Method, computing device, and storage medium for redundant control of a controller

Abstract

Embodiments of the present invention relate to a method, computing device, and storage medium for redundant switching of a controller. The method includes: a redundant interactive switching unit monitoring the status information of the current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information; in response to determining that the redundant monitoring signal indicates redundant switching, the switching unit cuts off the communication connection with the current master device, and the current slave device in the first main control unit and the second main control unit switches to the new master device; and the new master device in the first main control unit and the second main control unit processes data received by the controller, executes the logical control function of the controller, and transmits data through the backplane high-speed connector. As a result, the redundant switching speed of a single board and a single module can be effectively improved, the space requirement is small, and the redundant control function can be implemented on a single board and a single module, greatly saving hardware costs.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to the field of industrial control, and more particularly to a method, a computing device, and a storage medium for redundant control of a controller. Background Art

[0002] In the field of industrial control, redundant design is an effective means to meet the requirements of automated continuous control and improve the reliability and availability of control systems. Traditional methods for controlling redundant systems mainly rely on equipment redundancy, which is divided into overall system redundancy and key equipment redundancy.

[0003] In the aforementioned traditional redundant control solutions, for example, using device-level redundancy, whether for controller or rack redundancy, the overall system equipment count and cost increase exponentially, while also significantly increasing the system's installation space requirements. This makes them less suitable for control systems with compact spaces. For example, redundant information exchange between devices requires multiple connectors, resulting in a low exchange rate, typically in the tens of milliseconds. This makes them less suitable for applications with high switching disturbance requirements. In some equipment control systems, where space is limited, short-term continuous operation requires extremely high availability, and redundancy switching speeds are crucial, these traditional redundancy solutions are difficult to apply.

[0004] In summary, the traditional redundant control method has the following shortcomings: large system space requirements, slow switching speed, and high hardware cost. Summary of the Invention

[0005] In response to the above problems, the present invention provides a method, computing device and storage medium for redundant control of a controller, which can effectively improve the redundant switching speed of a single board or a single module, has a small system space requirement, and can be installed on a single board or a single module to realize redundant control functions, thereby greatly saving hardware costs.

[0006] According to a first aspect of the present invention, a method for redundant control of a controller is provided, wherein the controller includes a first main control unit and a second main control unit communicatively connected to a switch switching unit, a redundant interactive switching unit coupled to the switch switching unit, the first main control unit and the second main control unit, and a backplane high-speed connector connected to the first main control unit and the second main control unit. The method for redundant control of the controller includes: monitoring, by the redundant interactive switching unit, status information of a current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information; in response to determining that the redundant monitoring signal indicates redundant switching, the switch switching unit cuts off the communication connection with the current master device, and the current slave device in the first main control unit and the second main control unit is switched to a new master device; and processing, by the new master device in the first main control unit and the second main control unit, data received by the controller, executing the logical control function of the controller, and transmitting data through the backplane high-speed connector.

[0007] In some embodiments, the redundant interactive switching unit monitors the status information of the current master device in the first master control unit and the second master control unit so as to generate a redundant monitoring signal based on the monitored status information, including: receiving a first pulse signal from the first universal input and output interface of the current master device, and converting the received first pulse signal into a first level signal via a pulse conversion circuit; receiving a second level signal from the second universal input and output interface of the current master device; generating a redundant monitoring signal based on the status of the first level signal and the second level signal; and sending redundant monitoring signals to the current slave devices in the switching unit, the first master control unit, and the second master control unit, respectively.

[0008] In some embodiments, generating a redundant monitoring signal based on the status of a first level signal and a second level signal includes: receiving the first level signal and the second level signal via a status judgment circuit; in response to determining that the first level signal and the second level signal are both high level signals, the status judgment circuit outputs a low level signal; in response to at least one of the first level signal and the second level signal being a low level signal, the status judgment circuit outputs a high level signal; and instructing the switch switching unit and the slave device to perform redundant switching or not, respectively, by the output signal of the status judgment circuit being a high level signal or a low level signal.

[0009] In some embodiments, the status information of the master device includes one or more of the following: normal operation, power supply abnormality, system freeze, and partial function abnormality; the method also includes: determining the status of the master device based on the status of the first level signal and the second level signal.

[0010] In some embodiments, based on the states of the first level signal and the second level signal, determining the state of the main device includes one of the following: in response to determining that the first level signal and the second level signal are both high level signals, determining that the main device is working normally; in response to determining that the first level signal is a high level signal and determining that the second level signal is a low level signal, determining that some functions of the main device are abnormal; in response to determining that the first level signal is a low level signal and determining that the power detection signal of the main device indicates an abnormality, determining that the power supply of the main device is abnormal; in response to determining that the first level signal is a low level signal and determining that the power detection signal of the main device indicates an abnormality, determining that the power supply of the main device is abnormal. In response to determining that the first level signal is a low level signal and determining that the voltage detection signal of the main device indicates normal, determining that the main device system is stuck.

[0011] In some embodiments, the method for redundant control of a controller further includes: receiving data from the switch switching unit at the first master control unit and the second master control unit, respectively; receiving data processed by the master device at the slave devices in the first master control unit and the second master control unit; and verifying and storing the received data processed by the master device at the slave device based on a predetermined verification algorithm and the data received from the switch switching unit.

[0012] In some embodiments, the method for redundant control of a controller also includes: supplying power and performing voltage detection to the first main control unit via a first power supply unit, and supplying power and performing voltage detection to the second main control unit via a second power supply unit; the first power supply unit and the second power supply unit are coupled to the baseboard high-speed connector through different interfaces.

[0013] In some embodiments, the method for redundant control of a controller further includes: after the controller is powered on, detecting the working status of the first main control unit and the second main control unit, and reading the fault information in the non-volatile memory of the second main control unit; in response to reading the fault information and the second main control unit working normally, switching the second main control unit to a new master device; and in response to not reading the fault information, the second main control unit working normally and the first main control unit working abnormally, switching the second main control unit to a new master device.

[0014] According to a second aspect of the present invention, a controller is provided, comprising: a first master control unit and a second master control unit connected to a switch switching unit, each configured to receive data from the switch switching unit; a redundant interactive switching unit coupled to the switch switching unit, the first master control unit, and the second master control unit, configured to monitor status information of a current master device in the first master control unit and the second master control unit, so as to generate a redundant monitoring signal based on the monitored status information; the switch switching unit is configured to perform redundant switching in response to determining that the redundant monitoring signal indicates an indication, and cut off the communication connection with the current master device; wherein the current slave device in the first master control unit and the second master control unit is configured to perform redundant switching in response to determining that the redundant monitoring signal indicates an indication, and switch to a new master device, and the new master device is configured to process data received by the controller, execute the logical control function of the controller, and transmit data through the backplane high-speed connector.

