Master-slave redundancy control method and system, medium and product

Abstract

The invention provides a master-slave redundancy control method and system, a medium and a product, and relates to the technical field of redundancy control, and the method comprises the steps: controlling a master controller to generate a PWM heartbeat signal and a CAN heartbeat signal based on the current operation state of the master controller in each control period, the PWM heartbeat signal and the CAN heartbeat signal are simultaneously sent to the slave controller through a hard wire and a CAN bus; and after the slave controller receives the PWM heartbeat signal and the CAN heartbeat signal, the slave controller is controlled to start a built-in redundancy control switching logic, and the redundancy control switching logic is configured to control the slave controller to enter a working mode to take over a control task of the master controller when the master controller is identified to have a fault based on the PWM heartbeat signal and the CAN heartbeat signal. According to the method, through a heartbeat signal detection scheme of dual redundancy of the hard wire and the CAN bus, the reliability and the anti-interference capability of heartbeat signals are enhanced, and misoperation during redundancy switching control can be effectively prevented.

Description

Technical Field

[0001] The present disclosure belongs to the field of redundant control technology, and in particular relates to a master-slave redundant control method, system, medium and product. Background Art

[0002] In control areas where reliability is paramount, a master-slave redundant control strategy is often employed. This involves configuring two sets of functionally identical master and slave controllers within a master-slave redundant control system. The master controller is responsible for normal data processing and control tasks, as well as generating and outputting control signals. The slave controller, on the other hand, processes some data but does not output control signals until activated.

[0003] In related technologies, redundant switching typically relies on the master controller periodically sending heartbeat messages via the CAN bus. If the master controller's heartbeat signal is not detected, the system determines that the master controller has failed and triggers the slave controller to automatically take over the master control functions to ensure continuous system operation. However, if the CAN bus experiences heartbeat signal anomalies due to factors such as frame loss, delay, or electromagnetic interference, the slave controller may mistakenly determine that the master controller has failed, causing the redundant switching to malfunction. This results in poor accuracy and stability in the redundant switching of master-slave redundant control systems. Summary of the Invention

[0004] The present disclosure provides a master-slave redundancy control method, system, medium and product, which aim to at least to some extent solve the technical problem in related technologies that the accuracy and stability of redundant switching are poor when frame loss, delay or electromagnetic interference occurs on the CAN bus due to the switching action relying on the heartbeat message of the CAN bus.

[0005] At least one embodiment of the present disclosure provides a master-slave redundant control method, which is applied to a master-slave redundant control system having a master controller and a slave controller, wherein a connection harness between the master controller and the slave controller includes a CAN bus and a hard line, and the master-slave redundant control method includes:

[0006] In each control cycle, controlling the master controller to generate a PWM heartbeat signal and a CAN heartbeat signal based on a current operating state of the master controller, and simultaneously sending the PWM heartbeat signal through the hard line and the CAN heartbeat signal through the CAN bus to the slave controller, wherein the PWM heartbeat signal and the CAN heartbeat signal are correlated; and

[0007] After the slave controller receives the PWM heartbeat signal and the CAN heartbeat signal, the slave controller is controlled to start its built-in redundant control switching logic, wherein the redundant control switching logic is configured to control the slave controller to enter a working mode to take over the control task of the master controller when a fault occurs to the master controller based on mutual verification of the PWM heartbeat signal and the CAN heartbeat signal.

[0008] In the method provided by at least one embodiment of the present disclosure, the master controller is used to generate multiple types of control signals and process multiple types of control tasks, and the slave controller is used to process the control tasks of the master controller when a failure occurs in the master controller. In addition, the master-slave redundancy control method further includes:

[0009] In each control cycle, controlling the main controller to start detecting its current operating state; and

[0010] When the slave controller recognizes that the master controller fails, it disconnects the output of the master controller.

[0011] In a method provided by at least one embodiment of the present disclosure, the main controller includes a first single-chip microcomputer and a heartbeat signal output circuit, the heartbeat signal output circuit is configured to generate the PWM heartbeat signal based on a control signal of the first single-chip microcomputer, the period and duty cycle of the PWM heartbeat signal are fixed, and the controlling the main controller to generate the PWM heartbeat signal and the CAN heartbeat signal based on the current operating state of the main controller includes:

[0012] Obtaining the current operating status of the main controller;

[0013] generating a control signal of the first single-chip microcomputer and the CAN heartbeat signal based on a current operating state of the main controller, wherein the control signal of the first single-chip microcomputer is related to the CAN heartbeat signal; and

[0014] The first single-chip microcomputer is controlled to output the control signal to the heartbeat signal output circuit, so that the heartbeat signal output circuit generates and outputs the PWM heartbeat signal.

[0015] In the method provided in at least one embodiment of the present disclosure, the redundant control switching logic includes:

[0016] Obtain the PWM heartbeat signal and the CAN heartbeat signal, and obtain the frequency of the PWM heartbeat signal;

[0017] In response to the CAN heartbeat signal being true and the frequency of the PWM heartbeat signal being within a preset safety threshold range, generating first information for indicating that the current operating state of the main controller is normal; and

[0018] In response to the PWM heartbeat signal being false or the frequency of the PWM heartbeat signal exceeding a preset safety threshold range, second information is generated to characterize a failure of the master controller, and the slave controller is controlled to enter a working mode to take over the control task of the master controller.

[0019] In the method provided by at least one embodiment of the present disclosure, the slave controller includes a photoelectric coupling circuit, a comparator circuit, and a second single-chip microcomputer, and obtaining the frequency of the PWM heartbeat signal includes:

[0020] Performing optical coupling isolation on the input PWM heartbeat signal through the optical coupling circuit;

[0021] Comparing the optically isolated PWM heartbeat signal with a preset reference voltage through the comparator circuit, generating a deviation signal between the PWM heartbeat signal and the reference voltage, and sending the deviation signal to the second single-chip microcomputer; and

[0022] The frequency of the deviation signal is obtained by the second single-chip microcomputer as the frequency of the PWM heartbeat signal.

[0023] At least one embodiment of the present disclosure further provides a master-slave redundant control system, comprising a master controller and a slave controller;

[0024] Wherein, the connection harness between the master controller and the slave controller includes a CAN bus and a hard line;

[0025] The master controller is configured to generate a PWM heartbeat signal and a CAN heartbeat signal based on a current operating state of the master controller in each control cycle, and simultaneously send the PWM heartbeat signal through the hard line and the CAN heartbeat signal through the CAN bus to the slave controller, wherein the PWM heartbeat signal and the CAN heartbeat signal are correlated;

[0026] The slave controller is configured to start a pre-set redundant control switching logic after receiving the PWM heartbeat signal and the CAN heartbeat signal, wherein the redundant control switching logic is configured to control the slave controller to enter a working mode based on mutual verification of the PWM heartbeat signal and the CAN heartbeat signal to identify that the master controller fails, so as to take over the control tasks of the master controller.

