the same time, a redundant monitoring signal is sent to the second master control unit 130 and the switch switching unit 110. When a high-level signal is detected, neither the second master control unit 130 nor the switch switching unit 110 performs redundant switching. At this time, the first master control unit 120 is maintained in the working mode of the master device and the second master control unit 130 is maintained in the working mode of the slave. At the same time, the switch switching unit 110 switches to data communication with the first master control unit 120 and only sends data to the second master control unit 130.

[0087] Continuing with the above example, when the power supply system of the first main control unit 120 is abnormal or the system is stuck, the first main control unit 120 has no pulse signal to send, and the pulse conversion circuit adjusts it into a low-level signal and outputs it to the state judgment circuit 164. At the same time, a high-level signal is sent to the state judgment circuit 164 through GPIO-12, and the redundant monitoring signal output by the state judgment circuit 164 is a low-level signal; at the same time, a redundant monitoring signal is sent to the second main control unit 130 and the switch switching unit 110 to instruct the two to perform redundant switching, switching to a working mode in which the second main control unit 130 is the master device and the first main control unit 120 is the slave device, and at the same time, the switch switching unit 110 switches to data communication with the second main control unit 130 and does not receive data transmitted to it by the first main control unit 120.

[0088] Continuing with the above example, when some functions of the first main control unit 120 are abnormal, the first main control unit 120 can send pulse signals normally, but the GPIO-12 interface of the first main control unit 120 outputs a low-level signal, indicating that some functions of the first main control unit 120 are abnormal. When the state judgment circuit 164 receives the above two level signals, the output redundant monitoring signal is a low-level signal, and a redundant monitoring signal is sent to the second main control unit 130 and the switch switching unit 110 at the same time, so as to instruct the two to perform redundant switching, switching to a working mode in which the second main control unit 130 is the master device and the first main control unit 120 is the slave device. At the same time, the switch switching unit 110 switches to data communication with the second main control unit 130 and does not receive data transmitted to it by the first main control unit 120.

[0089] In the above example, by using pulse detection, it is possible to more quickly detect whether the system of the main device (such as the first main control unit 120) is stuck or the power supply is abnormal, and perform rapid redundant switching to ensure the continuity and reliability of data processing. At the same time, the GPIO interface of the main device is used to output high and low level signals to quickly detect abnormal functions of some main control units.

[0090] The various failure modes of the master device include: (1) The power supply of the master device is abnormal or the system is stuck. No pulse is sent from the first general input / output interface of the master device. The pulse conversion circuit outputs a low level. The redundant monitoring signal indicates that redundant switching is to be performed. The master device performs a relinquishment operation and the slave device switches to the new master device to take over the work and process data. (2) The master device system works normally, but some functions are abnormal. The master device sends a low-level signal through the second general input and output interface. The redundant monitoring signal is used as an instruction to perform redundant switching. The master device performs a relinquishment operation, and the slave device switches to the new master device to take over the work and process data.

[0091] For example, when the state judgment circuit 164 includes an AND logic gate circuit, the truth table of the redundant monitoring signal output by the redundant interactive switching unit 160 is shown in the following table: Table 1

[0092] The GPIO level signal is logic 1 for high output, and logic 0 for low output; the pulse signal is logic 1 for pulse, and logic 0 for no pulse signal; the redundant switching signal is logic 1 for redundant switching, and logic 0 for the main device working normally without redundant switching.

[0093] Therefore, the main control unit and the switch switching unit perform fault detection and judgment by interruption, which can save a lot of system resources and eliminate the need for real-time high-frequency detection, making the controller system more efficient and improving the stability and reliability of the controller system operation. It is also suitable for use in situations where the installation space is compact and the redundant switching speed requirements are high. Compared with traditional reset circuit detection, it has greatly improved stability and redundant switching speed.

[0094] In some embodiments, the first main control unit is powered and voltage detected via a first power supply unit, and the second main control unit is powered and voltage detected via a second power supply unit; the first power supply unit and the second power supply unit are coupled to the baseboard high-speed connector through different interfaces.

[0095] Therefore, through two independent power trees that do not affect each other, when a power supply system failure occurs in the main device, the slave device can automatically switch to the master device to automatically take over the work without affecting the function of the entire controller system, ensuring long-term stable and reliable operation of the equipment.

[0096] Figure 4 FIG. 4 is a flow chart of a method 400 for controller startup detection according to an embodiment of the present invention. The method 400 may be performed as follows: Figure 1 The controller 100 shown in FIG. Figure 7 The method 400 is executed at the electronic device 700. It should be understood that the method 400 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0097] In step 402, after the controller is powered on, the working states of the first main control unit and the second main control unit are detected, and fault information in the non-volatile memory of the second main control unit is read.