[0015] In some embodiments, the first master control unit and the second master control unit respectively include multiple universal input and output interfaces, and the redundant interactive switching unit includes a pulse conversion circuit and a status judgment circuit; the status judgment circuit is configured to: receive a first pulse signal from the first universal input and output interface of the master device and receive a second level signal from the second universal input and output interface of the master device; the pulse conversion circuit is configured to convert the received first pulse signal into a first level signal; the status judgment circuit is also configured to: generate a redundant monitoring signal based on the status of the first level signal and the second level signal; and send redundant monitoring signals to the slave devices in the switch switching unit, the first master control unit, and the second master control unit respectively.

[0016] In some embodiments, the state judgment circuit includes: an AND logic gate circuit, a Schottky diode, a trigger, a comparator, an operational amplifier, a microprocessor or a programmable logic device; the redundant monitoring signal is used to instruct the switch switching unit and the slave device to perform redundant switching or not.

[0017] In some embodiments, the controller also includes: a first power supply unit, configured to provide power and perform voltage detection for the first main control unit, and the first power supply unit is coupled to the baseboard high-speed connector; a second power supply unit, configured to provide power and perform voltage detection for the second main control unit, and the second power supply unit is coupled to the baseboard high-speed connector.

[0018] In some embodiments, the switch switching unit includes multiple external communication interfaces, multiple internal communication interfaces, FPGA chips, relays, transistors, transfer switches and mechanical switches. The switch switching unit is configured to communicate with the first main control unit and the second main control unit respectively through different internal communication interfaces for the same input signal.

[0019] In some embodiments, the controller also includes: a redundant communication unit, configured to communicatively connect the first master control unit and the second master control unit, so that data processed by the master device is transmitted to the slave device; a master-slave detection unit, configured to detect the working status of the first master control unit and the second master control unit after the controller is powered on, and read the fault information in the non-volatile memory of the second master control unit; and determine whether the second master control unit needs to be switched to a new master device based on the working status of the second master control unit and whether the fault information is read.

[0020] According to a third aspect of the present invention, a computing device is provided, comprising: at least one processing unit; and at least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the device to perform the steps of the method according to the first aspect.

[0021] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a machine, the method according to the first aspect is implemented.

[0022] According to a fifth aspect of the present invention, there is further provided a computer program product, comprising a computer program, wherein when the computer program is executed by a machine, the method of the first aspect of the present invention is performed.

[0023] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements.

[0025] Figure 1 A schematic diagram of the internal structure of a controller for implementing an embodiment of the present invention is shown.

[0026] Figure 2 A flow chart of a method for redundant control of a controller according to an embodiment of the present invention is shown.

[0027] Figure 3 A flow chart of a method for generating a redundant monitoring signal according to an embodiment of the present invention is shown.

[0028] Figure 4A flow chart of a method for controller startup detection according to an embodiment of the present invention is shown.

[0029] Figure 5 A schematic diagram of the internal structure of a redundancy monitoring module of a controller according to an embodiment of the present invention is shown.

[0030] Figure 6 A schematic diagram of the circuit structure between controller and main control devices according to an embodiment of the present invention is shown.

[0031] Figure 7 A block diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0032] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0033] As used herein, the term "including" and its variations represent open inclusion, i.e., "including but not limited to." Unless otherwise stated, the term "or" means "and / or." The term "based on" means "based at least in part on." The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment." The term "another embodiment" means "at least one additional embodiment." The terms "first," "second," etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0034] In the aforementioned traditional redundant control solutions, for example, using device-level redundancy, whether for controller or rack redundancy, the overall system equipment count and cost increase exponentially, while also significantly increasing the system's installation space requirements. This makes them less suitable for control systems with compact spaces. For example, redundant information exchange between devices requires multiple connectors, resulting in a low exchange rate, typically in the tens of milliseconds. This makes them less suitable for applications with high switching disturbance requirements. In some equipment control systems, where space is limited, short-term continuous operation requires extremely high availability, and redundancy switching speeds are crucial, these traditional redundancy solutions are difficult to apply.

[0035] In summary, the traditional redundant control method has the following shortcomings: large system space requirements, slow switching speed, and high hardware cost.

[0036] In order to at least partially solve one or more of the above-mentioned problems and other potential problems, an example embodiment of the present invention proposes a scheme for redundant control of a controller and a controller. In the scheme of the present invention, the controller includes: a first master control unit and a second master control unit connected to a switch switching unit, and respectively configured to receive data from the switch switching unit; a redundant interactive switching unit coupled to the switch switching unit, the first master control unit, and the second master control unit, and configured to monitor status information of the current master device in the first master control unit and the second master control unit, so as to generate a redundant monitoring signal based on the monitored status information; the switch switching unit is configured to perform redundant switching in response to determining that the redundant monitoring signal indicates an indication, and cut off the communication connection with the current master device; wherein the current slave device in the first master control unit and the second master control unit is configured to perform redundant switching in response to determining that the redundant monitoring signal indicates an indication, and switch to a new master device, and the new master device is configured to process data received by the controller, execute the logical control function of the controller, and transmit data through the backplane high-speed connector.

[0037] Therefore, the above scheme uses two independent main control units and the "master-slave" functional state switching between the two main control units, so that during normal operation, both the master device and the slave device can receive data from the outside of the controller from the switch switching unit, ensuring that the slave device is heated and receives data; wherein, the master device is responsible for processing the data received by the controller, executing the logical control function of the controller, and transmitting data through the backplane high-speed connector; the slave device only receives data under normal working conditions, does not execute the logical control function of the controller, does not transmit data through the backplane high-speed connector, does not process the data received from the outside, and only performs data storage and verification; when the redundant interactive switching unit monitors If there is an abnormality in the status of the master device, the redundant monitoring signals sent to the switch switching unit, the first main control unit and the second main control unit respectively instruct the receiving device to perform redundant switching, which can make the switch switching power supply disconnect the communication connection with the current master device, thereby avoiding signal interference from the abnormal device in subsequent communications, and can also make the current slave device switch to the new master device, so that data processing, logic control and external communication functions are performed through the new master device; and because the slave device also continuously receives data during operation, after the current master device is abnormal and switched, the new master device has complete data, and can switch smoothly without affecting the data processing function and external communication of the controller device.

