Vehicle-mounted platform hot standby redundancy method and system, electronic equipment and storable medium

Abstract

The invention relates to a vehicle-mounted platform hot standby redundancy method and system, electronic equipment and a storable medium, and the method comprises the following steps: an MPB reads a configuration file from a flash, and divides the MPB into an output state MPBActive or a maintenance state MPBStandby and a leader MPBleader or a follower MPBFollower according to the number and the group number of the MPB and the current main standby state and subordinate state; when a fault occurs, switching is carried out, and the MPBActive or the MPBleader is selected again; the system, the electronic equipment and the storable medium realize the method. According to the serial number, the group number, the current master / standby state and the current slave state, the MPB is divided into an MPB Active or an MPB Standby and an MPB Leader or an MPB Follower, so that the uniqueness of output and clock synchronization are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of hot standby redundancy, and in particular to a method and system for hot standby redundancy of a vehicle-mounted platform, an electronic device, and a storage medium. Background Art

[0002] With the development of technology, the automation level of rail transit systems has also been increasing day by day. For vehicle-mounted platforms, train control systems with different automation levels are to run different application programs on the vehicle-mounted platforms.

[0003] The invention patent with the publication number of CN117785568B discloses a dual-master and dual-slave hot standby method and device. By detecting the fault status of all master nodes in real time, the faults of the master nodes can be detected in time and fault switching can be performed. When a master node fails, it is switched to a standby node, thus ensuring the continuous availability of the system; this patent confirms the fault type through a preset detection script and solves the fault, and cannot perform master-slave switching or slave switching immediately when a fault occurs and output data externally, and maintain the consistency of data and clock.

[0004] Therefore, providing a hot standby redundancy method that can self-elect an MPU for external output and keep data and clock consistent is a problem that needs to be solved currently. Summary of the Invention

[0005] The purpose of the present invention is to provide a method and system for hot standby redundancy of a vehicle-mounted platform, an electronic device, and a storage medium to overcome the deficiencies of the above-mentioned existing technologies.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] According to the first aspect of the present invention, a method for hot standby redundancy of a vehicle-mounted platform is provided. This method is used for the election of multiple MPBs. According to the types of applications running on the vehicle-mounted platform, the MPBs are divided into multiple groups, and the same type of application runs on the MPBs in each group. The method includes the following steps:

[0008] S1. The MPB reads the configuration file from the flash to obtain its own number and group number;

[0009] S2. The MPB broadcasts its own number and group number, as well as the current master-slave status and subordinate status, through the heartbeat HB message at the first preset time T HB for broadcasting;

[0010] S3. After multiple first preset times T HBAfter that, according to the numbers, group numbers, and primary / standby statuses of other MPBs in the group in the received HB message, the MPB divides the MPBs into output state MPB_Active or standby state MPB_Standby. If it is MPB_Active, it outputs externally; if it is MPB_Standby, it remains silent.

[0011] S4. The MPB divides the MPBs into sender MPB_leader or receiver MPB_Follower according to the numbers and subordinate statuses of other MPBs in the received HB message. If it is MPB_leader, it sends clock synchronization information; if it is MPB_Follower, it receives clock synchronization information and synchronizes.

[0012] S5. When the MPB_Active or MPB_leader fails, a switch is made to re-elect the MPB_Active or MPB_leader.

[0013] As a preferred technical solution, communication between the multiple MPBs is carried out in the form of dual media.

[0014] As a preferred technical solution, S3 specifically includes:

[0015] S31. In the same group, if an MPB does not receive the HB message sent by other MPBs, the MPB is set to MPB_Active.

[0016] S32. In the same group, if an MPB receives the HB message sent by MPB_Active, the MPB is set to MPB_Standby.

[0017] S33. In the same group, if an MPB has not received the HB message sent by MPB_Active, then compare the numbers of the MPBs to determine whether the MPB is MPB_Active or MPB_Standby.