[0098] For example, see Figure 6Taking the first main control unit 120 as the master device by default as an example, after the controller is powered on, the master-slave detection unit 180 detects the working status of the first main control unit 120 and the second main control unit 130, and reads the non-volatile memory of the second main control unit 130 (for example Figure 6 The fault information in the memory 166) in the memory.

[0099] In step 404, if the fault information is read and the second main control unit works normally, the second main control unit is switched to a new master device.

[0100] For example, continuing with the above example, if fault information is read, it means that the first main control unit 120 has previously failed, and the default master device of the controller 100 (such as the first main control unit 120) has been switched, so the default slave device (such as the second main control unit 130) is used as the new main control unit for data processing.

[0101] In step 406, if no fault information is read, the second main control unit works normally and the first main control unit works abnormally, the second main control unit is switched to a new master device.

[0102] For example, continuing with the above example, if no fault information is read, the default master device of the controller 100 (such as the first master control unit 120) cannot work normally, while the default slave device (such as the second master control unit 130) can work normally, and the default slave device (such as the second master control unit 130) is also used as the new master control unit for data processing.

[0103] Taking the default master device (first master control unit 120) and the default slave device (second master control unit 130) as examples, the master-slave detection unit 180 includes two GPIO signals, namely GPIO1 and GPIO2 signals, wherein GPIO1 is a pulse signal sent by the second master control unit 130 (through the GPIO-23 interface) to the first master control unit 120, and is used to detect whether the second master control unit 130 is working normally. The presence of a pulse signal represents that the second master control unit 130 is working normally, and the absence of a pulse signal represents that the second master control unit 130 is working abnormally; the GPIO2 signal is a strong master signal sent by the second master control unit 130 to the first master control unit 120. When GPIO-24 outputs a high-level signal, redundant switching is not performed, and the controller 100 is in the first master control unit. 120 is the master and the second main control unit 130 is the slave working mode; when GPIO-24 outputs a low-level signal, it represents that the second main control unit 130 sends a strong master signal. At this time, after the first main control unit 120 receives the strong master signal, it only retains the redundant interactive switching function, and other functions remain silent so as not to send interference signals, thereby not affecting the normal operation of other units. At the same time, the first main control unit 120 will stop sending pulse signals to other devices; the redundant interactive switching unit 160 sends a redundant monitoring signal to the second main control unit 130 and the switch switching unit 110 to instruct the two to perform synchronous redundant switching, switching to the second main control unit 130 as the new master device, and at the same time, the second main control unit 130 writes the switching information to the memory 166 for fault information storage.

[0104] Continuing with the above example, regarding the storage of fault information, it includes: after the controller 100 is powered on, when the first main control unit 120 and the second main control unit 130 are both operating normally, the second main control unit 130 reads the data stored in the memory 166. When there is no data stored, the second main control unit 130 sends a pulse signal normally, and GPIO-24 sends a high-level signal at the same time. The controller system does not perform redundant switching, and operates with the first main control unit 120 as the master device and the second main control unit 130 as the slave device.

[0105] Continuing with the above example, after power-on is completed, when the first main control unit 120 and the second main control unit 130 are operating normally, the second main control unit 130 reads the data stored in the memory 166. When it is read that the first main control unit 120 has failed and switched to the master device (switched to the second main control unit 130), it means that the first main control unit 120 is unstable. Then, the second main control unit 130 sends a strong master signal through GPIO-24, so that the first main control unit 120 no longer sends a pulse signal, and sends a redundant monitoring signal through the redundant interactive switching unit 160, so that the controller 100 switches to work with the second main control unit 130 as the master device and the first main control unit 120 as the slave device.

[0106] Continuing with the above example, after power-on is completed, the first main control unit 120 works normally, and the second main control unit 130 has power supply abnormality or the system is stuck, the second main control unit 130 will not send a pulse signal to the first main control unit 120. At the same time, the first main control unit 120 no longer receives a strong main signal, and the controller 100 performs redundant switching, keeping the first main control unit 120 as the master device and the second main control unit 130 as the slave device.

[0107] Therefore, during the operation of the controller 100, as long as there is a record of a failure of the default master device (such as the first main control unit 120), redundant switching is required regardless of whether the default master device (such as the first main control unit 120) has resumed normal operation. The default slave device (such as the second main control unit 130) is switched to the new master device working mode. Only when the fault is repaired will the entire controller system be initialized, and after initialization, it will continue to work in the default master-slave device mode. This solution can greatly improve the stability and reliability of the controller module.

