Dual-redundancy hot backup method and system

Abstract

The invention discloses a dual-redundancy hot backup method and system, and belongs to the technical field of dual-redundancy hot backup, and the method comprises the steps that a first processor receives first sampling data collected by a first data collection module and second sampling data forwarded by a second processor and collected by a second data collection module; performing data processing and resolving, executing a corresponding control action, outputting the control action to a corresponding execution device, and sending synchronous state data except the sampling data to a second processor; and the second processor receives and uses the second sampling data acquired by the second data acquisition module. According to the invention, redundancy is carried out on the data acquisition module, the second processor directly uses the second sampling data, synchronization of the sampling data is not needed, and especially when the sampling data volume is large, the data synchronization rate can be improved, so that the real-time performance of hot backup is improved, and the requirements of millisecond-level high-real-time application scenes are met.

Description

Technical Field

[0001] The present invention relates to the technical field of dual redundant hot backup, and in particular to a dual redundant hot backup method and system. Background Art

[0002] Dual redundant hot backup technology is based on redundant design and real-time synchronization mechanism. The core is to configure two devices with the same or similar functions and keep them in real-time synchronization. When the system detects that the main device fails, the backup device can immediately take over the work of the main device to ensure the continuous normal operation of the business and the security of the data. The principle characteristics of this technology can be summarized as: redundant configuration, real-time synchronization, heartbeat detection, and fault switching. At present, dual redundant hot backup technology has a high level of development both at home and abroad, and embedded devices using this technology are also widely used in many fields such as aerospace, telecommunications, finance and banking, medical IT, and industrial automation.

[0003] Although dual redundant hot backup technology is of great significance in improving system reliability, it also has some shortcomings. In the common data synchronization method between two machines, the first processor in power sends its own status data to the backup machine. Its own status data includes external data collected by the data acquisition module, step status data of executing various tasks, configuration status data of the first processor, and data that the slave machine cannot obtain due to limited authority, etc., so as to achieve data synchronization between the master and the slave. When the first processor fails, the backup machine can replace the first processor to continue data processing, etc. Since the data synchronization process involves data transmission and status update, especially when the amount of data is large, the synchronization operation may take up a lot of time. Therefore, this method cannot adapt to application scenarios with high real-time requirements, such as millisecond-level posture control scenarios. In summary, how to improve the real-time performance of the dual redundant hot backup method is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of the present invention is to overcome the problems of the prior art and provide a dual-redundancy hot backup method and system.

[0005] The object of the present invention is to achieve the following technical solution: a dual redundant hot backup method, wherein the first processor is in a power state and the second processor is in a power-lost state, the method comprising the following steps:

[0006] The first processor receives the formal work order and performs the following sub-steps:

[0007] Receive first sampled data collected by the first data collection module and second sampled data collected by the second data collection module forwarded by the second processor;

[0008] Perform data processing and solving, execute corresponding control actions and output to corresponding execution devices, and send synchronization status data to the second processor, including step status data of executing each instruction, configuration status data, and data that the second processor has no authority to obtain;

[0009] The second processor receives the formal work order forwarded by the first processor and performs the following sub-steps:

[0010] Receiving second sampled data collected by a second data collection module;

[0011] Read the authority flag to determine whether to cut off the authority. If so, perform data processing and solution, execute the corresponding control action and output it to the corresponding execution device; if not, forward the second sampling data collected by the second data acquisition module to the first processor, receive the synchronization status data of the first processor, then perform data processing and solution, and execute the corresponding control action. The control action executed by the second processor is not output to the corresponding execution device.

[0012] In one example, the rights-cutting judgment further includes:

[0013] The authority management module receives the dog feeding signal sent by the first processor. If the dog feeding cycle is exceeded and no dog feeding signal is received, it is determined that the first processor fails and the authority cutting action is executed, so that the second processor takes over the first processor to complete subsequent work.

[0014] In one example, after the second processor receives the synchronization status data of the first processor, the method further includes:

[0015] The synchronization state data is compared with the corresponding data stored in the first processor. If the states of the two are consistent, no processing is performed. Otherwise, the synchronization state data is used for updating.

[0016] In one example, after the second processor executes the corresponding control action, it only stores it and does not execute the return response. The state of the standby machine will not affect the change of the host state or the execution of the host program flow, thereby ensuring the real-time requirements of the host.

[0017] In one example, after receiving the first sampling data and the second sampling data, the first processor determines whether the first sampling data meets the legality requirements. If so, the first sampling data is adopted. If not, the first processor determines whether the second sampling data meets the legality requirements. If so, the second sampling data is adopted. If not, the historical data used by the first processor in the previous cycle that meets the legality requirements is adopted.