[0038] The above solution enables hot standby of key components within a single module, achieving a compact control system with high availability and fast redundancy switching. It can be deployed on a single board, requiring minimal rack space and seamlessly switching between individual boards (single modules or key components) without having to consider communication with multiple other devices within the system. Therefore, the present invention effectively improves the redundancy switching speed of a single board or module, requires minimal system space, and can implement redundant control functions on a single board or module, significantly saving hardware costs.

[0039] Figure 1 FIG. 1 shows a schematic diagram of a controller 100 for implementing an embodiment of the present invention. Figure 1 As shown in the figure, the controller 100 includes a switch switching unit 110, a first main control unit 120, a second main control unit 130, a power supply unit 140, a backplane high-speed connector 150, a redundant interactive switching unit 160, a redundant communication unit 170, a master-slave detection unit 180, an internal communication unit 182 and an external communication interface 111.

[0040] Regarding the switch unit 110, multiple external communication interfaces (e.g., Figure 1 111-1, 111-2 and 111-3 shown in the figure are respectively CAN external communication interface, RS422 / 485 external communication interface and Ethernet external communication interface), multiple internal communication interfaces (such as Figure 1 An external communication interface of the switching unit 110 corresponds to multiple internal communication interfaces. For example, the CAN external communication interface 111-1 corresponds to CANA and CANB, the RS422 / 485 external communication interface corresponds to UARTA and UARTB, and the Ethernet external communication interface corresponds to PHYA and PHYB.

[0041] About CAN (Controller Area Network), Figure 1 CANA and CANB represent two different CAN interfaces A and CAN interfaces B respectively.

[0042] About UART (Universal Asynchronous Receiver / Transmitter), it is a protocol and hardware interface for asynchronous serial communication; UART is commonly used for data communication between microcontrollers, computers and other digital devices. Figure 1 URATA and UARTB represent two different UART interfaces A and UART interfaces B respectively.

[0043] Regarding PHY (Physical Layer, port physical layer) is the physical layer transceiver, Figure 1 PHYA and PHYB represent two different PHY interfaces A and PHY interfaces B respectively.

[0044] The switching unit 110 is configured to communicate with the first main control unit 120 and the second main control unit 130 via different internal communication interfaces for the same input signal. The first main control unit 120 and the second main control unit 130 are each connected to the switching unit 110 and are each configured to receive data from the switching unit. For example, the first main control unit 120 receives CAN data, RS422 / 485 data, and Ethernet data from the switching unit 110 via CANA, UARTA, and PHYA, respectively. For example, the second main control unit 130 receives CAN data, RS422 / 485 data, and Ethernet data from the switching unit 110 via CANB, UARTB, and PHYB, respectively. Therefore, in normal operation, the master-slave status of the first main control unit 120 and the second main control unit 130 does not need to be considered. Both can independently receive data via the internal communication interface of the switching unit 110, thereby maintaining synchronization, independence, and non-interference of the received data.

[0045] The switching unit 110 also includes an FPGA chip, relays, transistors, transfer switches, and / or mechanical switches. It should be understood that the switch components of the switching unit are not limited to the aforementioned switch types. Through switching components such as the FPGA chip, relays, transistors, transfer switches, and / or mechanical switches, the switching unit 110 can connect or disconnect communications with the first main control unit 120 and the second main control unit 130. For example, it can connect or disconnect the first main control unit 120 from the CANA internal communication interface and connect or disconnect the second main control unit 130 from the CANB internal communication interface.

[0046] For example, using CAN data as an example, two CAN signals, CANA and CANB, are derived from the first and second master units 120, 130, respectively. These signals are then connected to the switching unit 110. Under normal operating conditions (e.g., with the first master unit 120 acting as the default master), the first master unit 120 operates normally, controlling the CAN enable switch to connect to the CANA signal, while the second master unit 130 controls the CAN enable switch to connect to the CANB signal. If the first master unit 120 fails, the second master unit 130 takes over control of the CAN enable switch, becoming the active master (i.e., the master device). Simultaneously, the switching unit 110 no longer receives control signals from the first master unit 120, preventing interference with the CAN enable controller in the event of a failure of the first master unit 120. After assuming control of the switching unit 110, the second master unit 130 switches from a slave device to a master device, processing data received via CANB and implementing redundant CAN data communication via the CAN transceiver. Other communication protocols can achieve similar data reception, processing and switching functions by setting two signals, which will not be described here.

[0047] Regarding the redundant interactive switching unit 160, coupled to the switch switching unit 110, the first main control unit 120 and the second main control unit 130, the redundant interactive switching unit 160 is configured to monitor the status information of the current master device in the first main control unit 120 and the second main control unit 130, so as to generate a redundant monitoring signal based on the monitored status information.

[0048] Regarding the new master device in the first master control unit and the second master control unit, it is configured, for example, to receive data from the switch switching unit 110, process the data received by the controller, execute the logic control function of the controller, and transmit data through the backplane high-speed connector; before the slave device becomes the new master device, it does not execute the aforementioned data processing function, but only receives data, such as receiving data from outside the system from the switch switching unit 110, such as receiving data processed by the master device from the master device.

[0049] Regarding the new slave device in the first master control unit and the second master control unit, it is configured, for example, to receive data from the switch switching unit 110, and to perform redundant switching in response to determining that the redundant monitoring signal indicates, and switch to a new master device; the slave device switches to the new master device and performs the functions that the master device needs to perform (including processing data received by the controller, executing the logical control functions of the controller, and transmitting data through the backplane high-speed connector).

[0050] Regarding the switch switching unit 110, it is also configured to perform redundant switching in response to determining that the redundant monitoring signal indicates that the communication connection with the current master device is cut off; thereby, the interference signal of the abnormal master device can be avoided, and the controller 100 can continue to communicate, process data and execute the functions of the controller 100 normally based on the new master device.

[0051] Regarding the power supply unit 140, it includes a first power supply unit 142 and a second power supply unit 144. The two groups of power supplies independently supply power to the main control units connected to them. For example, two independent 24V power supplies are provided through the baseboard high-speed connector 150 to power the entire controller 100. The two independent 24V power supply trees respectively supply power to the first main control unit 120 and the second main control unit 130. At the same time, the two independent power supply trees are respectively subjected to power supply topology and converted into the power rails required by each unit module.

[0052] In some embodiments, two power rails are generated between the first power supply unit 142 and the first main control unit 120, and two power rails are generated between the second power supply unit 144 and the second main control unit 130. Thus, when one power rail fails, the other power rail can be used to provide power, making the power supply of the controller 100 more stable.