[0027] In the device provided in at least one embodiment of the present disclosure, the main controller includes:

[0028] a heartbeat signal output circuit, wherein the heartbeat signal output circuit is configured to convert an input control signal thereof into the PWM heartbeat signal;

[0029] a first single-chip microcomputer, a control output end of the first single-chip microcomputer being connected to an input end of the heartbeat signal output circuit, and the first single-chip microcomputer being configured to generate the control signal and the CAN heartbeat signal based on a current running state of the main controller;

[0030] a first logic device, the first logic device being in bidirectional communication with the first single-chip microcomputer, and the first logic device being configured to implement transceiving control of the main controller;

[0031] a first communication interface, one end of the first communication interface being connected to the first logic device, the other end of the first communication interface being connected to the hardwire, and the first communication interface being configured to send the PWM heartbeat signal through the hardwire; and,

[0032] a first Ethernet interface, one end of the first Ethernet interface being connected to the first logic device, the other end of the first Ethernet interface being connected to the CAN bus, and the first Ethernet interface being configured to send the CAN heartbeat signal through the CAN bus.

[0033] In the apparatus provided in at least one embodiment of the present disclosure, the slave controller comprises:

[0034] a second Ethernet interface, one end of the first Ethernet interface being connected to the second logic device, the other end of the first Ethernet interface being connected to the CAN bus, and the second Ethernet interface being configured to receive the CAN heartbeat signal through the CAN bus;

[0035] a second communication interface, one end of the second communication interface being connected to the second logic device, the other end of the second communication interface being connected to the hardwire, and the second communication interface being configured to receive the PWM heartbeat signal through the hardwire;

[0036] a heartbeat signal acquisition circuit, the heartbeat signal acquisition circuit being configured to receive the CAN heartbeat signal of the second communication interface;

[0037] a second single-chip microcomputer, an input end of the second single-chip microcomputer being connected to an output end of the heartbeat signal acquisition circuit, the second single-chip microcomputer being configured to start a built-in redundant control switching logic thereof after receiving the PWM heartbeat signal and the CAN heartbeat signal; and,

[0038] a second logic device, the second logic device being in bidirectional communication with the second single-chip microcomputer, and the second logic device being configured to implement transceiving control of the controller.

[0039] In the device provided by at least one embodiment of the present disclosure, the heartbeat signal output circuit includes a high-side drive circuit, and the signal end of the PWM heartbeat signal is located at the output end of the high-side drive circuit; the high-side control circuit includes a PMOS transistor, and the PMOS transistor serves as a high-side control switch of the high-side control circuit; and

[0040] The heartbeat signal acquisition circuit includes a photoelectric coupling circuit and a comparator circuit. The input end of the photoelectric coupling circuit is connected to the hard wire, and the output end of the photoelectric coupling circuit is connected to the input end of the comparator circuit. The photoelectric coupling circuit is used to achieve electrical isolation between its input end and its output end. The reference end of the comparator circuit is connected to a preset reference voltage, and the output end of the comparator circuit is connected to the second single-chip microcomputer.

[0041] In the device provided by at least one embodiment of the present disclosure, the master controller and the slave controller have the same hardware architecture; and

[0042] The master controller and the slave controller further include respective fault recording modules configured to record redundant control switching events, fault types and timestamps.

[0043] At least one embodiment of the present disclosure further provides a storage medium storing a program or instruction. When the program or instruction is executed by a processor, the steps of the master-slave redundancy control method provided in any embodiment of the present disclosure are implemented.

[0044] At least one embodiment of the present disclosure further provides a product, including a program or instructions, wherein when the program or instructions are executed by a processor, the steps of the master-slave redundancy control method provided in any embodiment of the present disclosure are implemented.

[0045] Compared with related technologies, the master-slave redundant control method, system, medium and product provided by the embodiments of the present invention enhance the reliability and anti-interference ability of the heartbeat signal through mutual verification of the hard-wired PWM heartbeat signal and the CAN heartbeat signal of the CAN bus, that is, the hard-wire + CAN bus dual redundant heartbeat signal detection scheme, which can significantly improve the accuracy and stability of redundant switching of the master-slave redundant control system when frame loss, delay or electromagnetic interference occurs on the CAN bus, and prevent malfunction during redundant switching control. This method not only improves the redundant switching efficiency of the system, but also greatly enhances the stability and reliability of the system. By accurately identifying the fault state of the master controller and quickly starting the slave controller to take over the control task, the method of the present invention effectively shortens the fault switching time and reduces the risk of system downtime due to controller failure. In addition, the method is also highly flexible and scalable, and can adapt to the specific needs of different industries and application scenarios, providing users with a more reliable and efficient master-slave redundant control solution.

[0046] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 A flowchart of a master-slave redundancy control method provided by at least one embodiment of the present disclosure;

[0049] Figure 2 A schematic diagram of the composition of a master-slave redundant control system provided by at least one embodiment of the present disclosure;

[0050] Figure 3 A schematic diagram of another master-slave redundant control system provided by at least one embodiment of the present disclosure;

[0051] Figure 4 A schematic diagram of a heartbeat signal output circuit provided by at least one embodiment of the present disclosure;

[0052] Figure 5 A schematic diagram of a heartbeat signal acquisition circuit provided by at least one embodiment of the present disclosure;

[0053] Figure 6 A schematic diagram of the composition of a program product provided for at least one embodiment of the present disclosure.

[0054] Reference numerals:

[0055] 1 - Master-slave redundant control system; 11 - Master controller; 12 - Slave controller; 111 - Heartbeat signal output circuit; 112 - First single-chip microcomputer; 113 - First logic device; 114 - First communication interface; 115 - First Ethernet interface; 121 - Heartbeat signal acquisition circuit; 122 - Second single-chip microcomputer; 123 - Second logic device; 124 - Second communication interface; 125 - Second Ethernet interface; R1-R12 - Resistors; Q1, Q3 - NPN transistors; Q2 - PMOS transistor; C1, C3, C4 - Capacitors;

[0056] D1-Zener diode; D2~D5-diodes; M1-photocoupler; M2-comparator. DETAILED DESCRIPTION

[0057] The present disclosure will be further described below in conjunction with the drawings and embodiments. It is particularly pointed out that the following embodiments are only for illustrating the present disclosure, but not for limiting the scope of the present disclosure. Similarly, the following embodiments are only part of the embodiments of the present disclosure, not all the embodiments, and all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0058] The terms "first", "second", and "third" in the embodiments of the present disclosure are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second", and "third" can be explicitly or implicitly included at least one of the features.

[0059] In the description of the present disclosure, the meaning of "a plurality of" is at least two, such as two or three, etc., unless otherwise explicitly and specifically limited.

[0060] In the present disclosure, the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0061] In the embodiments of the present disclosure, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or components inherent to the process, method, product, or device.

[0062] In the embodiments of the present disclosure, the term "controller area network bus" is abbreviated as CAN.

[0063] In the embodiments of the present disclosure, the term "pulse width modulation" is abbreviated as PWM.