[0018] As a preferred technical solution, S33 specifically includes:

[0019] S331. The number of the MPB is M i , compare with the numbers of all other MPBs in the group included in the HB messages received by the MPB and obtain the smallest number M min ;

[0020] S332. If M min is greater than M i , the MPB is set to MPB_Active; if M min is less than M i , the MPB is set to MPB_Standby.

[0021] As a preferred technical solution, S4 specifically includes:

[0022] S41. If the MPB does not receive the HB message sent by other MPBs, the MPB is set as MPB_leader;

[0023] S42. If the MPB receives the HB message sent by another MPB that is MPB_leader, the MPB is set as MPB_Follower;

[0024] S43. If the MPB has not received the HB message sent by MPB_leader, then judge the number size of the MPB to determine it as MPB_leader or MPB_Follower.

[0025] As a preferred technical solution, S43 specifically includes:

[0026] S431. The MPB number is M i , compare the numbers according to the MPB numbers included in the HB messages received from all other MPBs and obtain the maximum number as M max ;

[0027] S432. If M max is less than M i , the MPB is set as MPB_leader; if M max is greater than M i , the MPB is set as MPB_Follower.

[0028] As a preferred technical solution, the specific switching of MPB_Active in S5 includes:

[0029] S511. All MPBs calculate the cyclic redundancy check CRC of the output data per cycle, and MPB_Active sends the CRC of this board to MPB_Standby in the group through the output check Output_Check message.

[0030] S512. In the same group, judge whether MPB_Standby receives the Output_Check message sent by MPB_Active. If received, check the CRCs of both sides. If they are consistent, continue to maintain; if they are inconsistent, enter the safe side;

[0031] S513. If not received, use the MPB_Standby with the smallest number still running as MPB_Active;

[0032] S514. Whether MPB_Standby is switched to MPB_Active or not, as long as it has not received an Output_Check message in this cycle, and receives any message from the original MPB_Active at any time later, then this MPB_Active enters the secure side.

[0033] As a preferred technical solution, the switching of MPB_Leader in S5 specifically includes:

[0034] S521. The MPB_Leader broadcasts a Clock message to other MPB_Followers. The clock Clock message includes the start time T of the MPB_Leader in this cycle. L ;

[0035] S522. The start time T of the MPB_Follower F is respectively subtracted from the start time T of the MPB_Leader L to obtain a difference value T. I The difference value T I is broadcast through an election Vote message.

[0036] S523. Sort the difference values T of all MPBs I and select the MPB_Follower to which the median belongs as the new MPB_Leader.

[0037] S524. All MPB_Followers need to send an acknowledgment ACK message to the newly elected leader they have elected for confirmation.

[0038] S525. The MPB_Leader that has received confirmations from more than half of the MPB_Followers can officially become the new MPB_Leader; otherwise, it remains an MPB_Follower.

[0039] According to the second aspect of the present invention, there is provided a system for a vehicle-mounted platform hot standby redundancy method, including a control module, and the control module implements the vehicle-mounted platform hot standby redundancy method as described in any one of the above.

[0040] According to the third aspect of the present invention, there is provided an electronic device, including a memory and a processor. A computer program is stored on the memory, and when the processor executes the program, it implements the method as described in any one of the above.

[0041] According to the fourth aspect of the present invention, there is provided a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements the method as described in any one of the above.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. According to the number, group number, and current primary / backup status and subordinate status, the present invention divides the MPBs into MPB_Active or MPB_Standby and MPB_Leader or MPB_Follower, ensuring that only the MPB with the MPB_Active status can output externally, while the MPB with the MPB_Standby status remains silent. Only one MPB_Leader sends the clock signal, and the MPB_Follower receives the clock signal and synchronizes. The Leader and Active can be different MPBs, avoiding the system burden caused by simultaneous switching.

[0044] 2. Whether it is the switching of MPB_Active or MPB_Leader, the present invention can be completed within one platform cycle without affecting the input and output processing of platform data. At the same time, the dynamic switching based on real-time messages makes this solution not limit the set number of applications and redundant boards, and has good scalability.

[0045] 3. By calculating and sorting the cycle deviation from the original MPB_Leader, the selected new MPB_Leader has the overall smallest cycle deviation from other MPB_Followers. At the same time, the switching of the MPB_Leader requires secondary confirmation to avoid the situation of multiple MPB_Leaders due to network fluctuations.

