Main and standby controller switching method based on dual-redundancy electromechanical management system GJB289A bus

Abstract

The invention provides a main and standby controller switching method based on a GJB289A bus of a dual-redundancy electromechanical management system, the dual-redundancy electromechanical management system comprises two electromechanical management computers, one electromechanical management computer is used as a main controller, the other electromechanical management computer is used as a standby controller, the dual-redundancy electromechanical management system further comprises two ECU controllers and three RIU units as RT, the two ECU controllers respectively comprise two RT (Reverse Transistor); the main controller and the standby controller are connected with each other, and are respectively connected with each RIU unit and each ECU controller through a GJB289A bus; by adopting the method to realize the switching process of the main controller and the standby controller of the GJB289A bus, not only can the switching probability of the GJB289A bus be reduced, but also the switching probability of the GJB289A bus caused by unstable communication links of the main controller and the standby controller can be reduced, so that the reliability and the stability of the control function of the electromechanical management system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of avionics, and in particular to a method for switching between a master and a standby controller based on a dual-redundancy electromechanical management system GJB289A bus. Background Art

[0002] In aircraft electromechanical management systems, dual-redundancy electromechanical management systems, coupled with master / backup controller switching technology using the GJB289A bus, are key elements of high-reliability avionics system design. Their functional performance is directly related to aircraft flight safety. Furthermore, the aircraft engine controller (ECU), as the core control unit for aircraft engines, plays a crucial role in ensuring safe flight. As the bus data dispatcher for the ECU, the electromechanical management system must, on the one hand, upload engine status to the avionics system in real time, providing data support for pilots' safe flight. On the other hand, it must receive control commands from the avionics system and transmit them to the ECU, ensuring the engine's ability to respond to cockpit commands in real time.

[0003] Dual-redundant electromechanical management systems typically use two buses for state exchange. While this solution initially establishes a redundant backup mechanism, it has significant reliability shortcomings during actual operation. First, in a two-bus architecture, if one of the buses experiences a fault such as a circuit break, signal interference, or data transmission error, the exchange of state information between the redundant systems will be incomplete, affecting the accurate switching decision between the primary and backup controllers. Second, when the bus load is excessive, the limited transmission channels make it difficult to ensure the real-time and stability of data, posing the risk of system failure due to data congestion or loss. Summary of the Invention

[0004] In view of this, the embodiments of the present application combine the actual scenarios of dual-redundant electromechanical systems to provide a master-slave controller switching method based on the GJB289A bus of the dual-redundant electromechanical management system, realize the request and release of GJB289A bus control rights, avoid triggering the switching function due to a single point failure or multiple single point failures in the system, thereby improving the fault tolerance of the electromechanical management system and enhancing the reliability and safety of aircraft functions.

[0005] The present application provides the following technical solution: a method for switching between a master and a slave controller based on a dual-redundant electromechanical management system GJB289A bus, wherein the dual-redundant electromechanical management system includes two electromechanical management computers, one of which serves as a master controller and the other as a slave controller, and further includes two ECU controllers and three RIU units serving as RTs, each of the two ECU controllers including two RTs; the master controller and the slave controllers are interconnected and connected to each RIU unit and the ECU controller via a GJB289A bus; The active / standby controller switching method includes: Within 30 seconds after the system is powered on, the main controller directly switches to BC controller mode, and the standby controller enters RT mode. 30 seconds after the system is powered on, the main controller and the standby controller start the mutual monitoring process; The main controller determines in real time whether all RTs are online. If all four RTs in the two ECU controllers are offline, it is determined that the current BC controller has failed. The main controller switches the current BC controller mode to silent mode and sends a switching instruction to the standby controller via Ethernet, RS22 bus, and HDLC bus, so that the standby controller switches from RT mode to BC controller mode. If the main controller detects that the standby controller is in BC control state for three consecutive times within a set interval, the main controller switches the current BC controller mode to silent mode and sends the current controller state to the standby controller; If the standby controller detects that the Ethernet, RS22 bus, and HDLC bus reception are all faulty and the bus inactivity lasts for 1 second, the standby controller switches from RT mode to BC controller mode and sends the current controller status to the master controller; If the standby controller receives the switching instruction sent by the main controller three times in succession, the standby controller switches from the RT mode to the BC controller mode and sends the current controller state to the main controller.