[0064] In the embodiments of the present disclosure, the term "hardwire" refers to a physical connection used to transmit control signals or data signals, which is realized through a specific wire or cable, rather than through wireless communication or network transmission. Hardwire is usually used to ensure the stability and reliability of signal transmission, especially in application scenarios that require high real-time performance or low latency.

[0065] The term "heartbeat signal" in the embodiments of the present disclosure refers to a signal periodically sent between the master controller and the slave controller for monitoring the running state and connection state of the master controller. If the master controller fails or loses connection, the heartbeat signal will be interrupted, and the slave controller can detect this change and take corresponding fault handling measures.

[0066] The term "high-side driver circuit" in the embodiments of the present disclosure refers to a circuit for driving high-voltage loads, usually used to convert the output signal of a microcontroller or other low-voltage device into a signal capable of controlling a high-voltage load.

[0067] The related technology has the technical problem of poor accuracy and stability of redundant switching when the CAN bus has frame loss, delay or electromagnetic interference due to the dependence of the switching action on the heartbeat message of the CAN bus.

[0068] To solve the above technical problems, the present disclosure proposes a master-slave redundant control method. On the basis of the related technology, a hardwire is added, and the PWM heartbeat signal of the hardwire and the CAN heartbeat signal of the CAN bus are mutually verified, thereby enhancing the reliability and anti-interference ability of the heartbeat signal and improving the accuracy and stability of the switching between the master controller and the slave controller.

[0069] Figure 1 A flowchart of a master-slave redundant control method provided by at least one embodiment of the present disclosure. The method is applied to a master-slave redundant control system having a master controller and a slave controller, and the connection harness between the master controller and the slave controller includes a CAN bus and a hardwire. As shown in Figure 1 the method can include the following steps S10-S20.

[0070] Step S10: In each control cycle, the master controller generates a PWM heartbeat signal and a CAN heartbeat signal based on the current running state of the master controller, and simultaneously sends the PWM heartbeat signal through the hardwire and the CAN heartbeat signal through the CAN bus to the slave controller, wherein the PWM heartbeat signal and the CAN heartbeat signal are related.

[0071] Step S20: After the slave controller receives the PWM heartbeat signal and the CAN heartbeat signal, the slave controller starts its built-in redundant control switching logic, wherein the redundant control switching logic is configured to identify when the master controller fails based on mutual verification of the PWM heartbeat signal and the CAN heartbeat signal, and control the slave controller to enter a working mode to take over the control task of the master controller.

[0072] In the above scheme, the failure of the master controller includes various types, for example, hardware failure may cause the master controller to fail to normally send the PWM heartbeat signal or the CAN heartbeat signal, software failure may cause the sent PWM heartbeat signal or CAN heartbeat signal to contain incorrect information, or communication failure (such as disconnection of the connecting harness) may cause the slave controller to fail to normally receive the PWM heartbeat signal or the CAN heartbeat signal. Different types of failures may require different measures to be taken, and ensure that the slave controller can timely and accurately take over the control task of the master controller, so as to maintain the stable operation of the master-slave redundant control system.

[0073] In the above scheme, the PWM heartbeat signal and the CAN heartbeat signal present obvious correlation, for example, at least one of the frequency, duty cycle, and amplitude of the PWM heartbeat signal and the CAN heartbeat signal presents obvious correlation, and the PWM heartbeat signal and the CAN heartbeat signal are key signals in the redundant control device for monitoring the state of the master controller and implementing failure switching. When the slave controller receives the two signals and checks them against each other, it can accurately identify whether the master controller has failed, so as to timely start the redundant control switching logic and ensure the stable operation of the master-slave redundant control system.

[0074] In implementation, for two controllers with control functions, one is determined as the master controller according to pre-configuration, which has complete data processing and control functions and control signal generation and sending functions, and the other is the slave controller, which can process part of the data but does not output control signals. Using an oscilloscope to collect and analyze signals on the connecting harness between the master controller and the slave controller, a PWM signal with fixed period and duty cycle can be collected on the connecting harness, and after the connecting harness is cut off, the master controller works as the standby controller. After the redundant control switching logic is triggered, when the master controller fails, the slave controller quickly takes over all control tasks of the master controller, and in this process, the slave controller uses the control logic stored by itself and the latest system state information to seamlessly continue to perform the control task, ensuring the stable operation of the entire control system is not affected.

[0075] Some embodiments of the present disclosure also provide a system, a medium (storage medium), and a product (program product) corresponding to the above method.

[0076] The master-slave redundant control method provided by at least one embodiment of the present disclosure is applicable to any existing master-slave redundant control scenario with a master controller and a slave controller. For example, in the field of automobile manufacturing, the master controller can be responsible for the core control systems of the vehicle, such as engine management, braking system, etc. When the master controller fails, the slave controller can quickly take over the control tasks to ensure the safe operation of the vehicle. For another example, in the field of industrial automation, the master controller can be responsible for the overall scheduling and monitoring of the production line. When a problem occurs with the master controller, the slave controller can automatically adjust the working status of the workstation according to the preset redundant control logic to avoid stagnation of the production line.

[0077] Compared with related technologies, the master-slave redundant control method proposed in the present invention enhances the reliability and anti-interference ability of the heartbeat signal by mutual verification of the hard-wired PWM heartbeat signal and the CAN heartbeat signal of the CAN bus, that is, the hard-wire + CAN bus dual redundant heartbeat signal detection scheme, which can significantly improve the accuracy and stability of redundant switching of the master-slave redundant control system when frame loss, delay or electromagnetic interference occurs on the CAN bus, and prevent malfunction during redundant switching control. This method not only improves the redundant switching efficiency of the system, but also greatly enhances the stability and reliability of the system. By accurately identifying the fault state of the master controller and quickly starting the slave controller to take over the control task, the method disclosed in the present invention effectively shortens the fault switching time and reduces the risk of system downtime due to controller failure. In addition, the method is also highly flexible and scalable, and can adapt to the specific needs of different industries and application scenarios, providing users with a more reliable and efficient master-slave redundant control solution.

[0078] Wherein, step S10 includes the master controller periodically sending a PWM heartbeat signal to the slave controller via a hard line, and simultaneously sending a CAN heartbeat signal via a CAN bus.

[0079] In step S20, after receiving the PWM heartbeat signal and the CAN heartbeat signal, the slave controller performs a mutual verification to ensure the accuracy and relevance or consistency of the two signals. If the slave controller fails to receive the PWM heartbeat signal or the CAN heartbeat signal from the master controller within a preset time, or if the two received heartbeat signals are inconsistent, the slave controller will determine that the master controller may have failed and immediately enter a redundant switching control state, that is, the slave controller enters the working mode and takes over the control tasks of the master controller.

[0080] In some embodiments, in order to further ensure the stability and reliability of the master-slave redundant control system, the master controller is used to generate multiple types of control signals and process multiple types of control tasks, and the slave controller is used to process the control tasks of the master controller when the master controller fails. In addition, the master-slave redundant control method also includes the following steps S30-S40.

[0081] Step S30: In each control cycle, the main controller is controlled to start detecting its current operating status.