[0053] In some embodiments, the first power supply unit 142 performs power supply detection and / or voltage fault detection on the first main control unit 120, and the second power supply unit 144 performs power supply detection and / or voltage fault detection on the second main control unit 130. For example, when the first power supply unit 142 detects a power rail fault on the first main control unit 120, it generates a fault feedback signal and sends it to the switch unit 110, the second main control unit 130, and the redundant interactive switching unit 160, so that the switch unit 110 and the second main control unit 130 can perform redundancy switching, for example, switching from the first main control unit 120 as the master device to the second main control unit 130 as the master device, and then performing IO (Input / Output) data communication and data processing through the new master device (the second main control unit 130), while keeping the switched first main control unit 120 in a silent state (in which the master unit does not send data to other devices).

[0054] In some embodiments, the first power supply unit 142 is configured to provide power and perform voltage detection for the first main control unit 120, and the first power supply unit 142 is coupled to the baseboard high-speed connector 150; the second power supply unit 144 is configured to provide power and perform voltage detection for the second main control unit 130, and the second power supply unit 144 is coupled to the baseboard high-speed connector 150.

[0055] Therefore, through two independent and mutually non-interfering power trees, when a power supply system failure occurs in the main device, the slave device can automatically switch to the master device to automatically take over the work without affecting the system function of the entire controller 100, ensuring long-term stable and reliable operation of the device.

[0056] In some embodiments, the first master control unit 120 and the second master control unit 130 respectively include multiple general-purpose input / output interfaces GPIO (General-purpose input / output), and the redundant interactive switching unit 160 includes a pulse conversion circuit 162 and a status judgment circuit 164. The status judgment circuit 164 is configured to: receive a first pulse signal from the first general-purpose input / output interface of the master device and receive a second level signal from the second general-purpose input / output interface of the master device; the pulse conversion circuit 162 is configured to convert the received first pulse signal into a first level signal; the status judgment circuit 164 is also configured to: generate a redundant monitoring signal based on the status of the first level signal and the second level signal; and send the redundant monitoring signal to the slave devices in the switch switching unit 110, the first master control unit 120 and the second master control unit 130 respectively.

[0057] For example, see Figure 5 , illustrates the GPIO transmission and reception situation with the first master control unit 120 as the master device and the second master control unit 130 as the slave device. For example, the GPIO-11 interface of the first master control unit 120 outputs a pulse signal to the pulse conversion circuit 162. The pulse conversion circuit 162 converts the pulse signal to generate a converted level signal, which is then sent to the status judgment circuit 164. The GPIO-12 interface of the first master control unit 120 outputs a level signal to the status judgment circuit 164. The status judgment circuit 164 judges the status of the master device (such as the first master control unit 120) based on the level signal converted by the pulse conversion circuit 162 and the level signal directly output by GPIO-12, generates a redundant monitoring signal, and sends the redundant monitoring signal to the switch unit 110 and the current slave device (such as the second master control unit 130).

[0058] Thus, the redundant interactive switching unit can determine the operating status of the master device by combining GPIO level signals and pulse signals, thereby resolving issues such as slow redundant switching, master control system freezes, and partial anomalies in the master control communication system. For example, conventional fault detection methods use a reset circuit for system fault detection. This requires a long detection time from detecting a master control unit freeze, triggering the reset detection circuit, to issuing a reset signal. Furthermore, it cannot guarantee that redundant switching will be initiated when the master control unit is operating abnormally. The solution provided by the present invention can effectively resolve such issues.

[0059] In some embodiments, the state determination circuit 164 includes: an AND logic gate circuit, a Schottky diode, a trigger, a comparator, an operational amplifier, a microprocessor, or a programmable logic device. In some embodiments, the redundancy monitoring signal is used to instruct the switch unit 110 and the slave device to perform redundant switching or not perform redundant switching.

[0060] The first main control unit 120 and the second main control unit 130 may each include one or more processing units, including dedicated processing units such as GPUs, FPGAs, and ASICs, and general-purpose processing units such as CPUs. In addition, one or more virtual machines may also be running on each main control unit.

[0061] In some embodiments, the controller 100 further includes a redundant communication unit 170 and a master-slave detection unit 180. The redundant communication unit 170 is configured to communicatively connect the first master control unit 120 and the second master control unit 130, so that data processed by the master device is transmitted to the slave device. The master-slave detection unit 180 is configured to detect the operating status of the first master control unit 120 and the second master control unit 130 after the controller is powered on, and to read fault information from the non-volatile memory of the second master control unit 130. Furthermore, based on the operating status of the second master control unit 130 and whether fault information has been read, determine whether the second master control unit 130 should be switched to the new master device. It should be understood that in the above example, the default operating state of the controller 100 is to use the first master control unit 120 as the master device and the second master control unit 130 as the slave device. If the default setting is changed, the master-slave detection unit 180 reads the fault information from the non-volatile memory of the first master control unit 120 and makes a corresponding determination.

[0062] In some embodiments, the PCIE bus is preferably used for data redundancy communication between master control units. The PCIE bus has advantages such as high transmission speed, good real-time performance, and strong anti-interference capabilities. It facilitates rapid data backup and redundancy switching. Therefore, it can quickly and quickly back up large amounts of data from the first master control unit 120 to the second master control unit 130 while maintaining good real-time performance. For example, when the redundant communication unit 170 uses PCIE for communication, the first master control unit 120 and the second master control unit 130 communicate via the PCIE bus. The first master control unit 120 operates in RC mode (master mode, responsible for data transmission, reception, and processing), while the second master control unit 130 operates in EP mode (endpoint mode, responsible for data reception). The first master control unit 120 acts as a master device, while the second master control unit 130 acts as a slave device. Data from the first master control unit is periodically transmitted to the second master control unit, and data in the first and second master control units 120 and 130 are periodically verified to prevent packet loss. RC (Root Complex) mode and EP (Endpoint) mode are two different operating modes in PCIE (Peripheral Component Interconnect Express) devices. In RC mode, the device is used to connect the CPU / memory subsystem and I / O devices. In RC mode, the type value in the PCIe configuration header is 1; in EP mode, the type value in the PCIe configuration header is 0.

[0063] Figure 2 FIG. 2 is a flow chart of a method 200 for redundant control of a controller according to an embodiment of the present invention. The method 200 may be performed as follows: Figure 1 The controller 100 shown in FIG. Figure 7 The method 200 is executed at the electronic device 700. It should be understood that the method 200 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0064] In step 202 , the redundant interactive switching unit monitors status information of the current master device in the first master control unit and the second master control unit, so as to generate a redundant monitoring signal based on the monitored status information.