[0006] According to one embodiment of the present application, the method further includes: If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the RS422 bus communication fault, HDLC bus communication fault and Ethernet communication fault is invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus is not failed, and at least one of the RS422 bus communication fault and the HDLC bus communication fault is invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the Ethernet bus communication fault and the HDLC bus communication fault is invalid, then switching to the BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is invalid, and at least one of the Ethernet bus communication fault and the RS422 bus communication fault is invalid, switching to BC controller mode is allowed.

[0007] According to one embodiment of the present application, the method further includes: If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus fails, the HDLC bus is not failed, and the HDLC bus communication fault is invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus fails, and the RS422 bus communication fault is invalid, then the controller is allowed to switch to the BC controller mode; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is invalid, the HDLC bus is invalid, and the Ethernet bus communication fault is invalid, then the controller is allowed to switch to the BC controller mode; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus fails, and the HDLC bus fails, switching to the BC controller mode is not allowed, and the active and standby controllers maintain the current status.

[0008] According to one embodiment of the present application, the method further includes: If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least two of the RS422 bus communication fault, HDLC bus communication fault and Ethernet communication fault are invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus is not failed, and the RS422 bus communication failure and the HDLC bus communication failure are both invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is invalid, the HDLC bus is not invalid, and the HDLC bus communication fault and Ethernet communication fault are both invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is invalid, and the RS422 bus communication failure and the Ethernet bus communication failure are both invalid, then switching to BC controller mode is allowed.

[0009] According to one embodiment of the present application, the method further includes: If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus fails, and the HDLC bus is not failed, the switch to the BC controller mode is not allowed, and the active and standby controllers maintain the current status; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is invalid, and the HDLC bus is invalid, the switch to the BC controller mode is not allowed, and the active and standby controllers maintain the current status; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus is not failed, and the HDLC bus fails, the switch to the BC controller mode is not allowed, and the active and standby controllers maintain the current status; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus fails, or the HDLC bus fails, switching to the BC controller mode is not allowed, and the active and standby controllers remain in the current state.

[0010] According to one embodiment of the present application, the method further includes: If the Ethernet link is disconnected more than 10 times within 10 minutes, the Ethernet is considered to be in a failed state; If the Ethernet link is disconnected no more than twice within 10 minutes, the Ethernet is considered to be in a valid state. If the data sent by the peer controller is not received or cannot be correctly parsed for 500ms, it is determined that the Ethernet communication is faulty.

[0011] According to one embodiment of the present application, the method further includes: If the data sent by the peer controller is not received or cannot be correctly parsed more than 20 times within 3 seconds, the RS422 bus is determined to be in a failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for no more than three times within 3s, the RS422 bus is determined to be in a non-failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for 300ms, it is determined that the RS422 bus communication is faulty.

[0012] According to one embodiment of the present application, the method further includes: If the data sent by the peer controller is not received or cannot be correctly parsed more than 20 times within 3 seconds, the HDLC bus is determined to be in a failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for no more than three times within 3s, the HDLC bus is determined to be in a non-failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for 300ms, it is determined that the RS422 bus communication is faulty.

[0013] According to one embodiment of the present application, the method further includes: If no level signal reversal is detected within three consecutive operating cycles, the heartbeat fault is determined to be valid; in other cases, the heartbeat fault is determined to be invalid.

[0014] Because aircraft engine electronic control units (ECUs) directly control aircraft power systems, they are crucial to safe flight. The electromechanical management system (EMS) in the EMS acts as the dispatcher for the ECU. By implementing the GJB289A bus master / slave controller switching process using the method of the present invention, the probability of GJB289A bus switching can be reduced. This also reduces the probability of GJB289A bus switching caused by unstable communication links between the master and backup controllers, thereby improving the reliability and stability of the EMS control function. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0016] Figure 1 This is an internal cross-link diagram of a dual-redundant electromechanical management system in a method for switching between a master and a standby controller based on a GJB289A bus of a dual-redundant electromechanical management system according to an embodiment of the present invention; Figure 2 This is a flow chart of the master-slave controller switching based on the dual-redundancy electromechanical management system GJB289A bus according to an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0018] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that, in the absence of conflict, the features in the following embodiments and embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without making creative work are within the scope of protection of this application.