[0082] Step S40: When the slave controller identifies that the master controller fails, the output of the master controller is disconnected.

[0083] It should be noted that the method of disconnecting the output of the main controller can be to send a control instruction or control signal from the controller to the actuator to automatically disconnect the output of the main controller, or to send an early warning signal to enable the operator to manually disconnect the output of the main controller.

[0084] Among them, through steps S30-S40, the stability and reliability of the master-slave redundant control system can be further ensured. In step S30, the master controller periodically detects its own current operating status and sends a CAN heartbeat signal to the CAN bus. This not only detects potential faults in a timely manner, but also provides data support for the maintenance of the master controller, allowing maintenance personnel to perform preventive maintenance operations before a fault occurs. In step S40, once the slave controller identifies a fault in the master controller, it immediately disconnects the output of the master controller. This rapid response mechanism greatly reduces the operating time of the system in a faulty state, thereby protecting other parts of the system from potential damage, while also ensuring that the interruption time of production or service is minimized. This series of carefully designed steps together constitutes an efficient and reliable master-slave redundant control process.

[0085] In some embodiments, in order to achieve effective monitoring and fault detection of the main controller from the controller, the main controller includes a first single-chip microcomputer and a heartbeat signal output circuit. The heartbeat signal output circuit is configured to generate a PWM heartbeat signal based on the control signal of the first single-chip microcomputer. The period and duty cycle of the PWM heartbeat signal are fixed. In addition, controlling the main controller to generate a PWM heartbeat signal and a CAN heartbeat signal based on the current operating status of the main controller in step S10 is further refined to include the following sub-steps S101-sub-steps S103.

[0086] Sub-step S101: Acquire the current operating status of the main controller.

[0087] Sub-step S102: Generate a control signal of the first single-chip microcomputer and a CAN heartbeat signal based on the current operating state of the main controller, wherein the control signal of the first single-chip microcomputer is related to the CAN heartbeat signal.

[0088] Sub-step S103: controlling the first single-chip microcomputer to output a control signal to the heartbeat signal output circuit, so that the heartbeat signal output circuit generates and outputs a PWM heartbeat signal.

[0089] It should be noted that the type of heartbeat signal output circuit is not limited. It can be an analog circuit or a digital circuit, as long as it can generate a PWM heartbeat signal with a fixed period and duty cycle according to the control signal of the first single-chip microcomputer. In addition, the specific implementation of the heartbeat signal output circuit can also be flexibly designed according to actual needs to meet different application scenarios and performance requirements.

[0090] Among them, through sub-steps S101-S103, the main controller can monitor and respond to its running state in real time, ensuring the stability and reliability of the system. In particular, the generation and output of the PWM heartbeat signal and the CAN heartbeat signal not only realize effective communication between the master and slave controllers, but also further enhance the redundancy and fault detection capability of the system. In sub-step S101, the main controller first obtains its current running state information, which includes but is not limited to the load of the processor, the memory usage, the state of the input and output devices, etc. These information is crucial for subsequent control decisions. Next, in sub-step S102, based on the obtained running state information, the main controller generates the control signal of the first single-chip microcomputer and the CAN heartbeat signal. Here, there is some association between the control signal of the first single-chip microcomputer and the CAN heartbeat signal, which may be reflected in the frequency, phase or other characteristics of the signals to ensure synchronization and coordination between the two. Finally, in sub-step S103, the first single-chip microcomputer outputs the control signal to the heartbeat signal output circuit, which generates a PWM heartbeat signal with a fixed period and duty cycle according to the received control signal and outputs it to the system bus or other communication medium. At the same time, the CAN heartbeat signal is also transmitted through the CAN bus or other communication medium. Through such design, the main controller can send its running state information to the slave controller or other system components in real time, realizing effective monitoring and fault detection of the slave controller to the main controller.

[0091] In some embodiments, in order to enhance the reliability and stability of the master-slave redundant control system, the step S10 of sending the PWM heartbeat signal through the hard line and the CAN heartbeat signal through the CAN bus to the slave controller at the same time is refined to include the following sub-steps S104-S105.

[0092] Sub-step S104: Generate a CAN message containing the CAN heartbeat signal.

[0093] Sub-step S105: Send the PWM heartbeat signal through the hard line and the CAN message through the CAN bus to the slave controller at the same time at a specific frequency.

[0094] The dual sending mechanism of the heartbeat signal of the main controller is realized through the sub-steps S104-S105, which enhances the reliability and stability of the system. The CAN message is transmitted through the CAN bus, which has the characteristics of high speed and high reliability, and can effectively resist electromagnetic interference and line faults. The PWM heartbeat signal is transmitted through the hard-wire, which provides another independent communication path, further reducing the risk of system failure caused by single communication failure. This dual heartbeat signal mechanism enables the slave controller to monitor the running state of the main controller in real time and accurately, so as to switch to the standby controller in time when the main controller fails, and ensure the continuous and stable operation of the system.

[0095] In some embodiments, in order to realize real-time monitoring of the running state of the main controller and fault switching, the redundant control switching logic in step S20 is refined to include the following sub-steps S201-S203.

[0096] Sub-step S201: Acquire the PWM heartbeat signal and the CAN heartbeat signal, and acquire the frequency of the PWM heartbeat signal.

[0097] Sub-step S202: In response to the CAN heartbeat signal being true and the frequency of the PWM heartbeat signal being within a pre-set safety threshold range, generate first information representing that the current running state of the main controller is normal.

[0098] Sub-step S203: In response to the PWM heartbeat signal being false or the frequency of the PWM heartbeat signal being beyond the pre-set safety threshold range, generate second information representing that the main controller has failed, and control the slave controller to enter the working mode to take over the control task of the main controller.

[0099] It should be noted that a true CAN heartbeat signal means that the CAN heartbeat signal is received and the period and duty cycle of the CAN heartbeat signal are within a pre-set range; a false CAN heartbeat signal means that the CAN heartbeat signal is not received or the period and duty cycle of the CAN heartbeat signal do not meet the pre-set range (severe distortion). A true PWM heartbeat signal means that the PWM heartbeat signal is received and the period and duty cycle of the PWM heartbeat signal are within a pre-set range; a false PWM heartbeat signal means that the PWM heartbeat signal is not received or the period and duty cycle of the PWM heartbeat signal do not meet the pre-set range (severe distortion). Sub-step S203 includes two situations: the first situation is that the CAN heartbeat signal transmitted via the CAN message cannot be received, and the heartbeat detection PWM heartbeat signal cannot be collected or the frequency of the PWM heartbeat signal exceeds the safety threshold range; the second situation is that the CAN heartbeat signal transmitted via the CAN message can be received, but the PWM heartbeat signal cannot be collected or the frequency of the PWM heartbeat signal exceeds the safety threshold range. In this case, it is determined that the current operating state of the master controller is abnormal, that is, the master controller has failed. At this time, the slave controller enters the working mode to achieve redundant control switching.