[0065] The status information of the main device includes one or more of the following: normal operation, power supply abnormality, system freeze, and partial function abnormality.

[0066] In some embodiments, the redundant interactive switching unit monitors the status information of the current master device in the first master control unit and the second master control unit so as to generate a redundant monitoring signal based on the monitored status information, including: receiving a first pulse signal from the first universal input and output interface of the current master device, and converting the received first pulse signal into a first level signal via a pulse conversion circuit; receiving a second level signal from the second universal input and output interface of the current master device; generating a redundant monitoring signal based on the status of the first level signal and the second level signal; and sending redundant monitoring signals to the current slave devices in the switching unit, the first master control unit, and the second master control unit, respectively.

[0067] Please refer to Figure 5 The redundant interactive switching unit 160 monitors the current master device (eg Figure 5 The method comprises the following steps: receiving a first pulse signal from a first general input / output interface (GPIO-11) of the current master device (the first master control unit 120), converting the received first pulse signal into a first level signal via a pulse conversion circuit 162; receiving a second level signal from a second general input / output interface (GPIO-12) of the current master device (the first master control unit 120); generating a redundant monitoring signal based on the states of the first level signal and the second level signal; and respectively transmitting a redundant monitoring signal to the current slave device (the first master control unit 130) in the switch unit 110, the first master control unit 120, and the second master control unit 130. Figure 5 For example, the slave device (the second master control unit 130) sends a redundant monitoring signal.

[0068] In some embodiments, the redundancy monitoring signal is used to instruct the switch unit 110 and the slave device to perform redundant switching or not to perform redundant switching.

[0069] In some embodiments, the redundant interactive switching unit, the slave device and / or the master device determines the state of the master device based on the states of the first level signal and the second level signal.

[0070] Thus, multiple devices in each device controller 100 can determine whether the current operating status of the master device is normal and whether the redundancy monitoring signal indicates redundancy switching based on the pulse signal and level signal output by the GPIO interface of the master device.

[0071] The following will be combined Figure 3 The method of generating redundant monitoring signals is described in detail and will not be repeated here.

[0072] In step 204 , if it is determined that the redundancy monitoring signal indicates redundancy switching, the switch unit cuts off the communication connection with the current master device, and the current slave device in the first master control unit and the second master control unit is switched to the new master device.

[0073] For example, the current master device is the first master control unit 120, and the slave device is the second master control unit 130. The state judgment circuit 164 determines that the master device is in a certain abnormal state based on the first level signal and the second level signal, and generates a redundant monitoring signal (for example, the redundant monitoring signal is also expressed in the form of a level signal, 1 indicates redundant switching, and 0 indicates no redundant switching). At this time, the master device is in an abnormal state, and the redundant monitoring signal is 1; the switch switching unit 110 determines to perform redundant switching based on the received redundant monitoring signal being 1, and cuts off the communication connection with the first master control unit 120 to avoid the abnormal first master control unit 120 sending interference data and affecting the normal operation of the controller 100; the second master control unit 130 switches to the new master device and executes various data processing, logic control and external communication functions of the controller 100.

[0074] In step 206 , the new master device in the first master control unit and the second master control unit processes the data received by the controller, executes the logic control function of the controller, and transmits data through the backplane high-speed connector.

[0075] In some embodiments, at the first master control unit and the second master control unit, data is received from the switch switching unit respectively; at the slave devices in the first master control unit and the second master control unit, data processed by the master device is received via the redundant communication unit 170; and at the slave device, based on a predetermined verification algorithm and the data received from the switch switching unit, the received data processed by the master device is verified and stored.

[0076] Redundant communication unit 170 has been described in detail above and will not be repeated here. In the above solution, controller 100 includes an internal communication unit. Data exchange and communication between controller 100 and the IO (Input / Output) module (i.e., switching unit 110) is performed via an internal communication bus. In this embodiment, the two master control units serve as the two primary nodes for internal communication. Under normal operating conditions, the first main control unit and the second main control unit communicate with the IO module (i.e., the switch switching unit 110) through the internal bus at the same time. When the first main control unit (for example, as a master device) operates normally, the first main control unit communicates data with the IO module; the second main control unit (at this time, a slave device) does not issue communication instructions and is only used to receive data; when the communication between the first main control unit and the IO module is abnormal, the first main control unit sends fault diagnosis information to the second main control unit for subsequent fault analysis and processing. At the same time, the switch switching unit performs redundant switching and switches the master device to the second main control unit, so that the second main control unit (as the master device) communicates and processes data with the IO module, while keeping the first main control unit in a silent state to prevent interference with other units of the controller 100.

[0077] In the above scheme, the controller redundancy method provided by the present invention realizes the hot standby redundancy function of key components in a single module, has the characteristics of stable and fast redundant switching, does not require the exponential increase of identical controller modules, and has a small control system size and high availability; and through the dual judgment of GPIO level signals and GPIO pulse signals, it realizes rapid and accurate detection of various abnormal states of the main device, and has the characteristics of fast switching speed and strong anti-interference ability; in this judgment mode, the main control unit only needs to perform level signal detection and switching through interruption, and the main control unit does not need to collect detection pulse signals in real time, thereby saving system resources and improving system operation efficiency.

[0078] In addition, in the above scheme, the redundant interactive switching unit includes a pulse conversion circuit, which adjusts the GPIO pulse signal sent by the main device into a high-level and low-level signal through the pulse conversion circuit, thereby reducing system resource usage, improving the system's operating efficiency, and having strong stability and reliability; and the PCIE bus is used between the main control units inside the controller 100 for data redundancy communication, which has good real-time performance, can quickly interact with data, meet the requirements of fast redundant switching, and at the same time has strong anti-interference ability and stability.

[0079] Figure 3 FIG. 3 is a flow chart of a method 300 for generating a redundant monitoring signal according to an embodiment of the present invention. Figure 1 The controller 100 shown in FIG. Figure 7The method 300 is executed at the electronic device 700. It should be understood that the method 300 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0080] In step 302 , a first level signal and a second level signal are received via a state determination circuit.

[0081] In step 304 , in response to determining that the first level signal and the second level signal are both high level signals, the state determination circuit outputs a low level signal.

[0082] In step 306 , in response to at least one of the first level signal and the second level signal being a low level signal, the state determination circuit outputs a high level signal.

[0083] In step 308, the output signal of the state judgment circuit is a high level signal or a low level signal, which instructs the switch unit and the slave device to perform redundant switching or not to perform redundant switching respectively.

[0084] In some embodiments, the redundant interactive switching unit, the slave device and / or the master device determines the state of the master device based on the states of the first level signal and the second level signal.