[0018] In one example, the first processor determines whether the number of times that the first sampled data fails to meet the legality requirement reaches an upper limit of a periodic threshold. If so, it is determined that the first data acquisition module fails and the second sampled data is directly used.

[0019] In one example, the first processor and the second processor are in a debugging mode, comprising the following steps:

[0020] The first processor is in power state and executes the following sub-steps:

[0021] Receive remote control instructions from the host computer;

[0022] Execute the remote control command action, return a response command to the upper computer, and then the upper computer determines that the first processor functions normally according to the response command;

[0023] The first processor and the second processor receive a manual power-cutting instruction, the first processor is in a power-losing state, the second processor is in a power-taking state, and the second processor executes the following sub-steps:

[0024] Receive remote control instructions from the host computer;

[0025] The remote control command action is executed, and a response command is returned to the upper computer, so that the upper computer determines that the second processor functions normally according to the response command.

[0026] In one example, the first processor and the second processor are in a preparation mode, comprising the following steps:

[0027] The first processor is in power state and executes the following sub-steps:

[0028] The first processor receives the remote control instruction from the host computer;

[0029] Forward the remote control command to the second processor, execute the remote control command action, wait for the second processor to respond, integrate the results of the two machines and return the response command to the upper computer;

[0030] Sending synchronization status data to the second processor, including step status data of executing each instruction, configuration status data, and data that the second processor is not authorized to obtain;

[0031] The second processor reads the authority flag, confirms that it is in the authority-losing state, and executes the following sub-steps:

[0032] Determine whether to cut off the authority. If not, determine whether the remote control instruction forwarded by the first processor is received. If received, execute the remote control instruction action, respond to the first processor, and receive the synchronization status data of the first processor; if not received, receive the synchronization status data of the first processor; if the authority is cut off, receive the remote control instruction sent by the host computer, execute the remote control instruction action, and return the response instruction to the host computer.

[0033] It should be further explained that the technical features corresponding to the various examples of the above method can be combined or replaced with each other to form a new technical solution.

[0034] The present invention also includes a dual-redundant hot backup system, the system includes a first data acquisition module, a second data acquisition module, a first processor, and a second processor, the first data acquisition module is connected to the first processor, the second data acquisition module is connected to the second processor, and the first processor and the second processor are bidirectionally communicated;

[0035] The first data acquisition module is used to acquire first sampling data;

[0036] The second data acquisition module is used to collect second sampling data;

[0037] The first processor is used to receive the formal work order and perform the following sub-steps:

[0038] Receive the first sampled data collected by the first data acquisition module and the second sampled data collected by the second data acquisition module forwarded by the second processor; perform data processing and solving, execute the corresponding control action and output it to the corresponding execution device, and send synchronization status data to the second processor, including the step status data of executing each instruction, the configuration status data, and the data that the second processor has no authority to obtain;

[0039] The second processor is used to receive the formal work instruction forwarded by the first processor, and perform the following sub-steps:

[0040] Receive the second sampling data collected by the second data acquisition module; read the authority flag to determine whether to cut off the authority. If so, perform data processing and solution, execute the corresponding control action and output it to the corresponding execution device; if not, forward the second sampling data collected by the second data acquisition module to the first processor, receive the synchronization status data of the first processor, then perform data processing and solution, and execute the corresponding control action. The control action executed by the second processor is not output to the corresponding execution device.

[0041] In one example, the system further includes a host computer, which is connected to the first processor and the second processor via the authority control module.

[0042] It should be further explained that the technical features corresponding to the above system examples can be combined or replaced with each other to form a new technical solution.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] 1. In one example, the data acquisition module is redundant, and the second processor directly uses the second sampled data without synchronization of the sampled data. Especially when the amount of sampled data is large, the data synchronization rate can be increased, thereby improving the real-time performance of the hot backup, thereby meeting the needs of millisecond-level high-real-time application scenarios;

[0045] Furthermore, the second processor in the power-lost state performs data processing and solving and executes corresponding control actions, so as to keep in sync with the first processor. When the power is cut off, the second processor can more efficiently and conveniently take over the first processor to continue to complete subsequent work; at the same time, the control actions executed by the second processor are not output to the corresponding execution device, that is, the second processor does not have external control authority, that is, it unconditionally follows the first processor to execute corresponding actions or task status switching, so that the second processor has no effect on the actions of the first processor.