[0100] Substeps S201 to S203 enable real-time monitoring of the main controller's operating status and fault switching. In substep S201, the system first acquires a PWM heartbeat signal and a CAN heartbeat signal. These two signals, transmitted through different transmission channels, reflect the main controller's operating status. The PWM heartbeat signal reflects the main controller's operating status through its frequency changes, while the CAN heartbeat signal serves as an independent signal source, increasing the reliability of status monitoring. In substep S202, if the system detects the presence of the CAN heartbeat signal and the PWM heartbeat signal's frequency is within the normal range, it generates a message indicating that the main controller is operating normally, and the system remains in its original state. However, in substep S203, if the system detects the absence of the PWM heartbeat signal or an abnormal frequency, this is interpreted as a signal of abnormal operation of the main controller. In this case, the system immediately generates a message indicating a main controller failure and triggers the slave controller to enter operating mode, seamlessly taking over the control tasks of the main controller, thereby ensuring continuous and stable operation of the entire system. This process not only improves system reliability but also effectively reduces the risk of system downtime due to main controller failure.

[0101] In some embodiments, to enhance the sensitivity of the master-slave redundant control system to the operating state of the master controller, the safety threshold range is configured as (1±5%) times the theoretical frequency value. Among them, the theoretical frequency value is preset according to the normal operating state of the master controller, and when the frequency of the PWM heartbeat signal falls within this safety threshold range, the system judges that the master controller is in a normal state. If the frequency deviates from this range, even if the CAN heartbeat signal is normal, the system will consider that the master controller may have a potential fault, thereby triggering the takeover mechanism of the slave controller. Such design further enhances the sensitivity of the system to the operating state of the master controller, ensuring that any subtle abnormalities can be quickly responded to, maintaining the overall stability and safety of the system.

[0102] In some embodiments, to further enhance the reliability and anti-interference ability of the PWM heartbeat signal, the slave controller includes an optoelectronic coupling circuit, a comparator circuit and a second single-chip microcomputer, and the frequency of the PWM heartbeat signal obtained in sub-step S201 is refined to include: optically coupling the input PWM heartbeat signal through the optoelectronic coupling circuit; comparing the optically coupled PWM heartbeat signal with the pre-set reference voltage through the comparator circuit to generate a deviation signal between the PWM heartbeat signal and the reference voltage, and sending it to the second single-chip microcomputer; obtaining the frequency of the deviation signal as the frequency of the PWM heartbeat signal through the second single-chip microcomputer.

[0103] It should be noted that the types of optoelectronic coupling circuit and comparator circuit are not limited, as long as they can meet the functional requirements of optically coupling the PWM heartbeat signal and comparing it with the reference voltage. In actual application, appropriate types of optoelectronic coupling circuit and comparator circuit can be selected according to specific circuit design and performance requirements.

[0104] Among them, the optoelectronic coupling circuit plays the role of electrical isolation, effectively preventing possible electrical interference between the master controller and the slave controller, ensuring the reliability and stability of the PWM heartbeat signal. The comparator circuit is responsible for comparing the voltage level of the PWM heartbeat signal with the pre-set reference voltage, which is crucial because it can accurately capture the slight changes in the PWM heartbeat signal, which may be early signs of abnormal operating state of the master controller. The second single-chip microcomputer as an intelligent processing unit quickly responds and calculates the frequency of the deviation signal, which not only reflects the actual state of the PWM heartbeat signal, but also becomes an important basis for the system to judge the health state of the master controller. Through such refined design, the slave controller can more accurately and quickly capture potential problems of the master controller, thereby further improving the overall performance and reliability of the master-slave redundant control system.

[0105] In some embodiments, in order to adapt to the complex and changeable industrial environment, the CAN heartbeat signal is sent in the form of a CAN message. The CAN message contains a cycle counter and a CRC check field. The slave controller determines that the CAN message is valid only when the cycle counter is continuous and the CRC check is correct. Among them, the cycle counter ensures that each CAN message is unique, which can effectively prevent the duplication or loss of messages and enhance the reliability of communication. The CRC check field verifies the content of the CAN message to ensure that no errors occur during the data transmission process, further improving the accuracy of communication. Only when the cycle counter increases continuously and the CRC check passes, the slave controller will determine that the received CAN heartbeat signal is valid. This mechanism greatly enhances the robustness and fault tolerance of the system. Through such a design, the master-slave redundant control system can maintain stable operation in a complex and changeable industrial environment, providing strong support for industrial automation and intelligence.

[0106] In some embodiments, in order to implement a flexible switching mechanism, the master-slave redundancy control method further includes the following step S50.

[0107] Step S50: After the slave controller enters the working mode, when the master controller returns to normal and the current operating state of the master controller meets the preset switchback condition, the master-slave redundant control system switches back to the master controller for control.

[0108] Among them, through step S50, the system implements a flexible switching mechanism. This step ensures that when the main controller returns to normal after a short failure, it can quickly take over control, thereby improving the availability and efficiency of the entire system. The switchback conditions may include the main controller running stably for a period of time and no error reports. The setting of these conditions is intended to ensure that the main controller has indeed returned to a stable state and avoid frequent meaningless switching. Through such a design, the master-slave redundant control system can not only provide seamless backup control when the main controller fails, but also quickly restore the original control path after the main controller recovers, providing a more reliable and efficient control solution for industrial automation and intelligent applications.

[0109] Figure 2 A schematic diagram of a master-slave redundant control system provided by at least one embodiment of the present disclosure. Figure 2 As shown, the master-slave redundant control system 1 includes a master controller 11 and a slave controller 12. The connection harness between the master controller 11 and the slave controller 12 includes a CAN bus and a hard line.

[0110] The master controller 11 is configured to generate a PWM heartbeat signal and a CAN heartbeat signal based on the current operating status of the master controller 11 in each control cycle, and send the PWM heartbeat signal and the CAN heartbeat signal to the slave controller 12 simultaneously through a hard line and a CAN heartbeat signal through a CAN bus, wherein the PWM heartbeat signal and the CAN heartbeat signal are related.

[0111] The slave controller 12 is configured to start a pre-set redundant control switching logic after receiving the PWM heartbeat signal and the CAN heartbeat signal, wherein the redundant control switching logic is configured to control the slave controller 12 to enter the working mode based on the mutual verification of the PWM heartbeat signal and the CAN heartbeat signal to identify that the main controller 11 fails, so as to take over the control task of the main controller 11.

[0112] The specific manner in which each controller performs operations in the above system embodiment has been described in detail in the embodiment of the method, and will not be elaborated on here.