[0046] 4. The number and group number of the present invention are unique, avoiding inaccurate judgment conditions and affecting the final output result caused by non-unique numbers and group numbers during MPB election.

[0047] 5. The present invention introduces a dual-media channel within the MPB group running the same application to transmit key messages, preventing incorrect switching of the primary / backup status due to network packet loss. At the same time, the MPBs within the group need to exchange the CRC of the output data to ensure data consistency of the hot standby MPB and improve the reliability of the platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 is a schematic flow diagram of the MPB election process of the present invention;

[0049] Figure 2 is a practical flowchart of the MPB_Active switching process of the present invention;

[0050] Figure 3 is a practical flowchart of the MPB_Leader switching process of the present invention;

[0051] Figure 4This is the overall structural schematic diagram of the system of the present invention. Detailed implementation manners

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without making creative efforts shall fall within the protection scope of the present invention.

[0053] With the development of technology, the automation level of rail transit systems is also increasing day by day. For on-vehicle platforms, train control systems with different automation levels are to run different application programs on the on-vehicle platforms. Therefore, designing a hot standby redundancy solution for on-vehicle platforms that supports multiple applications can provide different driving modes with different automation levels for trains to cope with various operation scenarios.

[0054] The technical concept of the present invention is as follows: The on-vehicle platform divides the application programs running in the Main Processing Board (MPB) into different redundancy groups according to the types of the application programs. After the on-vehicle platform is powered on, each MPB obtains key information through the interactive HB message to establish its own primary / backup and subordinate states. When the on-vehicle platform is in the running state, each MPB determines the running states of other MPBs through the HB message, determines the conditions for primary / backup switching through the Output_Check message, and determines the conditions for subordinate switching through the Clock message. When the primary MPB responsible for data input / output processing or clock synchronization fails and shuts down, the on-vehicle platform can immediately perform primary / backup switching or subordinate switching, enabling the MPB in the hot standby mode to replace the downed MPB to work and maintaining the consistency of data and clocks.

[0055] The present invention provides a method and system for hot standby redundancy of a vehicle-mounted platform, an electronic device, and a storage medium; according to the number, group number, and current primary / standby status and subordinate status, the MPBs are divided into MPB_Active or MPB_Standby and MPB_Leader or MPB_Follower, ensuring that only the MPB with the MPB_Active status can output externally, while the MPB with the MPB_Standby status remains silent. Only one MPB_Leader sends clock signals, and the MPB_Follower receives the clock signals and synchronizes. The Leader and Active can be different MPBs, avoiding the system burden caused by simultaneous switching. Whether it is the switching of MPB_Active or MPB_Leader, the present invention can complete it within one platform cycle without affecting the input and output processing of platform data; at the same time, the dynamic switching based on real-time messages makes this solution not limit the set number of applications and redundant boards, and has good scalability. By calculating and sorting the cycle deviation from the original MPB_Leader, the selected new MPB_Leader has the overall smallest cycle deviation from other MPB_Followers. At the same time, the switching of the MPB_Leader requires secondary confirmation to avoid the situation of multiple MPB_Leaders due to network fluctuations. The numbers and group numbers of the present invention are unique, avoiding inaccurate judgment conditions and affecting the final output results due to non-unique numbers and group numbers during MPB election. The present invention introduces a dual-media channel within the MPB group running the same application to transmit key messages, preventing incorrect switching of the primary / standby status due to network packet loss. At the same time, the MPBs within the group need to exchange the CRC of the output data to ensure the data consistency of the hot standby MPB and improve the reliability of the platform.