[0046] 2. In one example, the second processor compares the synchronization status data with the corresponding data stored in the first processor. If the status is inconsistent, the synchronization status data is used to update it. This can minimize the synchronization workload and ensure the synchronization rate, so that the data of the first processor and the second processor are completely synchronized, so that the second processor can efficiently take over the first processor to complete subsequent work when power is cut off.

[0047] 3. In one example, after the second processor executes the corresponding control action, it does not need to return a response instruction to the first processor, that is, the first processor does not need to wait for the second processor to execute the response, thereby reducing the waiting time of the first processor and improving the processing efficiency of the hot backup method to meet the application requirements of high real-time performance at the millisecond level.

[0048] 4. In one example, the data acquisition module is made redundant, and it is determined whether the first sampling data and the second sampling data are legal, and the legal sampling data is used to improve data reliability.

[0049] 5. In one example, if it is determined that the first data acquisition module fails, the second sampling data is directly used, which reduces the steps of judging the legitimacy of the data, thereby improving data processing efficiency and further improving real-time requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings. The accompanying drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to represent the same or similar parts. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0051] Figure 1 A software state partition diagram provided for an example of the present invention;

[0052] Figure 2 A method flow chart provided for an example of the present invention;

[0053] Figure 3 A flow chart of the double-collected data legitimacy judgment provided as an example of the present invention;

[0054] Figure 4 A timing diagram of two processors independently responding to host computer instructions provided in an example of the present invention;

[0055] Figure 5 A method flow chart provided for another example of the present invention;

[0056] Figure 6 A timing diagram of two processors simultaneously responding to host computer instructions provided in an example of the present invention;

[0057] Figure 7 An embedded software functional structure diagram provided for an example of the present invention;

[0058] Figure 8 A framework diagram of a dual redundant hot standby system provided as an example of the present invention. DETAILED DESCRIPTION

[0059] The technical solution of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] In the description of the present invention, it should be noted that the directions or positional relationships indicated by "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. are directions or positional relationships based on the drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In addition, the use of ordinal numbers (e.g., "first and second", "first to fourth", etc.) is to distinguish objects, and is not limited to this order, and cannot be understood as indicating or implying relative importance.

[0061] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, "installation", "connection" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0062] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0063] In one example, a dual-redundant hot backup method is applied to a first processor and a second processor. The two processors are preferably the same processor chip, and processor chips with similar performance can also be used. Embedded software runs on the two processors. According to the processor flag and the authority flag, the embedded software is divided into four working states, wherein the processor flag is used to distinguish different processors. In this example, the first processor is the host, and the second processor is the slave. The authority flag includes four working states: host authority state, host loss of authority state, standby authority state, and standby loss of authority state. After the embedded software on the processor is started, the processor flag is identified, and the change of the authority flag is monitored in real time. The corresponding working state is determined according to the processor flag and the authority flag, and the corresponding program is executed. At this time, only one software configuration item is used to cover all functional processes of the host and the standby before and after fault shedding, reducing the complexity of software maintenance. Figure 1 As shown, before the first processor cuts off the power (host power state), while completing its own functions, it sends a synchronization signal to the second processor, executes instruction forwarding and receiving, and has control over the outside; correspondingly, the second processor is in a power-losing state (standby power-losing state), and its actions are affected by the synchronization state of the first processor, and its pace is consistent with that of the first processor, and it has no control over the outside. After the first processor cuts off the power (host power-losing state), the embedded software stops running or enters a signal loop that does not execute the power-cutting, such as an infinite loop that does not execute the dog-feeding signal or an infinite loop that does not execute the heartbeat signal sending; correspondingly, after cutting off the power, it indicates that the first processor has failed and cannot operate normally. At this time, the second processor is in the power state (standby power state), degenerating into a single-machine model, and the action state of the second processor is not affected by the first processor, and it obtains control over the outside.

[0064] In this example, the method of the present invention works in the formal working mode. The formal working mode is used to execute formal work tasks after the controller product is released. In this mode, the normal operation of the controller is guaranteed by dual redundant hot backup. When the first processor fails, it can quickly switch to the second processor to meet higher real-time requirements. In the formal working mode, the first processor is in the power state and the second processor is in the powerless state. The first processor and the second processor perform parallel data processing, such as Figure 2 As shown, the method now includes:

[0065] The first processor performs the following sub-steps:

[0066] S11: Receive formal work instructions.