[0113] Figure 3 A schematic diagram of another master-slave redundant control system provided by at least one embodiment of the present disclosure. Figure 3 As shown, in Figure 2 On the basis of the present invention, the main controller 11 includes a heartbeat signal output circuit 111, a first single-chip microcomputer 112, a first logic device 113, a first communication interface 114 and a first Ethernet interface 115. The heartbeat signal output circuit 111 is configured to convert the control signal input thereto into a PWM heartbeat signal. The control output end of the first single-chip microcomputer 112 is connected to the input end of the heartbeat signal output circuit 111, and the first single-chip microcomputer 112 is configured to generate a control signal and a CAN heartbeat signal based on the current operating state of the main controller 11. The first logic device 113 communicates bidirectionally with the first single-chip microcomputer 112, and the first logic device 113 is configured to implement the transceiver control of the main controller 11. One end of the first communication interface 114 is connected to the first logic device 113, the other end of the first communication interface 114 is connected to the hard line, and the first communication interface 114 is configured to send the PWM heartbeat signal through the hard line. One end of the first Ethernet interface 115 is connected to the first logic device 113 , and the other end of the first Ethernet interface 115 is connected to the CAN bus. The first Ethernet interface 115 is configured to send a CAN heartbeat signal through the CAN bus.

[0114] Among them, through the configuration of the above-mentioned main controller 11, a dual transmission mode of the heartbeat signal is realized, that is, the PWM heartbeat signal is transmitted through the hard line, and the CAN heartbeat signal is transmitted through the CAN bus. This design enhances the reliability and stability of the system. In the master-slave redundant control system, when the main controller 11 is operating normally, it will continue to generate and send heartbeat signals to indicate that its working status is normal. The slave controller will receive and detect these heartbeat signals to determine whether the main controller is still online and operating normally. If the main controller 11 fails or loses response, it will stop sending CAN heartbeat signals and PWM heartbeat signals. After detecting the absence of the PWM heartbeat signal, the slave controller will take over the function of the main controller according to the preset redundant switching logic to ensure that the system can continue to operate normally. This master-slave redundant control method greatly improves the fault tolerance and availability of the system, and is suitable for application scenarios with high requirements for system stability and reliability.

[0115] like Figure 3 As shown, in order to improve the stability and reliability of the master-slave redundant control system, the slave controller 12 includes a heartbeat signal acquisition circuit 121, a second single-chip microcomputer 122, a second logic device 123, a second communication interface 124 and a second Ethernet interface 125. One end of the first Ethernet interface 115 is connected to the second logic device 123, the other end of the first Ethernet interface 115 is connected to the CAN bus, and the second Ethernet interface 125 is configured to receive a CAN heartbeat signal via the CAN bus. One end of the second communication interface 124 is connected to the second logic device 123, the other end of the second communication interface 124 is connected to a hard line, and the second communication interface 124 is configured to receive a PWM heartbeat signal via a hard line. The heartbeat signal acquisition circuit 121 is configured to receive the CAN heartbeat signal of the second communication interface 124. The input end of the second single-chip microcomputer 122 is connected to the output end of the heartbeat signal acquisition circuit 121. The second single-chip microcomputer 122 is configured to start its built-in redundant control switching logic after receiving the PWM heartbeat signal and the CAN heartbeat signal; the second logic device 123 communicates bidirectionally with the second single-chip microcomputer 122, and the second logic device 123 is configured as the transceiver control of the controller.

[0116] Among them, through the configuration of the above-mentioned slave controller 12, dual monitoring of the heartbeat signal between the master controller 11 and the slave controller 12 can be achieved. When the PWM heartbeat signal of the second communication interface 124 and the CAN heartbeat signal forwarded through the second Ethernet interface 125 are successfully received by the slave controller 12, the slave controller 12 confirms that the master controller 11 is in normal working condition and does not perform master-slave switching. If any heartbeat signal is lost, the slave controller 12 will start the built-in redundant control switching logic to evaluate whether the master-slave role switching is needed to ensure the stability and reliability of the entire system. This configuration not only improves the redundancy of the master-slave redundant control system, but also enhances the fault detection and recovery capabilities of the master-slave redundant control system.

[0117] In some embodiments, the heartbeat signal output circuit 111 includes a high-side drive circuit, and the signal end of the PWM heartbeat signal is located at the output end of the high-side drive circuit. The high-side control circuit includes a PMOS transistor, which serves as a high-side control switch of the high-side control circuit. The gate of the PMOS transistor receives a control signal for controlling the on and off state of the PMOS transistor. When the control signal is at a high level, the PMOS transistor is turned on, and the PWM heartbeat signal is output to the output end of the high-side drive circuit; when the control signal is at a low level, the PMOS transistor is turned off, and the PWM heartbeat signal is blocked and not output to the output end of the high-side drive circuit. This design enables the heartbeat signal output circuit 111 to flexibly control the output of the PWM heartbeat signal, thereby improving the reliability and stability of the master-slave redundant control system. At the same time, the design of the high-side drive circuit also helps to enhance the driving capability of the PWM heartbeat signal, ensuring that the signal can be accurately and stably transmitted to the slave controller 12, further improving the performance of the master-slave redundant control system.

[0118] Figure 4 Schematic diagram of a heartbeat signal output circuit provided by at least one embodiment of the present disclosure. Figure 4As shown, the heartbeat signal output circuit includes resistors R1, R2, R3, R4, R5, an NPN transistor Q1, a PMOS transistor Q2, a Zener diode D1, a diode D2, and a capacitor C1. The high-side driver circuit includes a Zener diode D1, a resistor R4, and a PMOS transistor Q2. The base of the NPN transistor is connected to the microcontroller's control signal via resistor R1 and to ground GND via resistor R2. The emitter of the NPN transistor is connected to ground GND. The collector of the NPN transistor is connected to the gate of the PMOS transistor Q2 via resistor R3. The gate of the PMOS transistor Q2 is also connected to the external power supply VBAT via resistor R4 and to the external power supply VBAT via Zener diode D1. The source of the PMOS transistor Q2 is divided into three paths via resistor R5: the first path is connected to ground GND via diode D2, the second path is connected to ground via capacitor C1, and the third path serves as the signal terminal for the PWM heartbeat signal. The signal end of the PWM heartbeat signal is configured to output the PWM heartbeat signal to the master controller 11 or the slave controller 12 to achieve master-slave redundant control. In this embodiment, the heartbeat signal output circuit controls the conduction or cutoff of the NPN transistor through the control signal, thereby controlling the gate voltage of the PMOS transistor Q2, thereby controlling the conduction or cutoff of the PMOS transistor Q2. When the PMOS transistor Q2 is turned on, the external power supply VBAT provides a voltage to the signal end of the PWM heartbeat signal through the PMOS transistor Q2, outputting a high-level PWM heartbeat signal; when the PMOS transistor Q2 is turned off, the signal end of the PWM heartbeat signal is discharged to the ground GND through the resistor R5, the diode D2 and the capacitor C1, outputting a low-level PWM heartbeat signal. By continuously changing the level of the control signal, a PWM heartbeat signal with a specific frequency and duty cycle can be generated for heartbeat detection in master-slave redundant control. The first single-chip microcomputer 112 controls the PMOS tube to generate a high-side PWM signal output as a PWM heartbeat signal. The use of a high-side PWM heartbeat can make the PWM heartbeat signal level amplitude larger and reduce the influence of interference signals. The use of a PMOS tube can be turned on and off without establishing a higher gate voltage.