[0056] Embodiment 1

[0057] As Figures 1-3 shown, a method for hot standby redundancy of a vehicle-mounted platform, which is used for the election of multiple MPBs. According to the types of applications running in the vehicle-mounted platform, the MPBs are divided into multiple groups, and the same type of application is run on the MPBs in each group. The method includes the following steps:

[0058] S1. The MPB reads the configuration file from the flash to obtain its own number and group number;

[0059] S2. The MPB broadcasts its own number, group number, and current primary / standby status and subordinate status through the heartbeat HB message at the first preset time T HB for broadcasting;

[0060] S3. After multiple first preset times T HBAfter that, according to the numbers, group numbers, and primary / standby statuses of other MPBs in the group in the received HB message, the MPB divides the MPBs into output state MPB_Active or hold state MPB_Standby. If it is MPB_Active, it outputs externally; if it is MPB_Standby, it remains silent.

[0061] S4. The MPB divides the MPBs into sender MPB_leader or receiver MPB_Follower according to the numbers and subordinate statuses of other MPBs in the received HB message. If it is MPB_leader, it sends clock synchronization information; if it is MPB_Follower, it receives the clock synchronization information and synchronizes.

[0062] S5. When a failure occurs to MPB_Active or MPB_leader, a switchover is performed to re-elect MPB_Active or MPB_leader.

[0063] Communication is carried out among the multiple MPBs in a dual-media form.

[0064] Specifically, S3 includes:

[0065] S31. Within the same group, if an MPB does not receive an HB message sent by other MPBs, the MPB is set to MPB_Active.

[0066] S32. Within the same group, if an MPB receives an HB message sent by MPB_Active, the MPB is set to MPB_Standby.

[0067] S33. Within the same group, if an MPB has not received an HB message sent by MPB_Active, the numbers of the MPBs are compared to determine whether the MPB is MPB_Active or MPB_Standby.

[0068] Specifically, S33 includes:

[0069] S331. The number of the MPB is M i , and by comparing with the numbers of all other MPBs in the group included in the received HB messages of other MPBs, the smallest number is obtained as M min ;

[0070] S332. If M min is greater than M i , the MPB is set to MPB_Active; if M min is less than M i , the MPB is set to MPB_Standby.

[0071] In this embodiment, specifically, the MPBs are divided into two groups, and each group of MPBs is installed with ATP or ATO applications. Multiple groups can also be set up to install different applications respectively. The master-slave status includes two states: Active and Standby. When the MPB is Active, the MPB is MPB_Active; when the MPB is Standby, the MPB is MPB_Standby. The subordinate status includes two states: Leader and Follower. When the MPB is Leader, the MPB is MPB_leader; when the MPB is Follower, the MPB is MPB_Follower.

[0072] The election of MPB_Active in the initialization stage is specifically as follows:

[0073] All MPBs in the vehicle platform will first read the configuration file from the flash to obtain the numbers {M1, M2... Mx} and group numbers {G1, G2... Gy} of each MPB.

[0074] The MPB broadcasts its own number, group number, master-slave status, and subordinate status (both the master-slave and subordinate status are Unknown after power-on) through the HB message at a fixed first preset time T HB interval outward.

[0075] After a time of N*T HB the MPB numbered M i establishes its own master-slave status according to the following rules:

[0076] ① If no HB message within the group is received, set its own status to Active.

[0077] ② If an HB message with the master-slave status of Active within the group is received, then set its own master-slave status to Standby.

[0078] ③ If the master-slave status in the received HB messages within the group is all Standby or Unknown, and the smallest number M min >M i , then set its own status to Active. If M min <M i , then set its own status to Standby.

[0079] The specific steps of S4 include:

[0080] S41. If the MPB does not receive the HB message sent by other MPBs, the MPB is set to MPB_leader;

[0081] S42. If the MPB receives an HB message sent by another MPB that is the MPB_leader, the MPB is set to MPB_Follower;

[0082] S43. If the MPB has not received an HB message sent by the MPB_leader, then compare the MPB numbers to determine whether it is MPB_leader or MPB_Follower.

[0083] The specific steps of S43 are as follows:

[0084] S431. The MPB number is M i , compare the numbers based on the MPB numbers included in the HB messages received from all other MPBs, and the maximum number obtained is M max ;

[0085] S432. If M max is less than M i , the MPB is set to MPB_leader; if M max is greater than M i , the MPB is set to MPB_Follower.