[0067] Among them, the formal work instruction is generally issued by the host computer. Before receiving the formal work instruction, determine whether the timer interrupt in the embedded software is triggered. If not, return to the step of determining whether the timer interrupt in the embedded software is triggered; if triggered, it means that the start time point of a new round of cycle control has been reached, that is, the timer interrupt is configured to provide the start signal of the cycle control. The cycle in this example is 5ms, and then determine whether the formal work instruction is received. If the formal work instruction is not received, perform power-on test and preparation stage functions, and return to the step of determining whether the timer interrupt is triggered; if the formal work instruction is received, start pre-work preparation.

[0068] S12: Receive first sampled data collected by the first data collection module and second sampled data collected by the second data collection module and forwarded by the second processor.

[0069] Before executing step S12, determine again whether the timer interrupt is triggered. If not, return to the step of determining again whether the timer interrupt is triggered; if triggered, execute step S12.

[0070] S12: Perform data processing and solving, execute corresponding control actions and output to corresponding execution devices (execution equipment), such as a robot for posture adjustment, and send synchronization status data to the second processor to ensure the consistency of the working status of the two machines. The synchronization status data includes step status data for executing each instruction (task), configuration status data, and data required by the second processor to execute a certain function but cannot be obtained due to limited permissions.

[0071] At the same time, the second processor performs the following sub-steps:

[0072] S21: Receive a formal work instruction forwarded by the first processor.

[0073] Before receiving the formal work instruction, determine whether the timer interrupt in the embedded software is triggered. If not, return to the step of determining whether the timer interrupt in the embedded software is triggered. If triggered, the time point for executing the next periodic task has arrived, and then determine whether it is the formal work instruction forwarded by the first processor. If no formal work instruction is received, perform the debugging mode stage or the preparation mode stage function, and return to the step of determining whether the timer interrupt is triggered. If a formal work instruction is received, start pre-work preparation.

[0074] S22: Receive the second sampling data collected by the second data collection module.

[0075] Before executing step S22, determine again whether the timer interrupt is triggered. If not, return to the step of determining again whether the timer interrupt is triggered; if triggered, execute step S22.

[0076] S23: Read the authority flag to determine whether to cut authority. If so, perform data processing and solution, execute corresponding control actions and output them to the corresponding execution device; if not, forward the second sampling data collected by the second data acquisition module to the first processor, and receive the synchronization status data of the first processor, continue data processing and solution, and execute corresponding control actions. At this time, the control action executed by the second processor is not output to the corresponding execution device, that is, the second processor also executes the data collection and solution process, but its solution result is not used as the basis for switching the task status, but is only used to follow the task status of the first processor, so that the second processor completely affects the action of the first processor, thereby ensuring that the working status of the two machines is consistent. When cutting authority, the second processor can more efficiently and conveniently take over the first processor to continue to complete subsequent work.

[0077] In step S23, the weight cut judgment further includes:

[0078] The rights management module receives the dog-feeding signal (or heartbeat signal) sent by the first processor. If the dog-feeding signal is not received within the dog-feeding period, it is determined that the first processor has failed and cannot work normally, and the rights cutting action is executed to enable the second processor to take over the first processor to continue to complete subsequent work.

[0079] Specifically, a certain GPIO port of the first processor is set as a dog feeding port, which is connected to the authority control module outside the first processor; the control cycle of the embedded software is 5ms, and the dog feeding cycle is set to 20ms; and a single pulse signal is set to be a dog feeding operation. In the program loop of each control cycle, the software sends pulse signals to the GPIO port multiple times to achieve the purpose of dog feeding. The authority control module in the controller monitors the dog feeding signal of the first processor. If the dog feeding cycle is exceeded and the dog feeding signal is not received, the authority control module determines that the first processor has a fault, executes the authority cutting action, and enables the second processor to take over the first processor and continue to complete subsequent work. This dog feeding method can meet the needs of independent operation of the controller, get rid of the dependence of embedded devices on other external devices, and meet the requirements of high real-time control.

[0080] In this example, the data acquisition module is redundant, that is, the second processor directly and independently uses the second sampling data without the need to synchronize the sampling data. Only the step status data of each instruction, the configuration status data, and the data that the second processor does not have the authority to obtain are synchronized. Especially when the amount of sampling data is large, the data synchronization rate can be improved, thereby improving the real-time performance of hot backup, and thus adapting to the needs of millisecond-level high-real-time application scenarios.

[0081] In one example, after the second processor receives the synchronization status data of the first processor, the method further includes:

[0082] The synchronization status data is compared with the corresponding data stored in the first processor. If the two states are consistent, no processing is performed. Otherwise, the synchronization status data is used for updating. This can minimize the synchronization workload and ensure the synchronization rate, so that the data of the first processor and the second processor are completely synchronized, so that the second processor can efficiently take over the first processor to complete subsequent work when power is cut.