[0085] In some embodiments, determining the status of the main device includes one of the following: if it is determined that the first level signal and the second level signal are both high level signals, it is determined that the main device is operating normally; if it is determined that the first level signal is a high level signal and the second level signal is a low level signal, it is determined that some functions of the main device are abnormal; if it is determined that the first level signal is a low level signal and the power detection signal indication of the main device is abnormal, it is determined that the power supply of the main device is abnormal; if it is determined that the first level signal is a low level signal and the voltage detection signal indication of the main device is normal, it is determined that the main device system is stuck.

[0086] For example, the master device (taking the first master control unit 120 as an example) operates normally, sending a pulse signal through GPIO-11. The pulse conversion circuit 162 conditions the pulse signal into a high-level signal and then outputs the signal to the status judgment circuit 164 (for example, including an AND gate logic circuit). Simultaneously, a high-level signal is sent to the status judgment circuit 164 through GPIO-12. After the two GPIO signals are logically judged by the status judgment circuit 164, the output redundant monitoring signal is a high-level signal. Simultaneously, a redundant monitoring signal is sent to the second master control unit 130 and the switch unit 110. When a high-level signal is detected, neither the second master control unit 130 nor the switch unit 110 performs redundant switching. At this time, the first master control unit 120 remains in the master mode and the second master control unit 130 remains in the slave mode. Simultaneously, the switch unit 110 switches to data communication with the first master control unit 120 and sends data only to the second master control unit 130.

[0087] Continuing with the above example, when the power supply system of the first main control unit 120 is abnormal or the system is stuck, the first main control unit 120 has no pulse signal to send, and the pulse conversion circuit conditions it into a low-level signal and outputs it to the status judgment circuit 164. At the same time, a high-level signal is sent to the status judgment circuit 164 through GPIO-12, and the redundant monitoring signal output by the status judgment circuit 164 is a low-level signal; at the same time, a redundant monitoring signal is sent to the second main control unit 130 and the switch switching unit 110 to instruct the two to perform redundant switching and switch to a working mode with the second main control unit 130 as the master device and the first main control unit 120 as the slave device. At the same time, the switch switching unit 110 switches to data communication with the second main control unit 130 and does not receive data transmitted to it by the first main control unit 120.

[0088] Continuing with the above example, when some functions of the first main control unit 120 are abnormal, the first main control unit 120 can send pulse signals normally, but the GPIO-12 interface of the first main control unit 120 outputs a low-level signal, indicating that some functions of the first main control unit 120 are abnormal. When the status judgment circuit 164 receives the above two level signals, the output redundant monitoring signal is a low-level signal, and a redundant monitoring signal is sent to the second main control unit 130 and the switch switching unit 110 at the same time to instruct the two to perform redundant switching and switch to an operating mode with the second main control unit 130 as the master device and the first main control unit 120 as the slave device. At the same time, the switch switching unit 110 switches to data communication with the second main control unit 130 and does not receive data transmitted to it by the first main control unit 120.

[0089] In the above example, the pulse detection method is used to more quickly detect whether the system of the main device (such as the first main control unit 120) is stuck or the power supply is abnormal, and fast redundant switching is performed to ensure the continuity and reliability of data processing. At the same time, the GPIO interface of the main device is used to output high and low level signals to quickly detect abnormal functions of some main control units.

[0090] The various failure modes of the master device include:

[0091] (1) The power supply of the master device is abnormal or the system is stuck. No pulse is sent from the first general input and output interface of the master device. The pulse conversion circuit outputs a low level. The redundant monitoring signal is used as an instruction to perform redundant switching. The master device performs a relinquishment operation and the slave device switches to the new master device to take over the work and perform data processing.

[0092] (2) The master device system works normally, but some functions are abnormal. The master device sends a low-level signal through the second universal input and output interface. The redundant monitoring signal is used as an instruction to perform redundant switching. The master device performs a handover operation, and the slave device switches to the new master device to take over the work and process data.

[0093] For example, when the state judgment circuit 164 includes an AND logic gate circuit, the truth table of the redundant monitoring signal output by the redundant interactive switching unit 160 is shown in the following table:

[0094] Table 1

[0095]

[0096] The GPIO level signal is logic 1, which represents a high output level, and logic 0, which represents a low output level; the pulse signal is logic 1, which represents a pulse, and logic 0, which represents no pulse signal; the redundant switching signal is logic 1, which represents redundant switching, and logic 0, which represents that the main device is working normally and no redundant switching is performed.

[0097] Therefore, the main control unit and the switch switching unit perform fault detection and judgment through interruption, which can save a lot of system resources and eliminate the need for real-time high-frequency detection, making the controller system more efficient and improving the stability and reliability of the controller system operation. It is also suitable for use in occasions with compact installation space and high requirements for redundant switching speed. Compared with traditional reset circuit detection, it has greatly improved stability and redundant switching speed.

[0098] In some embodiments, power is supplied to the first main control unit and voltage detection is performed via a first power supply unit, and power is supplied to the second main control unit and voltage detection is performed via a second power supply unit; the first power supply unit and the second power supply unit are coupled to the baseboard high-speed connector through different interfaces.

[0099] Therefore, through two independent and mutually independent power trees, when a power supply system failure occurs in the main device, the slave device can automatically switch to the master device to automatically take over the work without affecting the function of the entire controller system, ensuring long-term stable and reliable operation of the equipment.

[0100] Figure 4 FIG. 4 is a flow chart of a method 400 for controller startup detection according to an embodiment of the present invention. The method 400 may be performed as follows: Figure 1 The controller 100 shown in FIG. Figure 7 The method 400 is executed at the electronic device 700. It should be understood that the method 400 may further include additional steps not shown and / or may omit the steps shown, and the scope of the present invention is not limited in this respect.

[0101] In step 402 , after the controller is powered on, the operating states of the first main control unit and the second main control unit are detected, and fault information in the non-volatile memory of the second main control unit is read.

[0102] For example, see Figure 6 Taking the first master control unit 120 as the master device by default as an example, after the controller is powered on, the master-slave detection unit 180 detects the working status of the first master control unit 120 and the second master control unit 130, and reads the non-volatile memory of the second master control unit 130 (for example Figure 6 The fault information in the memory 166) is stored in the memory 166).

[0103] In step 404, if the fault information is read and the second main control unit is operating normally, the second main control unit is switched to become the new master device.

[0104] For example, continuing with the above example, if fault information is read, it means that the first main control unit 120 has previously failed, and the default master device of the controller 100 (such as the first main control unit 120) has been switched, so the default slave device (such as the second main control unit 130) is used as the new main control unit for data processing.