[0019] like Figure 1-Figure 2As shown, an embodiment of the present invention provides a method for switching between a master and a slave controller based on a dual-redundant electromechanical management system GJB289A bus. The dual-redundant electromechanical management system includes two electromechanical management computers, one of which serves as a master controller and the other as a slave controller. It also includes two ECU controllers and three RIU (Remote Interface Unit) units serving as RTs (remote terminals). Each of the two ECU controllers includes two RTs. The master controller and the slave controller are interconnected, and each RIU unit and the ECU controller are connected via the GJB289A bus. The system composition diagram is shown in FIG. Figure 1 As shown, the functions of each internal structure are described as follows: (1) The master / standby controller mainly realizes the functions of aircraft electromechanical system function control, status monitoring, fault monitoring, etc., and receives all RT sent data blocks through the GJB289A bus, and sends the resolved control command signals.

[0020] (2) RT1: realizes the function of collecting aircraft sensor signals and sends the data to the main and standby controllers through the GJB289A bus; (3) RT2 / RT3: realizes the function of collecting aircraft sensor signals, exchanges data with other airborne equipment, and sends the data to the main and backup controllers through the GJB289A bus, and receives control commands issued by the main and backup controllers; (4) RT4 / RT5 / RT6 / RT7: Realize the aircraft engine data acquisition and control functions, organize and send data to the main / standby controller through the GJB289A bus, and receive control instructions issued by the main / standby controller.

[0021] Because the electromechanical management system (EMS) is responsible for scheduling aircraft power system controllers, its safety and reliability requirements are significantly increased. Given the GJB289A bus's superior real-time communication capabilities and physical layer redundant channel design, the system in this embodiment of the present invention utilizes a quadruple-redundant hardware redundancy model for the data exchange link between the primary and backup controllers, designing a switching voting strategy and switching mode to reduce the impact of single-point failures on system functionality, thereby enhancing the reliability and safety of the EMS.

[0022] After the aircraft is powered on, the power supply of each component in the electromechanical management system has a time sequence: within 30 seconds after the system is powered on, the main controller directly switches to BC (Bus Controller) controller mode, and the backup controller enters RT mode; 30 seconds after the product is powered on, the main and backup controllers start the mutual monitoring process and can switch states at any time. The main and backup controller switching process is as follows: Figure 2 The specific switching strategy is as follows: (1) Active switching of the main controller The main controller determines in real time whether all RTs are online. If all RTs are offline or RT4 to RT7 are offline, it is determined that the current BC controller has failed. The main controller's BC control state switches to silent mode and sends a switching instruction to the backup controller via Ethernet, RS22 bus, and HDLC bus, causing the backup controller to switch from RT state to BC control state.

[0023] (2) Passive switching of the main controller If the master controller receives the message that the backup controller is in BC control state for three consecutive times, the master controller BC control state switches to silent mode and sends the current controller state to the backup controller.

[0024] (3) Active switching of the standby controller If the standby controller detects that the Ethernet, RS22 bus, and HDLC bus reception are all faulty and the bus inactivity lasts for 1 second, the standby controller switches from the RT state to the BC control state and sends the current state of the standby controller to the master controller.

[0025] (4) Passive switching of the standby controller If the standby controller receives the switching command from the main controller three times in a row, the standby controller switches from the RT state to the BC control state and sends the current state of the standby controller to the main controller.

[0026] In this embodiment, since the electromechanical management system is responsible for the scheduling and control functions of the aircraft engine controller, the main and standby controllers use quad-redundant data links for data exchange to avoid affecting the reliability and fault tolerance of the electromechanical management system due to single-link or dual-link failures.