[0083] Optionally, the step of comparing the synchronization status data with the corresponding data stored in the first processor and using the synchronization status data for updating can be implemented after the second processor performs data processing and solving and executes the corresponding control action. At this time, the reliability of data comparison is higher.

[0084] In one example, after the second processor executes the corresponding control action, it only performs storage operations without returning a response instruction to the first processor. At this time, the first processor does not need to wait for the second processor to execute the response, thereby reducing the waiting time of the first processor and improving the processing efficiency of the hot backup method to meet the application requirements of high real-time performance at the millisecond level.

[0085] In one example, when entering the formal working stage, the second processor sends the acquired second collected data to the first processor through the synchronous serial port every cycle, and the first processor judges the legality of the first sampling data and the second sampling data every cycle, and selects the data that meets the requirements as the input data for the solution, such as Figure 3 As shown, the first processor performs the legitimacy judgment including:

[0086] Determine whether the first sampling data meets the legality requirements. If so, use the first sampling data as input data. If not, determine whether the second sampling data meets the legality requirements. If so, use the second sampling data as input data. If not, use the historical data of the location collected by the same data acquisition module that meets the legality requirements in the previous cycle used by the first processor as input data.

[0087] Among them, the legality judgment includes integrity judgment, continuity judgment, etc. For numerical data, the sampled data can also be checked for thresholds, variances, etc. This example takes numerical data as an example, such as speed data. Meeting the legality requirements means that each collected data is within the specified threshold range and the sampled data is slightly oscillating.

[0088] Preferably, if Figure 3 As shown, before the first processor determines whether the first sampled data meets the legality requirement, it also includes:

[0089] Determine whether the number of times the first sampling data fails to meet the legality requirements reaches the upper limit of the cycle threshold, that is: set a cycle upper limit N for data anomalies. If all data of the first collected data fail to meet the requirements for N consecutive cycles, it is determined that the first data collection module has failed (is damaged), and the second sampling data is directly used in the subsequent process.

[0090] In this example, when the controller is not powered off, the data acquisition module is also redundantly backed up. The purpose is to make full use of the two sets of sampling data when the first processor is working normally to avoid abnormal solution and control results of the current cycle due to abnormality of the acquisition module in a certain cycle.

[0091] In one example, the method of the present invention is combined with the data acquisition redundancy example in the formal working mode. In this case, the method is implemented as follows:

[0092] For embedded software on the first processor:

[0093] a) Before the controller cuts off power, the first processor takes power and obtains two sets of data, the first collected data and the second collected data. After the legality is judged, they are used as input data for the algorithm module to solve. According to the solution results, the corresponding control actions and output data are executed; finally, the first processor sends the synchronization data of this cycle to the second processor to keep the state of the second processor consistent with that of the first processor.

[0094] b) When hardware or software anomalies occur in the controller, the authority management module executes a power-cut operation, after which the first processor is in a fault state and cannot operate normally.

[0095] For embedded software on the second processor:

[0096] a) Before the controller cuts off the power, the software on the second processor obtains the data of the second collected data, and sends the data of the second collected data to the first processor through the synchronous serial port between processors for the first processor to solve and use; the software on the second processor receives the synchronization instruction sent by the first processor through the synchronous serial port, and uses the synchronization state of the first processor as the judgment condition of its own action; the software on the second processor also performs the solution, but it is not used as the judgment basis for the execution of the action;

[0097] b) After the controller cuts off power, the second processor takes power. The software obtains the data of the second collected data, and after judging the legitimacy of the data, provides it to the algorithm module for solution. The corresponding control action is executed according to the solution result. The second processor no longer depends on the synchronization state of the first processor.

[0098] In order to ensure that in the formal working mode, after the controller cuts off power, the second processor can correctly connect to the state of the first processor to continue to complete the subsequent process, it is necessary to keep the operating states of the two processors consistent in real time, as follows:

[0099] 1) The synchronization between the two processors is performed once per cycle, using a 1MHz serial communication rate, and the size of the synchronization data is compressed within 60 bytes to ensure that the synchronization data of each cycle can be transmitted in time;

[0100] 2) The states that need to be synchronized include:

[0101] a) The step status of executing a task. For example, if a task needs to execute three steps A, B, and C, the step status of the first processor should be transmitted to the second processor so that the two processors can execute the same step almost synchronously.

[0102] b) Configuration status of a single machine or module, for example, if the first processor sets the power supply status of a single machine, the status must be transmitted to the second processor so that the two processors are consistent in the power supply status;

[0103] c) Data that the second processor needs to perform a certain function but cannot obtain due to limited permissions. In order to ensure that the second processor can successfully complete the task, the first processor needs to provide such data information to the second processor.