[0086] In this embodiment, the subordinate state is determined according to the following rules:

[0087] ① If no HB message is received, set its own state to Leader.

[0088] ② If an HB message with a subordinate state of Leader is received, set its own master / backup state to Follower.

[0089] ③ If all the received HB messages have subordinate states of Follower or Unknown, and the maximum number M max < M i , then set its own state to Leader. If M max > M i , then set its own state to Follower.

[0090] The specific steps of the MPB_Active switch in S5 are as follows:

[0091] S511. All MPBs calculate the cyclic redundancy check CRC of the output data every cycle, and the MPB_Active sends the CRC of its own board to the MPB_Standby in the group through the output check Output_Check message.

[0092] S512. Within the same group, determine whether MPB_Standby receives the Output_Check message sent by MPB_Active. If received, perform CRC verification on both sides. If they are consistent, continue to maintain the status. If they are inconsistent, enter the secure side.

[0093] S513. If not received, use the MPB_Standby with the smallest running number as MPB_Active.

[0094] S514. Regardless of whether MPB_Standby switches to MPB_Active, as long as it has not received the Output_Check message in the current cycle and receives any message from the original MPB_Active at any time later, then that MPB_Active enters the secure side.

[0095] In this embodiment, MPB updates the running status of other MPBs in the group according to the HB message. At the same time, all MPBs calculate the CRC of the output data of their own boards. MPB_Active needs to send the CRC to MPB_Standby through the Output_Check message.

[0096] MPB_Standby performs master-slave switching according to whether it receives the Output_Check message for output check from MPB_Active in the current cycle. If it does not receive the Output_Check, perform switching judgment. Otherwise, perform CRC verification. If it is consistent with the output CRC of MPB_Active, maintain the standby state. If it is inconsistent, enter the secure state and end.

[0097] Select the MPB with the smallest number among the still-running MPBs in the group as MPB_Active.

[0098] If MPB_Standby switches to MPB_Active and receives any message from the original MPB_Active at any time later, then that MPB enters the secure side.

[0099] The switching of MPB_Leader in S5 specifically includes:

[0100] S521. MPB_Leader broadcasts the Clock message to other MPB_Followers. The clock Clock message includes the start time T of MPB_Leader in the current cycle L ;

[0101] S522. The start time T of the MPB_Follower F is respectively subtracted from the start time T of MPB_Leader L to obtain the difference value TI , broadcast the difference value T I through the election Vote message;

[0102] S523. Sort the difference values T of all MPBs I , and select the MPB_Follower to which the median belongs as the new MPB_Leader;

[0103] S524. All MPB_Followers need to send an acknowledgment ACK message to the newly elected leader they selected for confirmation;

[0104] S525. The MPB_Leader that receives confirmations from more than half of the MPB_Followers can officially become the new MPB_Leader, otherwise it remains an MPB_Follower.

[0105] In this embodiment, the MPB_Leader is responsible for providing the clock source for the entire vehicle-mounted platform. At the beginning of each cycle during the running phase, the MPB_Leader will broadcast a clock Clock message to other MPBs, which contains the start time T of this cycle of the MPB_Leader L . When an MPB_Follower does not receive the Clock message from the Leader in this cycle, a new leader election will start.

[0106] The MPB_Follower subtracts its own cycle start time T F from T L to get the difference value T I and broadcasts it through the VOTE message.

[0107] All MPB_Followers sort T I , and select the MPB_Follower to which the median belongs as the new MPB_Leader.

[0108] All MPB_Followers need to send an ACK message to the newly elected leader they selected for confirmation.

[0109] The leader that receives confirmations from more than half of the Followers can officially become the new MPB_Leader, otherwise it will still set its own status as a Follower.

[0110] Embodiment 2

[0111] As Figure 4 shown, a system for a method of hot standby redundancy for a vehicle-mounted platform includes a control module, and the control module implements the method of hot standby redundancy for a vehicle-mounted platform as described in any one of the above.