[0105] In step 406 , if no fault information is read, the second main control unit is operating normally and the first main control unit is operating abnormally, the second main control unit is switched to become a new master device.

[0106] For example, continuing with the above example, if no fault information is read, the default master device of the controller 100 (such as the first master control unit 120) cannot work normally, while the default slave device (such as the second master control unit 130) can work normally, and the default slave device (such as the second master control unit 130) is also used as the new master control unit for data processing.

[0107] Taking the default master device (first master control unit 120) and the default slave device (second master control unit 130) as an example, the master-slave detection unit 180 includes two GPIO signals, namely GPIO1 and GPIO2 signals, wherein GPIO1 is a pulse signal sent by the second master control unit 130 (through the GPIO-23 interface) to the first master control unit 120, which is used to detect whether the second master control unit 130 is working normally. The presence of a pulse signal indicates that the second master control unit 130 is working normally, and the absence of a pulse signal indicates that the second master control unit 130 is working abnormally; the GPIO2 signal is a strong master signal sent by the second master control unit 130 to the first master control unit 120. When GPIO-24 outputs a high-level signal, redundancy switching is not performed, and the controller 100 is in the first master control unit. 120 is the master and the second main control unit 130 is the slave working mode; when GPIO-24 outputs a low-level signal, it represents that the second main control unit 130 sends a strong master signal. At this time, after the first main control unit 120 receives the strong master signal, it only retains the redundant interactive switching function, and other functions remain silent so as not to send interference signals, thereby not affecting the normal operation of other units. At the same time, the first main control unit 120 will stop sending pulse signals to other devices; the redundant interactive switching unit 160 sends a redundant monitoring signal to the second main control unit 130 and the switch switching unit 110 to instruct the two to perform synchronous redundant switching, switching to the second main control unit 130 as the new master device, and at the same time the second main control unit 130 writes the switching information to the memory 166 for fault information storage.

[0108] Continuing with the above example, regarding the storage of fault information, it includes: after the controller 100 is powered on, when the first main control unit 120 and the second main control unit 130 are operating normally, the second main control unit 130 reads the data stored in the memory 166. When there is no data stored, the second main control unit 130 sends a pulse signal normally, and GPIO-24 sends a high-level signal at the same time. The controller system does not perform redundant switching, and operates with the first main control unit 120 as the master device and the second main control unit 130 as the slave device.

[0109] Continuing with the above example, after power-on is completed, when both the first main control unit 120 and the second main control unit 130 are operating normally, the second main control unit 130 reads the data stored in the memory 166. When it is read that the first main control unit 120 has failed and switched to the master device (switched to the second main control unit 130), it means that the first main control unit 120 is unstable. The second main control unit 130 then sends a strong master signal through GPIO-24, so that the first main control unit 120 no longer sends a pulse signal, and sends a redundant monitoring signal through the redundant interactive switching unit 160, so that the controller 100 switches to operate with the second main control unit 130 as the master device and the first main control unit 120 as the slave device.

[0110] Continuing with the above example, after power-on is completed, the first main control unit 120 works normally, and the second main control unit 130 has power supply abnormality or the system is stuck, the second main control unit 130 will not send a pulse signal to the first main control unit 120. At the same time, the first main control unit 120 no longer receives a strong main signal, and the controller 100 performs redundant switching, keeping the first main control unit 120 as the master device and the second main control unit 130 as the slave device.

[0111] Therefore, during the operation of the controller 100, as long as there is a record of a failure of the default master device (such as the first master control unit 120), redundant switching is required regardless of whether the default master device (such as the first master control unit 120) has resumed normal operation. The default slave device (such as the second master control unit 130) is switched to the working mode of the new master device. Only when the fault is repaired will the entire controller system be initialized. After initialization, it will continue to work in the default master-slave device mode. This solution can greatly improve the stability and reliability of the controller module.

[0112] In summary, the redundant interactive switching unit adopts the pulse signal + MRAM (non-volatile memory) flag signal detection method. In the case of power-on and restart, it can quickly detect the healthy main control unit, record the previous faulty main control unit, always keep the healthy main control unit working as the main unit, and keep the faulty main control unit silent. This effectively avoids the phenomenon that the faulty main control unit competes with the healthy main control unit for the main controller authority after returning to normal after power-on and restart, thereby improving the stability and reliability of system operation.

[0113] Figure 7 Schematic diagram of an example electronic device 700 that can be used to implement the embodiments of the present specification. Figure 1 The controller 100 shown can be implemented by an electronic device 700. As shown, the electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 702 or loaded from a storage unit 708 into a random access memory (RAM) 703. The random access memory 703 can also store various programs and data required for the operation of the electronic device 700. The CPU 701, the read-only memory 702, and the random access memory 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0114] Multiple components in the electronic device 700 are connected to the input / output interface 705, including: an input unit 706, such as a keyboard, a mouse, a microphone, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0115] The various processes and procedures described above, such as methods 200 to 400, may be performed by the central processing unit 701. For example, in some embodiments, methods 200 to 400 may be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the read-only memory 702 and / or the communication unit 709. When the computer program is loaded into the random access memory 703 and executed by the central processing unit 701, one or more actions of the methods 200 to 400 described above may be performed.

[0116] The present invention relates to methods, apparatuses, systems, electronic devices, computer-readable storage media and / or computer program products. The computer program products may include computer-readable program instructions for executing various aspects of the present invention.

[0117] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or raised-in-groove structure on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0118] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge computing devices. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0119] The computer program instructions for performing the operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, the state information of the computer-readable program instructions is used to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), so that the electronic circuit can execute the computer-readable program instructions, thereby implementing various aspects of the present invention.

[0120] Various aspects of the present invention are described herein with reference to flowcharts and / or step diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each step of the flowcharts and / or step diagrams, and any combination of the steps in the flowcharts and / or step diagrams, can be implemented by computer-readable program instructions.

[0121] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more steps in the flowchart and / or step diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more steps in the flowchart and / or step diagram.

[0122] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more steps in the flowchart and / or step diagram.