[0104] 3) After receiving the synchronization data sent by the first processor, the second processor compares it with its own current data: if the status is consistent, no processing is performed; otherwise, the synchronization status is used to update its own status, and the subsequent processes of the current cycle are executed according to the updated status; the second processor does not generate any status feedback and influence on the first processor, ensuring the first processor's dominant position in external control;

[0105] 4) If the second processor fails to receive a complete frame of synchronization data within a certain cycle, the second processor maintains the synchronization state of the previous cycle.

[0106] In one example, the method of the present invention works in a debugging mode, that is, it is used to test the first processor, the second processor and the embedded software on the two processors. At this time, the first processor or the second processor responds to the host computer control alone, and the corresponding timing diagram is as follows Figure 4 As shown, the method now includes the following steps:

[0107] The first processor is in power state and executes the following sub-steps:

[0108] S11': receiving remote control instructions from the host computer;

[0109] S12': executing the remote control command action, returning a response command to the upper computer, so that the upper computer determines that the first processor functions normally according to the response command;

[0110] S2': the first processor and the second processor receive a manual power-cutting instruction, and the first processor is in a power-losing state, that is, after receiving the manual power-cutting instruction, the first processor calls the active power-cutting function and enters an infinite loop without executing the dog-feeding function, the purpose of which is to avoid other influences on the second processor through the synchronous serial port between the processors. Correspondingly, the second processor is in a power-taking state, and the second processor executes the following sub-steps:

[0111] S31': receiving remote control instructions from the host computer;

[0112] S32': Execute the remote control command action, return a response command to the host computer, and then the host computer determines that the second processor functions normally according to the response command.

[0113] In one example, the method of the present invention works in a preparation mode, which is used to complete necessary configuration and preparation work after the controller product is released and before the formal task is executed, such as: system self-check, sampling data zero offset calibration, setting the working mode, starting or stopping the work, etc. The formal working mode is used to execute formal work tasks after the controller product is released, such as Figure 5 As shown, the method now includes the following steps:

[0114] S1": Hardware / software initialization, the first processor is in power, and the branch of the first processor is executed:

[0115] S11”: Determine whether the timer is triggered. If not, return to the step of determining whether the timer is triggered. If triggered, determine whether the remote control command of the host computer is received. If not, send synchronization status data to the second processor; if received, enter step S12”.

[0116] S12”: The first processor and the second processor respond to the host computer control at the same time. The corresponding timing diagram is as follows Figure 6 As shown, the first processor forwards the remote control instruction to the second processor via the synchronous serial port, executes the remote control instruction action, waits for the second processor to respond, integrates the dual-machine results and returns the response instruction to the upper computer; preferably, when the first processor waits for the second processor to return the result, a timeout should be set. If the second processor does not respond after the timeout, it chooses to resend the current instruction (the maximum number of retransmissions should be set) or return an exception code to the upper computer. Preferably, when the first processor returns the result to the upper computer, the processor flag is marked at an appropriate position in the instruction data field, such as at the beginning of the data, to distinguish which processor the current data belongs to.

[0117] S13”: Sending synchronization status data to the second processor, including step status data of executing each instruction, configuration status data, and data that the second processor is not authorized to obtain;

[0118] S2”: Hardware / software initialization, the second processor reads the authority flag, confirms that it is in the power-lost state, and executes the branch of the second processor:

[0119] S21": Determine whether the timer is triggered. If not, return to the step of determining whether the timer is triggered. If triggered, determine whether to cut off the authority. If not, the second processor can only obtain the remote control instruction from the host computer through the instruction forwarding function of the first processor. The second processor determines whether the remote control instruction forwarded by the first processor is received through the synchronous serial port. If received, execute the remote control instruction action, respond to the first processor (return the execution result to the first processor through the synchronous serial port), and receive the synchronization status data of the first processor; if not received, receive the synchronization status data of the first processor; if the authority is cut, the second processor does not receive the dog feeding signal within the dog feeding cycle, determines that the first processor fails, and the first processor cannot work normally. The second processor receives the remote control instruction sent by the host computer through the serial port, executes the remote control instruction action, and returns a response instruction to the host computer through the serial port, that is, returns the execution result to the host computer.

[0120] Combined with the above examples, it can be seen that the method of the present invention can work in debugging mode, preparation mode or formal working mode. According to the processor flag and the authority flag, such as Figure 7 As shown, the embedded software is divided into four working states: the first processor is in power, the first processor is out of power, the second processor is in power, and the second processor is out of power; the functions are divided into five major components according to the above four working states: a general functional component, a dual-machine communication component, a first processor in power component, a first processor out of power component, a second processor in power component, and a second processor out of power component.