[0112] In this embodiment, in a vehicle-mounted platform, MPBs running the same application program form a redundant group (hot standby with two machines means there are two MPBs in a group). Within the same group, the input data received by each MPB is the same, but only one MPB undertakes the actual data output function to the outside. This MPB for controlling output is the main MPB (MPB_Active), and the other MPBs are standby MPBs (MPB_Standby).

[0113] Since vehicle-mounted applications are often executed periodically and each application is not completely independent during operation (for example, ATO needs ATP to provide the train braking curve), one MPB is required as the only clock source between different groups. This MPB for controlling clock synchronization is called MPB_Leader, and the remaining MPBs are MPB_Followers.

[0114] The communication between MPBs adopts a dual-medium form: on the basis that all MPBs are mounted on the TSN bus, the MPBs belonging to the same group are connected by ETH Ethernet to ensure the transmission of key data. During the operation stage, MPB_Leader broadcasts a Clock message through TSN at the beginning of each cycle (unit: ms), and MPB_Leader adjusts the clock according to the Clock message. Then all MPBs start to process application data, calculate the CRC of their respective output data, and MPB_Active fills the CRC into the Output_Check message and sends it to the MPB_Standby in the group through the dual medium. MPB_Standby needs to compare the output CRC of this MPB with the received CRC to determine whether MPB_Standby is eligible for hot standby. If they are inconsistent, it enters the safe side (shuts down). Finally, the MPBs in the operation stage still need to broadcast an HB message through the dual medium at the end of the cycle, and each MPB updates the operation status of other MPBs in the vehicle-mounted platform through this message.

[0115] Embodiment 3

[0116] An electronic device includes a memory and a processor, and a computer program is stored on the memory. It is characterized in that when the processor executes the program, the method described in any one of the above is implemented.

[0117] A computer-readable storage medium stores a computer program. It is characterized in that when the program is executed by a processor, the method described in any one of the above is implemented.

[0118] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the foregoing method embodiments and will not be elaborated herein.

[0119] The electronic device of the present invention includes a central processing unit (CPU), which can execute various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or computer program instructions loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0120] Multiple components in the device are connected to the I / O interface, including: an input unit, such as a keyboard, mouse, etc.; an output unit, such as various types of displays, speakers, etc.; a storage unit, such as a magnetic disk, optical disc, etc.; and a communication unit, such as a network card, modem, wireless communication transceiver, etc. The communication unit allows the device to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks. The processing unit executes the various methods and processes described above, such as the method of the present invention. For example, in some embodiments, the method of the present invention can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device via the ROM and / or the communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of the method of the present invention described above can be executed. Alternatively, in other embodiments, the CPU can be configured to execute the method of the present invention by any other appropriate means (e.g., by means of firmware).

[0121] The functions described above herein can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that can be used include: field programmable gate arrays (FPGA), application specific integrated circuits (ASIC), application specific standard products (ASSP), system on a chip (SOC), complex programmable logic devices (CPLD), and so on.

[0122] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the program code is executed by the processor or controller, the functions / operations specified in the flowchart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, executed partially on the machine as an independent software package and partially on a remote machine, or executed entirely on a remote machine or server.

[0123] In the context of the present invention, a machine-readable medium may be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0124] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for hot standby redundancy of an on-vehicle platform, the method is used for selecting multiple MPBs, the MPBs are divided into multiple groups according to the types of applications running in the on-vehicle platform, and the same type of applications run on the MPBs in each group, characterized in that: The method comprises the following steps: S1, the MPB reads the configuration file from the flash and obtains the respective number and group number; S2, the MPB sends its own number and group number as well as the current master / slave state and slave state via a heartbeat HB message for a first preset time T HB to broadcast; S3, after a plurality of first preset times T HB Afterwards, the MPB divides the MPB into an output state MPB_Active or a holding state MPB_Standby according to the numbers of other MPBs in the group, the group number and the active / standby state in the received HB message. If it is MPB_Active, it outputs externally, and if it is MPB_Standby, it remains silent; S4, the MPB divides the MPB into a sender MPB_leader or a receiver MPB_Follower according to the numbers and subordinate states of other MPBs in the received HB message, and if it is an MPB_leader, it sends clock synchronization information, and if it is an MPB_Follower, it receives the clock synchronization information and synchronizes; S5. When the MPB_Active or MPB_leader fails, switching is performed and the MPB_Active or MPB_leader is re-elected.