[0119] In some embodiments, to accurately and reliably collect and transmit PWM heartbeat signals, the heartbeat signal acquisition circuit 121 includes a photoelectric coupling circuit and a comparator circuit. The input of the photoelectric coupling circuit is connected to a hardwire, and the output of the photoelectric coupling circuit is connected to the input of the comparator circuit. The photoelectric coupling circuit is used to achieve electrical isolation between its input and output. The reference terminal of the comparator circuit is connected to a preset reference voltage, and the output of the comparator circuit is connected to the second single-chip microcomputer 122. The photoelectric coupling circuit is capable of receiving a heartbeat signal from the hardwire, which may be an analog or digital signal. When the heartbeat signal is transmitted to the input of the photoelectric coupling circuit via the hardwire, the light-emitting diode within the photoelectric coupler emits light, triggering the phototransistor to turn on or off, achieving electrically isolated signal transmission. This ensures that even if high voltage or interference signals are present on the hardwire, they will not affect subsequent circuits. The comparator circuit is responsible for comparing the signal output by the photoelectric coupling circuit with a preset reference voltage. If the signal voltage output by the photoelectric coupling circuit is higher than the reference voltage, the comparator circuit outputs a high-level signal; otherwise, it outputs a low-level signal. This high and low level signal represents the state of the heartbeat signal and is transmitted to the second single chip microcomputer 122 for further processing or judgment. Through such a design, the heartbeat signal acquisition circuit 121 can accurately and reliably collect and transmit the heartbeat signal, providing important information basis for subsequent master-slave redundancy control.

[0120] Figure 5 A schematic diagram of a heartbeat signal acquisition circuit provided by at least one embodiment of the present disclosure. Figure 5As shown, the heartbeat signal acquisition circuit includes resistors R6, R7, R8, R9, R10, R11, R12, an NPN transistor Q3, a photocoupler M1, a comparator M2, a diode D3, a diode D4, a diode D5, a capacitor C3, and a capacitor C4. The photocoupler circuit includes resistors R6, R7, R8, a diode D3, a diode D4, a diode D5, an NPN transistor Q3, and a capacitor C3. The comparator circuit includes resistors R9, R10, R11, and comparator M2. The positive input terminal of the photocoupler is connected to the PWM heartbeat signal input terminal via diode D3, and is connected to the base of the NPN transistor Q3 and the positive terminal of diode D5 via resistor R7. The negative input terminal of the photocoupler is connected to the collector of the NPN transistor Q3. The emitter of the NPN transistor Q3 is grounded via resistor R6. The negative terminal of diode D5 is grounded via diode D4. A capacitor C3 is connected between the anode of diode D3 and the cathode of diode D4. The anode of the photocoupler's output is connected to the external power supply VCC via resistor R8 and to the positive input of the comparator via resistor T9. The cathode of the photocoupler's output is grounded. The positive input of the comparator is also grounded via resistor R10 and to the comparator's output via resistor R11. The negative input of the comparator is connected to a reference voltage VREF. The comparator's output is divided into three paths: the first path is connected to the external power supply VCC via resistor R12, the second path is grounded via capacitor C4, and the third path serves as the PWM heartbeat signal acquisition signal and is input into the second single-chip microcomputer 122. Among them, the input end of the heartbeat signal acquisition circuit adopts an isolated ground, and the PWM heartbeat signal first enters the photoelectric coupler for conversion between the input electrical signal and the optical signal. Then, the comparator is used to compare the input signal processed by the photocoupler with the reference voltage VREF, and output it to the single-chip microcomputer. The single-chip microcomputer collects the specific frequency and identifies whether it is within the set safety threshold. It is then mutually verified with the heartbeat detection information transmitted between the main controller 11 and the slave controller 12 through the CAN message, and this is used as the basis for switching between the main controller 11 and the slave controller 12 to realize dual redundant control switching.

[0121] In some embodiments, in order to facilitate fault analysis and maintenance, the master controller 11 and the slave controller 12 have the same hardware architecture; and the master controller 11 and the slave controller 12 also include respective fault recording modules, which are configured to record redundant control switching events, fault types, and timestamps. Among them, the fault recording module also has a self-detection function, which can monitor and record its own working status in real time to ensure the accuracy and reliability of fault information. When a fault occurs in the master controller 11 or the slave controller 12, the fault recording module will immediately capture and record the switching event, including the time when the switching occurred, the fault type, and the specific cause of the switching. This information is crucial for subsequent fault analysis and system maintenance. In addition, the fault recording module also supports the export of fault logs through a standard interface, which facilitates technicians to perform remote fault diagnosis and data analysis, further improving the reliability and maintainability of the system.

[0122] The embodiment of the present disclosure further provides a storage medium, which stores a program or instruction. When the program or instruction is executed by a processor, the steps of the above method embodiment are implemented.

[0123] The present disclosure also provides a program product, such as Figure 6 As shown, the program product includes one or more processors 21 and a memory 22. Figure 6 A processor 21 is taken as an example.

[0124] The controller may further include an input device 23 and an output device 24 .

[0125] The processor 21, the memory 22, the input device 23 and the output device 24 may be connected via a bus or other means. Figure 6 The bus connection is taken as an example.

[0126] The processor 21 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips. The general-purpose processor can be a microprocessor or any conventional processor.

[0127] Memory 22, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the program instructions / modules corresponding to the methods in the embodiments of the present disclosure. Processor 21 executes the non-transitory software programs, instructions, and modules stored in memory 22 to execute various functional applications and data processing of the server, thereby implementing the steps of the above-mentioned method embodiments.

[0128] The memory 22 may include a program storage area and a data storage area, wherein the program storage area may store the application programs required for the operating device and at least one function; the data storage area may store data created based on the use of the processing device operated by the server, etc. In addition, the memory 22 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 22 may optionally include a memory remotely located relative to the processor 21, and these remote memories may be connected to a network connection device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0129] The input device 23 can receive input digital or character information and generate key signal input related to the driver's settings and function control of the processing device of the server. The output device 24 can include a display device such as a display screen.

[0130] One or more modules are stored in the memory 22 and when executed by one or more processors 21, perform the following operations: Figure 1 The method shown.

[0131] Those skilled in the art will appreciate that all or part of the processes in the above method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (FM), a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above types of memory.

[0132] Although the embodiments of the present disclosure have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

[0133] Although the embodiments of the present disclosure have been shown and described above, it is understood that the above embodiments are illustrative and are not to be construed as limitations on the present disclosure. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present disclosure.

Claims

1. A master-slave redundant control method, applied to a master-slave redundant control system having a master controller and a slave controller, characterized in that: The connection harness between the master controller and the slave controller includes a CAN bus and a hard line, and the master-slave redundant control method includes: In each control cycle, controlling the master controller to generate a PWM heartbeat signal and a CAN heartbeat signal based on a current operating state of the master controller, and simultaneously sending the PWM heartbeat signal through the hard line and the CAN heartbeat signal through the CAN bus to the slave controller, wherein the PWM heartbeat signal and the CAN heartbeat signal are correlated; and After the slave controller receives the PWM heartbeat signal and the CAN heartbeat signal, the slave controller is controlled to start its built-in redundant control switching logic, wherein the redundant control switching logic is configured to control the slave controller to enter a working mode to take over the control task of the master controller when a fault occurs to the master controller based on mutual verification of the PWM heartbeat signal and the CAN heartbeat signal.