[0108] In summary, the redundant interactive switching unit adopts the pulse signal + MRAM (non-volatile memory) flag signal detection method. In the case of power-on and restart, it can quickly detect the healthy main control unit, record the previous faulty main control unit, always keep the healthy main control unit working as the main unit, and keep the faulty main control unit silent, effectively avoiding the phenomenon that the faulty main control unit competes with the healthy main control unit for the main controller authority after recovering to normal after power-on and restart, thereby improving the stability and reliability of system operation.

[0109] Figure 7 Schematic diagram of an example electronic device 700 that can be used to implement an embodiment of the present specification is shown. Figure 1 The controller 100 shown can be implemented by an electronic device 700. As shown, the electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 702 or computer program instructions loaded from a storage unit 708 to a random access memory (RAM) 703. In the random access memory 703, various programs and data required for the operation of the electronic device 700 can also be stored. The central processing unit 701, the read-only memory 702, and the random access memory 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0110] Multiple components in the electronic device 700 are connected to the input / output interface 705, including: an input unit 706, such as a keyboard, a mouse, a microphone, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0111] The various processes and processing described above, such as methods 200 to 400, may be performed by the central processing unit 701. For example, in some embodiments, methods 200 to 400 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the read-only memory 702 and / or the communication unit 709. When the computer program is loaded into the random access memory 703 and executed by the central processing unit 701, one or more actions of the methods 200 to 400 described above may be performed.

[0112] The present invention relates to methods, apparatuses, systems, electronic devices, computer-readable storage media and / or computer program products. The computer program products may include computer-readable program instructions for executing various aspects of the present invention.

[0113] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the above. The computer-readable storage medium used herein is not to be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0114] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge computing devices. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing / processing device.

[0115] The computer program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect through the Internet). In some embodiments, the electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be executed by using the state information of the computer-readable program instructions to personalize and customize the electronic circuit, thereby implementing various aspects of the present invention.

[0116] Various aspects of the present invention are described herein with reference to flow charts and / or step diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each of the steps in the flow charts and / or step diagrams and the combination of the steps in the flow charts and / or step diagrams can be implemented by computer-readable program instructions.

[0117] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more steps in the flowchart and / or step diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more steps in the flowchart and / or step diagram.

[0118] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more steps in the flowchart and / or step diagram.

[0119] The flowchart and step diagram in the accompanying drawings show the possible architecture, functions and operations of the system, method and computer program product according to multiple embodiments of the present invention. In this regard, each square step in the flowchart or step diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the square steps can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive square steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square step in the step diagram and / or the flowchart, and the combination of the square steps in the step diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0120] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for redundant control of a controller, characterized in that: The controller includes a first main control unit and a second main control unit communicatively connected to the switch switching unit, a redundant interactive switching unit coupled to the switch switching unit, the first main control unit and the second main control unit, and a backplane high-speed connector connected to the first main control unit and the second main control unit. The method includes: The redundant interactive switching unit monitors the status information of the current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information; In response to determining that the redundancy monitoring signal indicates redundancy switching, the switch switching unit cuts off the communication connection with the current master device, and the current slave device in the first master control unit and the second master control unit is switched to a new master device; and The new master device in the first main control unit and the second main control unit processes the data received by the controller, executes the logic control function of the controller, and transmits data through the backplane high-speed connector.

2. The method according to claim 1, characterized in that Monitoring the status information of the current master device in the first main control unit and the second main control unit by the redundant interactive switching unit so as to generate a redundant monitoring signal based on the monitored status information includes: receiving a first pulse signal from a first universal input / output interface of a current master device, and converting the received first pulse signal into a first level signal via a pulse conversion circuit; receiving a second level signal from a second universal input / output interface of the current master device; generating a redundant monitoring signal based on states of the first level signal and the second level signal; and A redundant monitoring signal is sent to the current slave device in the switch switching unit, the first main control unit and the second main control unit respectively.

3. The method according to claim 2, characterized in that Based on the states of the first level signal and the second level signal, generating a redundant monitoring signal comprises: Receiving a first level signal and a second level signal via a state determination circuit; In response to determining that both the first level signal and the second level signal are high level signals, the state determination circuit outputs a low level signal; In response to at least one of the first level signal and the second level signal being a low level signal, the state determination circuit outputs a high level signal; and The output signal of the state judgment circuit is a high level signal or a low level signal, which respectively instructs the switch switching unit and the slave device to perform redundant switching or not to perform redundant switching.

4. The method according to claim 3, characterized in that The status information of the master device includes one or more of the following: normal operation, power supply abnormality, system freeze, partial function abnormality; The method further includes determining a state of a master device based on states of the first level signal and the second level signal.