[0121] After the software is started, the processor flag recorded in the FLASH in advance is used to identify whether the current software is running on the first processor or the second processor; during the software operation, the change of the authority flag is periodically monitored; the software determines the corresponding working state according to the two flags and executes the program of the corresponding component; for example, for the system self-check function, when the controller is not faulty and the authority is cut off, the first processor function is composed of a general function component, a dual-machine communication component, and a first processor authority component; the second processor function is composed of a general function component, a dual-machine communication component, and a second processor authority-losing component; when the controller fails and the authority is cut off, the self-check function is only completed by the second processor, which is composed of a general function component and a second processor authority component.

[0122] The present invention also includes a dual redundant hot standby system, such as Figure 8As shown, the system includes a first data acquisition module, a second data acquisition module, a first processor, and a second processor. The first data acquisition module is connected to the first processor, and the second data acquisition module is connected to the second processor. The two processors have their own SRAM and FLASH memories. The first processor and the second processor communicate synchronously through a high-speed synchronous serial port. Among them, the first data acquisition module is used to collect the first sampling data, and the second data acquisition module is used to collect the second sampling data. The sampling data is obtained for the software execution stage on the processor. The sampling data can be industrial monitoring data, such as rotation speed, pressure, etc., or it can be posture control data, such as speed and direction.

[0123] Further, the first processor is used to receive the formal work order and perform the following sub-steps:

[0124] Receive the first sampling data collected by the first data acquisition module and the second sampling data collected by the second data acquisition module forwarded by the second processor; perform data processing and solution, execute the corresponding control action and output it to the corresponding execution device, and send synchronization status data to the second processor, including step status data of executing each instruction, configuration status data, and data that the second processor has no authority to obtain.

[0125] Further, the second processor is used to receive the formal work instruction forwarded by the first processor, and perform the following sub-steps:

[0126] Receive the second sampling data collected by the second data acquisition module; read the authority flag to determine whether to cut off the authority. If so, perform data processing and solution, execute the corresponding control action and output it to the corresponding execution device; if not, forward the second sampling data collected by the second data acquisition module to the first processor, receive the synchronization status data of the first processor, then perform data processing and solution, and execute the corresponding control action. The control action executed by the second processor is not output to the corresponding execution device.

[0127] In one example, the system further includes a host computer, which is connected to the first processor and the second processor via the authority control module. The host computer here can be an industrial computer or other stand-alone computer. The authority control module monitors the dog feeding signal of the first processor. If the dog feeding cycle is exceeded and the dog feeding signal is not received, it is determined that the first processor has failed, and the authority cutting action is executed. The second processor takes over the first processor and continues to complete subsequent work. This dog feeding method can meet the needs of independent operation of the controller, get rid of the dependence of the embedded device on other external devices, and meet the high real-time control requirements.

[0128] The controller communicates with other stand-alone modules in the outside world through the serial port and CAN bus, and outputs data or control signals to the outside world. After the controller is powered on, the first processor takes power and grants the first processor absolute external control authority; the second processor unconditionally follows the first processor to perform corresponding actions or task state switching, and the second processor will not affect the action of the first processor. This solution is suitable for control systems with high real-time requirements, ensuring the consistency of important data and status of the two machines, so that after the fault is cut off, the second processor can normally and efficiently take over the tasks of the first processor and execute them correctly, thereby ensuring the real-time processing of dual redundant hot backup.

[0129] The above specific implementation methods are detailed descriptions of the present invention. It cannot be determined that the specific implementation methods of the present invention are limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions and substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A dual redundant hot backup method, characterized in that: The first processor is in a privileged state and the second processor is in a privileged state, comprising the following steps: The first processor receives the formal work order and performs the following sub-steps: Receive first sampled data collected by the first data collection module and second sampled data collected by the second data collection module forwarded by the second processor; Perform data processing and solving, execute corresponding control actions and output to corresponding execution devices, and send synchronization status data to the second processor, including step status data of executing each instruction, configuration status data, and data that the second processor has no authority to obtain; The second processor receives the formal work order forwarded by the first processor and performs the following sub-steps: Receiving second sampled data collected by a second data collection module; Read the authority flag to determine whether to cut off the authority. If so, perform data processing and solution, execute the corresponding control action and output it to the corresponding execution device; if not, forward the second sampling data collected by the second data acquisition module to the first processor, receive the synchronization status data of the first processor, then perform data processing and solution, and execute the corresponding control action. The control action executed by the second processor is not output to the corresponding execution device.