2. The master-slave redundancy control method according to claim 1, characterized in that: The master controller is used to generate various types of control signals and process various types of control tasks, and the slave controller is used to process the control tasks of the master controller when a failure occurs in the master controller. In addition, the master-slave redundancy control method further includes: In each control cycle, controlling the main controller to start detecting its current operating state; and When the slave controller recognizes that the master controller fails, it disconnects the output of the master controller.

3. The master-slave redundancy control method according to claim 1 or 2, characterized in that: The main controller includes a first single-chip microcomputer and a heartbeat signal output circuit, wherein the heartbeat signal output circuit is configured to generate the PWM heartbeat signal based on a control signal of the first single-chip microcomputer, wherein the period and duty cycle of the PWM heartbeat signal are fixed, and the controlling the main controller to generate the PWM heartbeat signal and the CAN heartbeat signal based on the current operating state of the main controller includes: Obtaining the current operating status of the main controller; generating a control signal of the first single-chip microcomputer and the CAN heartbeat signal based on a current operating state of the main controller, wherein the control signal of the first single-chip microcomputer is related to the CAN heartbeat signal; and The first single-chip microcomputer is controlled to output the control signal to the heartbeat signal output circuit, so that the heartbeat signal output circuit generates and outputs the PWM heartbeat signal.

4. The master-slave redundancy control method according to claim 3, characterized in that: The redundant control switching logic includes: Obtain the PWM heartbeat signal and the CAN heartbeat signal, and obtain the frequency of the PWM heartbeat signal; In response to the CAN heartbeat signal being true and the frequency of the PWM heartbeat signal being within a preset safety threshold range, generating first information for indicating that the current operating state of the main controller is normal; and In response to the PWM heartbeat signal being false or the frequency of the PWM heartbeat signal exceeding a preset safety threshold range, second information is generated to characterize a failure of the master controller, and the slave controller is controlled to enter a working mode to take over the control task of the master controller.

5. The master-slave redundancy control method according to claim 4, characterized in that: The slave controller includes a photoelectric coupling circuit, a comparator circuit and a second single-chip microcomputer, and the obtaining of the frequency of the PWM heartbeat signal includes: Performing optical coupling isolation on the input PWM heartbeat signal through the optical coupling circuit; Comparing the optically isolated PWM heartbeat signal with a preset reference voltage through the comparator circuit, generating a deviation signal between the PWM heartbeat signal and the reference voltage, and sending the deviation signal to the second single-chip microcomputer; and The frequency of the deviation signal is obtained by the second single-chip microcomputer as the frequency of the PWM heartbeat signal.

6. A master-slave redundant control system, characterized in that: Including master controller and slave controller; Wherein, the connection harness between the master controller and the slave controller includes a CAN bus and a hard line; The master controller is configured to generate a PWM heartbeat signal and a CAN heartbeat signal based on a current operating state of the master controller in each control cycle, and simultaneously send the PWM heartbeat signal through the hard line and the CAN heartbeat signal through the CAN bus to the slave controller, wherein the PWM heartbeat signal and the CAN heartbeat signal are correlated; The slave controller is configured to start a pre-set redundant control switching logic after receiving the PWM heartbeat signal and the CAN heartbeat signal, wherein the redundant control switching logic is configured to control the slave controller to enter a working mode based on mutual verification of the PWM heartbeat signal and the CAN heartbeat signal to identify that the master controller fails, so as to take over the control tasks of the master controller.

7. The master-slave redundant control system according to claim 6, characterized in that: The main controller includes: a heartbeat signal output circuit, wherein the heartbeat signal output circuit is configured to convert an input control signal thereof into the PWM heartbeat signal; a first single-chip microcomputer, wherein a control output terminal of the first single-chip microcomputer is connected to an input terminal of the heartbeat signal output circuit, and the first single-chip microcomputer is configured to generate the control signal and the CAN heartbeat signal based on a current operating state of the main controller; a first logic device, the first logic device bidirectionally communicating with the first single-chip microcomputer, and the first logic device being configured to implement transceiver control of the main controller; a first communication interface, one end of the first communication interface being connected to the first logic device, the other end of the first communication interface being connected to the hard line, and the first communication interface being configured to send the PWM heartbeat signal through the hard line; and A first Ethernet interface, one end of the first Ethernet interface is connected to the first logic device, the other end of the first Ethernet interface is connected to the CAN bus, and the first Ethernet interface is configured to send the CAN heartbeat signal through the CAN bus.

8. The master-slave redundant control system according to claim 7, characterized in that: The slave controller includes: a second Ethernet interface, wherein one end of the first Ethernet interface is connected to the second logic device, the other end of the first Ethernet interface is connected to the CAN bus, and the second Ethernet interface is configured to receive the CAN heartbeat signal through the CAN bus; a second communication interface, one end of the second communication interface being connected to the second logic device, the other end of the second communication interface being connected to the hard line, and the second communication interface being configured to receive the PWM heartbeat signal through the hard line; A heartbeat signal acquisition circuit, configured to receive a CAN heartbeat signal from the second communication interface; a second single-chip microcomputer, wherein an input terminal of the second single-chip microcomputer is connected to an output terminal of the heartbeat signal acquisition circuit, and the second single-chip microcomputer is configured to activate its built-in redundant control switching logic after receiving the PWM heartbeat signal and the CAN heartbeat signal; and A second logic device, wherein the second logic device communicates bidirectionally with the second single-chip microcomputer, and the second logic device is configured as a transceiver control of the controller.

9. The master-slave redundant control system according to claim 8, characterized in that: The heartbeat signal output circuit includes a high-side drive circuit, and the signal end of the PWM heartbeat signal is located at the output end of the high-side drive circuit. The high-side control circuit includes a PMOS transistor, and the PMOS transistor serves as a high-side control switch of the high-side control circuit; and The heartbeat signal acquisition circuit includes a photoelectric coupling circuit and a comparator circuit. The input end of the photoelectric coupling circuit is connected to the hard wire, and the output end of the photoelectric coupling circuit is connected to the input end of the comparator circuit. The photoelectric coupling circuit is used to achieve electrical isolation between its input end and its output end. The reference end of the comparator circuit is connected to a preset reference voltage, and the output end of the comparator circuit is connected to the second single-chip microcomputer.

10. The master-slave redundant control system according to any one of claims 6 to 9, characterized in that: The master controller and the slave controller have the same hardware architecture; and The master controller and the slave controller further include respective fault recording modules, which are configured to record redundant control switching events, fault types, and timestamps.

11. A storage medium, characterized in that: The storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the master-slave redundancy control method according to any one of claims 1 to 5 are implemented.

12. A program product comprising a program or instructions, characterized in that When the program or instruction is executed by a processor, the steps of the master-slave redundancy control method according to any one of claims 1 to 5 are implemented.

Images