2. The method for hot standby redundancy of a vehicle-mounted platform according to claim 1, characterized in that: The multiple MPBs communicate with each other in the form of dual media.

3. The method for hot standby redundancy of a vehicle-mounted platform according to claim 1, characterized in that: The S3 specifically includes: S31. In the same group, if the MPB does not receive the HB message sent by other MPBs, the MPB is set to MPB_Active; S32. In the same group, if MPB receives the HB message sent by MPB_Active, MPB is set to MPB_Standby; S33. In the same group, if the MPB has not received the HB message sent by MPB_Active, the MPB number is determined to determine whether the MPB is MPB_Active or MPB_Standby.

4. The method for hot standby redundancy of a vehicle-mounted platform according to claim 3, characterized in that: The S33 specifically includes: S331, the MPB number is M i , compare the other MPB numbers contained in the HB messages received from all other MPBs in the group and find the smallest number is M min ; S332, if M min Greater than M i , the MPB is set to MPB_Active; if M min Less than M i , the MPB is set to MPB_Standby.

5. The method for hot standby redundancy of a vehicle-mounted platform according to claim 1, characterized in that: The S4 specifically includes: S41. If the MPB does not receive the HB message sent by other MPBs, the MPB is set to MPB_leader; S42. If the MPB receives a HB message sent by another MPB that is the MPB_leader, the MPB is set to be the MPB_Follower. S43. If the MPB has not received the HB message sent by the MPB_leader, the MPB determines the number of the MPB and determines whether it is the MPB_leader or the MPB_Follower.

6. The method for hot standby redundancy of a vehicle-mounted platform according to claim 5, characterized in that: The S43 specifically includes: S431, the MPB number is M i , according to the MPB numbers contained in the HB messages received from all other MPBs, the numbers are compared and the maximum number is M max ; S432, if M max Less than M i , the MPB is set to MPB_leader; if M max Greater than M i , the MPB is set to MPB_Follower.

7. The method for hot standby redundancy of a vehicle-mounted platform according to claim 1, characterized in that: The switching of MPB_Active in S5 specifically includes: S511. All MPBs calculate the cyclic redundancy check (CRC) of the output data every cycle, and the MPB_Active sends the CRC of the board to the MPB_Standby in the group through the output check Output_Check message. S512, in the same group, determine whether MPB_Standby receives the Output_Check message sent by MPB_Active, if received, check the CRC of both parties, if they are consistent, continue to maintain, otherwise enter the safety side; S513, if not received, the MPB_Standby with the smallest number that is still running is used as MPB_Active; S514. Regardless of whether MPB_Standby is switched to MPB_Active, as long as it has not received an Output_Check message in this cycle, if it receives any message from the original MPB_Active at any time thereafter, the MPB_Active enters the safe side.

8. The method for hot standby redundancy of a vehicle-mounted platform according to claim 1, characterized in that: The switching of MPB_Leader in S5 specifically includes: S521: The MPB_Leader broadcasts a Clock message to other MPB_Followers. The Clock message includes the start time T of the MPB_Leader in this cycle. L ; S522: The MPB_Follower cycle start time T F Respectively with the start time T of MPB_Leader L Make a difference and get the difference value T I , the difference T I Broadcast via election Vote message; S523, the difference T of all MPBs I Sort and select the MPB_Follower to which the median belongs as the new MPB_Leader; S524, all MPB_Followers need to send a confirmation ACK message to the new Leader they elected; S525. The MPB_Leader that is confirmed by more than half of the MPB_Followers can officially become the new MPB_Leader, otherwise it remains an MPB_Follower.

9. A system for hot standby redundancy method of vehicle-mounted platform, characterized in that: It includes a control module, and the control module implements the method for hot standby redundancy of the vehicle-mounted platform as described in any one of claims 1 to 8.

10. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to claim 9 is implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 10 is implemented.

Images