2. The dual redundant hot backup method according to claim 1, characterized in that: The judgment on cutting rights also includes: The rights management module receives the dog feeding signal sent by the first processor. If the dog feeding cycle is exceeded and no dog feeding signal is received, it is determined that the first processor fails, and the rights are cut off. The second processor takes over the first processor to complete subsequent work.

3. The dual redundant hot backup method according to claim 1, characterized in that: After the second processor receives the synchronization status data of the first processor, the method further includes: The synchronization state data is compared with the corresponding data stored in the first processor. If the states of the two are consistent, no processing is performed. Otherwise, the synchronization state data is used for updating.

4. The dual redundant hot backup method according to claim 1, characterized in that: After the second processor executes the corresponding control action, it only stores it and does not execute the return response.

5. The dual redundant hot backup method according to claim 1, characterized in that: After the first processor receives the first sampling data and the second sampling data, it determines whether the first sampling data meets the legality requirements. If so, the first sampling data is adopted. If not, it determines whether the second sampling data meets the legality requirements. If so, the second sampling data is adopted. If not, the historical data that meets the legality requirements in the previous cycle used by the first processor is adopted.

6. The dual redundant hot backup method according to claim 5, characterized in that: The first processor determines whether the number of times that the first sampling data fails to meet the legality requirement reaches an upper limit of a period threshold. If so, it is determined that a failure occurs in the first data acquisition module, and the second sampling data is directly used.

7. The dual redundant hot standby method according to claim 1, characterized in that: The first processor and the second processor are in debugging mode, comprising the following steps: The first processor is in power state and executes the following sub-steps: Receive remote control instructions from the host computer; Execute the remote control command action, return a response command to the upper computer, and then the upper computer determines that the first processor functions normally according to the response command; The first processor and the second processor receive a manual power-cutting instruction, the first processor is in a power-losing state, the second processor is in a power-taking state, and the second processor executes the following sub-steps: Receive remote control instructions from the host computer; The remote control command action is executed, and a response command is returned to the upper computer, so that the upper computer determines that the second processor functions normally according to the response command.

8. The dual redundant hot standby method according to claim 1, characterized in that: The first processor and the second processor are in a preparation mode, comprising the following steps: The first processor is in power state and executes the following sub-steps: The first processor receives the remote control instruction from the host computer; Forward the remote control command to the second processor, execute the remote control command action, wait for the second processor to respond, integrate the results of the two machines and return the response command to the upper computer; Sending synchronization status data to the second processor, including step status data of executing each instruction, configuration status data, and data that the second processor is not authorized to obtain; The second processor reads the authority flag, confirms that it is in the authority-losing state, and executes the following sub-steps: Determine whether to cut off the authority. If not, determine whether the remote control instruction forwarded by the first processor is received. If received, execute the remote control instruction action, respond to the first processor, and receive the synchronization status data of the first processor; if not received, receive the synchronization status data of the first processor; if the authority is cut off, receive the remote control instruction sent by the host computer, execute the remote control instruction action, and return the response instruction to the host computer.

9. A dual redundant hot standby system, characterized in that: The system comprises a first data acquisition module, a second data acquisition module, a first processor and a second processor, wherein the first data acquisition module is connected to the first processor, the second data acquisition module is connected to the second processor, and the first processor and the second processor are connected in a bidirectional communication manner; The first data acquisition module is used to acquire first sampling data; The second data acquisition module is used to collect second sampling data; The first processor is used to receive the formal work order and perform the following sub-steps: Receive the first sampled data collected by the first data acquisition module and the second sampled data collected by the second data acquisition module forwarded by the second processor; perform data processing and solving, execute the corresponding control action and output it to the corresponding execution device, and send synchronization status data to the second processor, including the step status data of executing each instruction, the configuration status data, and the data that the second processor has no authority to obtain; The second processor is used to receive the formal work instruction forwarded by the first processor, and perform the following sub-steps: Receive the second sampling data collected by the second data acquisition module; read the authority flag to determine whether to cut off the authority. If so, perform data processing and solution, execute the corresponding control action and output it to the corresponding execution device; if not, forward the second sampling data collected by the second data acquisition module to the first processor, receive the synchronization status data of the first processor, then perform data processing and solution, and execute the corresponding control action. The control action executed by the second processor is not output to the corresponding execution device.

10. The dual redundant hot standby system according to claim 9, characterized in that: The system also includes a host computer, which is connected to the first processor and the second processor via the authority control module.

Images