[0027] Therefore, this embodiment focuses on designing the conditions for allowing entry into the BC controller switching mode, which are specifically described as follows: (1) Allowing entry into BC controller switching conditions: If the peer heartbeat status is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the RS422 bus communication failure, HDLC bus communication failure and Ethernet communication failure is invalid, then entering the BC controller switching mode is allowed; (2) If the peer heartbeat status is normal, the Ethernet bus is invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the RS422 bus communication failure and the HDLC bus communication failure is invalid, then entering the BC controller switching mode is allowed; (3) If the peer heartbeat status is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the Ethernet bus communication failure and the HDLC bus communication failure is invalid, then entering the BC controller switching mode is allowed; (4) If the peer heartbeat status is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is invalid, and at least one of the Ethernet bus communication failure and the RS422 bus communication failure is invalid, then entering the BC controller switching mode is allowed; (5) If the peer heartbeat status is normal, the Ethernet bus fails, the RS422 bus fails, the HDLC bus does not fail, and the HDLC bus communication failure is invalid, then the BC controller switching mode is allowed; (6) If the peer heartbeat status is normal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus fails, and the RS422 bus communication failure is invalid, then entering the BC controller switching mode is allowed; (7) If the peer heartbeat status is normal, the Ethernet bus is not invalid, the RS422 bus is invalid, the HDLC bus is invalid, and the Ethernet bus communication failure is invalid, then the BC controller switching mode is allowed; (8) If the heartbeat status of the peer machine is normal, the Ethernet bus fails, the RS422 bus fails, and the HDLC bus fails, the BC controller switching mode is not allowed to be entered, and the master and backup controllers maintain the current status; (9) If the peer heartbeat status is abnormal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least two of the RS422 bus communication failure, HDLC bus communication failure and Ethernet communication failure are invalid, then it is allowed to enter the BC controller switching mode; (10) If the peer heartbeat status is abnormal, the Ethernet bus fails, the RS422 bus does not fail, the HDLC bus does not fail, and both the RS422 bus communication failure and the HDLC bus communication failure are invalid, then the BC controller switching mode is allowed to be entered; (11) If the peer heartbeat status is abnormal, the Ethernet bus is not invalid, the RS422 bus is invalid, the HDLC bus is not invalid, and the HDLC bus communication failure and Ethernet communication failure are both invalid, then entering the BC controller switching mode is allowed; (12) If the peer heartbeat status is abnormal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is invalid, and the RS422 bus communication failure and the Ethernet bus communication failure are invalid, then the BC controller switching mode is allowed; (13) If the peer heartbeat status is abnormal, the Ethernet bus fails, the RS422 bus fails, and the HDLC bus does not fail, the BC controller switching mode is not allowed to be entered, and the master and backup controllers maintain the current status; (14) If the heartbeat status of the peer machine is abnormal, the Ethernet bus is not invalid, the RS422 bus is invalid, and the HDLC bus is invalid, then the BC controller switching mode is not allowed to enter, and the master and backup controllers maintain the current status; (15) If the peer heartbeat status is abnormal, the Ethernet bus fails, the RS422 bus is not failed, and the HDLC bus fails, the BC controller switching mode is not allowed to enter, and the master and backup controllers maintain the current status; (16) If the heartbeat status of the peer machine is abnormal, the Ethernet bus fails, the RS422 bus fails, or the HDLC bus fails, the BC controller switching mode is not allowed to be entered, and the master and backup controllers maintain the current status.

[0028] The fault list and detection methods are shown in Table 1 below.

[0029] Table 1 Fault list and detection methods

[0030] A method for switching between a master and standby bus based on a dual-redundant electromechanical management computer GJB289A according to an embodiment of the present invention implements the request and release of GJB289A bus control rights, avoiding triggering of a switching function due to a single point failure or multiple single point failures in the system, thereby improving the fault tolerance of the electromechanical management system and enhancing the reliability and safety of aircraft functions.

[0031] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for switching between a master and a standby controller based on a dual-redundancy electromechanical management system GJB289A bus, characterized in that: The dual-redundant electromechanical management system includes two electromechanical management computers, one of which serves as a main controller and the other as a backup controller. It also includes two ECU controllers and three RIU units serving as RTs, with each of the two ECU controllers including two RTs. The main controller and the backup controllers are interconnected and connected to each RIU unit and the ECU controller via a GJB289A bus. The active / standby controller switching method includes: Within 30 seconds after the system is powered on, the main controller directly switches to BC controller mode, and the standby controller enters RT mode. 30 seconds after the system is powered on, the main controller and the standby controller start the mutual monitoring process; The main controller determines in real time whether all RTs are online. If all four RTs in the two ECU controllers are offline, it is determined that the current BC controller has failed. The main controller switches the current BC controller mode to silent mode and sends a switching instruction to the standby controller via Ethernet, RS22 bus, and HDLC bus, so that the standby controller switches from RT mode to BC controller mode. If the main controller detects that the standby controller is in BC control state for three consecutive times within a set interval, the main controller switches the current BC controller mode to silent mode and sends the current controller state to the standby controller; If the standby controller detects that the Ethernet, RS22 bus, and HDLC bus reception are all faulty and the bus inactivity lasts for 1 second, the standby controller switches from RT mode to BC controller mode and sends the current controller status to the master controller; If the standby controller receives the switching instruction sent by the main controller three times in succession, the standby controller switches from the RT mode to the BC controller mode and sends the current controller state to the main controller.

2. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 1 is characterized in that: The method further comprises: If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the RS422 bus communication fault, HDLC bus communication fault and Ethernet communication fault is invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus is not failed, and at least one of the RS422 bus communication fault and the HDLC bus communication fault is invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least one of the Ethernet bus communication fault and the HDLC bus communication fault is invalid, then switching to the BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is invalid, and at least one of the Ethernet bus communication fault and the RS422 bus communication fault is invalid, switching to BC controller mode is allowed.

3. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 2, characterized in that: The method further comprises: If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus fails, the HDLC bus is not failed, and the HDLC bus communication fault is invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus fails, and the RS422 bus communication fault is invalid, then the controller is allowed to switch to the BC controller mode; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus is not invalid, the RS422 bus is invalid, the HDLC bus is invalid, and the Ethernet bus communication fault is invalid, then the controller is allowed to switch to the BC controller mode; If the heartbeat status of the active and standby controllers is normal, the Ethernet bus fails, the RS422 bus fails, and the HDLC bus fails, switching to the BC controller mode is not allowed, and the active and standby controllers maintain the current status.

4. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 3 is characterized in that: The method further comprises: If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is not invalid, and at least two of the RS422 bus communication fault, HDLC bus communication fault and Ethernet communication fault are invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus is not failed, the HDLC bus is not failed, and the RS422 bus communication failure and the HDLC bus communication failure are both invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is invalid, the HDLC bus is not invalid, and the HDLC bus communication fault and Ethernet communication fault are both invalid, then switching to BC controller mode is allowed; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is not invalid, the HDLC bus is invalid, and the RS422 bus communication failure and the Ethernet bus communication failure are both invalid, then switching to BC controller mode is allowed.

5. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 4 is characterized in that: The method further comprises: If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus fails, and the HDLC bus is not failed, the switch to the BC controller mode is not allowed, and the active and standby controllers maintain the current status; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus is not invalid, the RS422 bus is invalid, and the HDLC bus is invalid, the switch to the BC controller mode is not allowed, and the active and standby controllers maintain the current status; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus is not failed, and the HDLC bus fails, the switch to the BC controller mode is not allowed, and the active and standby controllers maintain the current status; If the heartbeat status of the active and standby controllers is abnormal, the Ethernet bus fails, the RS422 bus fails, or the HDLC bus fails, switching to the BC controller mode is not allowed, and the active and standby controllers remain in the current state.

6. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 5, characterized in that: The method further comprises: If the Ethernet link is disconnected more than 10 times within 10 minutes, the Ethernet is considered to be in a failed state; If the Ethernet link is disconnected no more than twice within 10 minutes, the Ethernet is considered to be in a valid state. If the data sent by the peer controller is not received or cannot be correctly parsed for 500ms, it is determined that the Ethernet communication is faulty.

7. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 5, characterized in that: The method further comprises: If the data sent by the peer controller is not received or cannot be correctly parsed more than 20 times within 3 seconds, the RS422 bus is determined to be in a failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for no more than three times within 3s, the RS422 bus is determined to be in a non-failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for 300ms, it is determined that the RS422 bus communication is faulty.

8. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 5, characterized in that: The method further comprises: If the data sent by the peer controller is not received or cannot be correctly parsed more than 20 times within 3 seconds, the HDLC bus is determined to be in a failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for no more than three times within 3s, the HDLC bus is determined to be in a non-failed state; If the data sent by the peer controller is not received or cannot be correctly parsed for 300ms, it is determined that the RS422 bus communication is faulty.

9. The method for switching between the master and standby controllers based on the dual-redundancy electromechanical management system GJB289A bus according to claim 5, characterized in that: The method further comprises: If no level signal reversal is detected within three consecutive operating cycles, the heartbeat fault is determined to be valid; in other cases, the heartbeat fault is determined to be invalid.

Images