5. The method according to claim 4, characterized in that Determining the state of the master device based on the states of the first level signal and the second level signal includes one of the following: In response to determining that the first level signal and the second level signal are both high level signals, determining that the master device operates normally; In response to determining that the first level signal is a high level signal and determining that the second level signal is a low level signal, determining that part of the main device functions abnormally; In response to determining that the first level signal is a low level signal and determining that the power detection signal of the master device indicates an abnormality, determining that the power supply of the master device is abnormal; In response to determining that the first level signal is a low level signal and determining that the voltage detection signal of the master device indicates normal, it is determined that the master device system is stuck.

6. The method according to claim 1, characterized in that Also includes: At the first main control unit and the second main control unit, respectively receiving data from the switch switching unit; At the slave devices in the first main control unit and the second main control unit, receiving the data processed by the master device; as well as At the slave device, based on a predetermined verification algorithm and data received from the switch unit, the received data processed by the master device is verified and stored.

7. The method according to claim 5, characterized in that Also includes: The first main control unit is powered and voltage detected via a first power supply unit, and the second main control unit is powered and voltage detected via a second power supply unit; the first power supply unit and the second power supply unit are coupled to the baseboard high-speed connector via different interfaces.

8. The method according to claim 5, characterized in that Also includes: After the controller is powered on, the working states of the first main control unit and the second main control unit are detected, and the fault information in the non-volatile memory of the second main control unit is read; In response to reading the fault information and the second main control unit working normally, switching the second main control unit to a new main device; as well as In response to the failure information not being read, the second main control unit working normally and the first main control unit working abnormally, the second main control unit is switched to be a new master device.

9. A controller for redundant control, characterized in that: include: The first main control unit and the second main control unit connected to the switch switching unit are respectively configured to receive data from the switch switching unit respectively; A redundant interactive switching unit coupled to the switch switching unit, the first main control unit and the second main control unit, configured to monitor the status information of the current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information; a switch switching unit, configured to cut off the communication connection with the current master device in response to determining that the redundancy monitoring signal indicates redundancy switching; Among them, the current slave devices in the first master control unit and the second master control unit are configured to switch to a new master device in response to determining that the redundant monitoring signal indicates redundant switching; the new master device is configured to process data received by the controller, execute the logical control function of the controller, and transmit data through the baseboard high-speed connector.

10. The controller according to claim 9, characterized in that: The first main control unit and the second main control unit respectively include a plurality of general input and output interfaces, and the redundant interactive switching unit includes a pulse conversion circuit and a state judgment circuit; The state judgment circuit is configured to: receive a first pulse signal from a first universal input / output interface of the master device, and receive a second level signal from a second universal input / output interface of the master device; The pulse conversion circuit is configured to convert the received first pulse signal into a first level signal; The state judgment circuit is further configured to: generate a redundant monitoring signal based on the states of the first level signal and the second level signal; and send the redundant monitoring signal to slave devices in the switch switching unit, the first main control unit and the second main control unit respectively.

11. The controller according to claim 10, characterized in that: The state judgment circuit includes: an AND logic gate circuit, a Schottky diode, a trigger, a comparator, an operational amplifier, a microprocessor or a programmable logic device; The redundancy monitoring signal is used to instruct the switch unit and the slave device to perform redundant switching or not to perform redundant switching.

12. The controller according to claim 9, characterized in that: Also includes: A first power supply unit is configured to supply power and perform voltage detection for the first main control unit, the first power supply unit being coupled to the baseboard high-speed connector; The second power supply unit is configured to supply power and perform voltage detection for the second main control unit, and the second power supply unit is coupled to the baseboard high-speed connector.

13. The controller according to claim 9, characterized in that: The switch switching unit includes multiple external communication interfaces, multiple internal communication interfaces, and also includes an FPGA chip, a relay, a transistor, a conversion switch and / or a mechanical switch. The switch switching unit is configured to: for the same input signal, communicate with the first main control unit and the second main control unit respectively through different internal communication interfaces.

14. The controller according to claim 9, characterized in that: Also includes: A redundant communication unit, configured to communicatively connect the first main control unit and the second main control unit so that data processed by the master device is transmitted to the slave device; A master-slave detection unit, configured to detect the working status of the first master control unit and the second master control unit after the controller is powered on, and read the fault information in the non-volatile memory of the second master control unit; And based on the working state of the second main control unit and whether the fault information is read, it is determined whether the second main control unit needs to be switched to a new main device.

15. A computing device, characterized in that: include: at least one processing unit; At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the device to perform the steps of the method according to any one of claims 1 to 8.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a machine, the method according to any one of claims 1 to 8 is implemented.

17. A computer program product comprising a computer program, characterized in that When the computer program is executed by a machine, the method according to any one of claims 1 to 8 is performed.

Images