[0123] The flowcharts and step diagrams in the accompanying drawings show the possible architectures, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present invention. In this regard, each step in the flowchart or step diagram can represent a module, program segment or part of an instruction, and a module, program segment or part of an instruction contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions marked in the steps can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each step in the step diagram and / or flowchart, and the combination of the steps in the step diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0124] While various embodiments of the present invention have been described above, the above descriptions are intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for redundant control of a controller, characterized in that: The controller includes a first main control unit and a second main control unit communicatively connected to the switch unit, a redundant interactive switching unit coupled to the switch unit, the first main control unit, and the second main control unit, and a backplane high-speed connector connected to the first main control unit and the second main control unit. The method includes: Monitoring the status information of the current master device among the first master control unit and the second master control unit by the redundant interactive switching unit so as to generate a redundant monitoring signal based on the monitored status information includes: receiving a first pulse signal from a first universal input / output interface of the current master device, and converting the received first pulse signal into a first level signal via a pulse conversion circuit; receiving a second level signal from a second universal input / output interface of the current master device; generating a redundant monitoring signal based on the status of the first level signal and the second level signal; and the redundant interactive switching unit sending the redundant monitoring signal to the current slave device among the switch switching unit, the first master control unit, and the second master control unit, respectively; In response to determining that the redundancy monitoring signal indicates redundancy switching, the switch switching unit cuts off the communication connection with the current master device, and the current slave device in the first master control unit and the second master control unit is switched to the new master device; receiving, at slave devices in the first master control unit and the second master control unit, data processed by the master device via the redundant communication unit; and The new master device in the first main control unit and the second main control unit processes data received by the controller, executes the logic control function of the controller, and transmits data through the backplane high-speed connector; Among them, generating a redundant monitoring signal also includes: receiving a first level signal and a second level signal via a state judgment circuit; in response to determining that the first level signal and the second level signal are both high level signals, the state judgment circuit outputs a low level signal; in response to at least one of the first level signal and the second level signal being a low level signal, the state judgment circuit outputs a high level signal; and by the output signal of the state judgment circuit being a high level signal or a low level signal, instructing the switch switching unit and the slave device to perform redundant switching or not to perform redundant switching, respectively.

2. The method according to claim 1, characterized in that The status information of the master device includes one or more of the following: normal operation, power supply abnormality, system freeze, partial function abnormality; The method further includes determining a status of a master device based on states of the first level signal and the second level signal.

3. The method according to claim 2, characterized in that Determining the state of the master device based on the states of the first level signal and the second level signal includes one of the following: In response to determining that the first level signal and the second level signal are both high level signals, determining that the master device is operating normally; In response to determining that the first level signal is a high level signal and determining that the second level signal is a low level signal, determining that a portion of the main device functions abnormally; In response to determining that the first level signal is a low level signal and determining that the power detection signal of the master device indicates an abnormality, determining that the power supply of the master device is abnormal; In response to determining that the first level signal is a low level signal and determining that the voltage detection signal of the master device indicates normal, it is determined that the master device system is stuck.

4. The method according to claim 1, wherein Also includes: At the first main control unit and the second main control unit, respectively receiving data from the switch switching unit; as well as At the slave device, based on a predetermined verification algorithm and data received from the switch unit, the received data processed by the master device is verified and stored.

5. The method according to claim 3, characterized in that Also includes: The first main control unit is supplied with power and voltage detection is performed via a first power supply unit, and the second main control unit is supplied with power and voltage detection is performed via a second power supply unit; the first power supply unit and the second power supply unit are coupled to the baseboard high-speed connector through different interfaces.

6. The method according to claim 3, characterized in that Also includes: After the controller is powered on, detecting the working status of the first main control unit and the second main control unit, and reading the fault information in the non-volatile memory of the second main control unit; In response to reading the fault information and the second main control unit working normally, switching the second main control unit to a new master device; as well as In response to no fault information being read, the second main control unit is operating normally and the first main control unit is operating abnormally, the second main control unit is switched to be a new master device.

7. A controller for redundant control, characterized in that: include: The first main control unit and the second main control unit connected to the switch unit are respectively configured to receive data from the switch unit; a redundant interactive switching unit coupled to the switch unit, the first main control unit, and the second main control unit, configured to monitor status information of a current master device in the first main control unit and the second main control unit, so as to generate a redundant monitoring signal based on the monitored status information, and the redundant interactive switching unit sends the redundant monitoring signal to the slave devices in the switch unit, the first main control unit, and the second main control unit respectively; a switch switching unit configured to cut off the communication connection with the current master device in response to determining that the redundancy monitoring signal indicates redundancy switching; a redundant communication unit configured to communicatively connect the first main control unit and the second main control unit so that data processed by the master device is transmitted to the slave device; The current slave device in the first master control unit and the second master control unit is configured to perform redundancy switching in response to determining that the redundancy monitoring signal indicates an instruction to switch to a new master device; the new master device is configured to process data received by the controller, execute the logic control functions of the controller, and transmit data through the backplane high-speed connector; the first master control unit and the second master control unit each include a plurality of general-purpose input and output interfaces, and the redundancy interactive switching unit includes a pulse conversion circuit and a state determination circuit; the state determination circuit is configured to receive a first pulse signal from the first general-purpose input and output interface of the master device and a second level signal from the second general-purpose input and output interface of the master device; The pulse conversion circuit is configured to convert the received first pulse signal into a first level signal; The state determination circuit is further configured to generate a redundant monitoring signal based on states of the first level signal and the second level signal.

8. The controller according to claim 7, characterized in that The state judgment circuit includes: an AND logic gate circuit, a Schottky diode, a trigger, a comparator, an operational amplifier, a microprocessor or a programmable logic device; The redundancy monitoring signal is used to instruct the switch unit and the slave device to perform redundant switching or not to perform redundant switching.

9. The controller according to claim 7, characterized in that Also includes: a first power supply unit, configured to supply power and perform voltage detection for the first main control unit, the first power supply unit being coupled to the backplane high-speed connector; The second power supply unit is configured to supply power and perform voltage detection for the second main control unit, and the second power supply unit is coupled to the baseboard high-speed connector.

10. The controller according to claim 7, characterized in that The switch switching unit includes multiple external communication interfaces, multiple internal communication interfaces, and also includes an FPGA chip, a relay, a transistor, a conversion switch and / or a mechanical switch. The switch switching unit is configured to: for the same input signal, communicate with the first main control unit and the second main control unit respectively through different internal communication interfaces.

11. The controller according to claim 7, characterized in that Also includes: a master-slave detection unit configured to detect the working status of the first master control unit and the second master control unit after the controller is powered on, and read the fault information in the non-volatile memory of the second master control unit; And based on the working state of the second main control unit and whether the fault information is read, it is determined whether the second main control unit needs to be switched to a new master device.

12. A computing device, characterized in that include: at least one processing unit; At least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the apparatus to perform the steps of the method according to any one of claims 1 to 6.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a machine, the method according to any one of claims 1 to 6 is implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a machine, the method according to any one of claims 1 to 6 is performed.

Images