Control method for information interaction of dual-computer hot backup CPU (Central Processing Unit)

Abstract

The invention provides a control method for information interaction of a dual-computer hot backup CPU (Central Processing Unit), which is characterized in that an I / O (Input / Output) interface of the dual-computer CPU is connected with a peripheral hardware circuit and is matched with a software algorithm to realize information interaction between the dual-computer CPU, a problem can be timely and quickly found and a switching operation can be completed under the condition that a communication interface suddenly fails and data is interrupted, and the reliability of the dual-computer hot backup CPU is improved. And the correctness, continuity and reliability of instruction execution are ensured.

Description

Technical Field

[0001] This invention belongs to the field of embedded system technology, and specifically relates to a control method for information interaction between dual-machine hot backup CPUs. Background Technology

[0002] The primary function of the spacecraft propulsion circuit box is to receive valve control commands from the Guidance, Navigation and Control (GNC) subsystem, and control the opening or closing of engine valves according to the commands, thereby fulfilling the spacecraft's attitude adjustment or orbital change requirements. To increase the reliability of individual units, the propulsion circuit box is designed with a primary and backup hot-redundant CPU system. Two independent communication interfaces simultaneously receive commands from the GNC subsystem. Each CPU independently decodes and parses the command code, outputting the corresponding valve control signal data and a flag indicating its own health status, which is then transmitted to the valve voting output module. The valve voting output module adopts a master-slave voting output mode, normally outputting data from the primary CPU. When the CPU primary communication interface experiences a sudden data interruption due to a fault, the output control of the valve voting output module will switch from primary CPU data output to backup CPU data output, a process that requires a certain amount of time. Although the GNC subsystem uses a closed-loop control method to control the valves, traditional control methods cannot meet the high-precision valve control requirements during special and critical operational periods such as the docking phase and the powered descent phase. Therefore, this invention provides a control method for information interaction between dual-machine hot backup CPUs, which can complete the switching between primary and backup machines more quickly, ensuring that the propulsion circuit box can quickly, correctly, and reliably execute GNC instructions in the event of a communication failure, and ensuring the reliability and safety of the spacecraft thruster attitude and orbit control function.

[0003] Patent document CN110647426A discloses a dual-machine hot backup method, apparatus, system, and computer storage medium, including two computers, each equipped with a hot backup device. For each hot backup device, the method includes: detecting the level signal of a first input pin of the computer, determining the output state of a first output pin of the computer based on the level signal of the first input pin, and determining the state of the computer based on the output state of the first output pin. That is, the dual-machine hot backup system of this embodiment is a symmetrical system. When the hot backup device in one computer malfunctions, the hot backup device in the other computer can accurately determine the primary and backup machines in the system, thereby improving the reliability of the dual-machine hot backup system.

[0004] However, patent document CN110647426A focuses on solving the problem of low reliability caused by arbitration switching circuit failure, but does not solve how to complete the master-slave switchover more quickly. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the purpose of this invention is to provide a control method for information interaction between CPUs in a dual-machine hot backup system.

[0006] According to the present invention, a dual-machine hot backup CPU information interaction circuit is characterized in that it includes: a CPU host, a CPU standby, a trigger circuit, and a valve voting output module.

[0007] The CPU master and CPU standby receive the same communication command data through their respective communication interfaces;

[0008] The CPU master and CPU standby have the same software configuration items, and the master and standby are distinguished by the high and low level of the I / O port input signal;

[0009] The CPU host's "Main I / O Input 1" is at a high level; this signal is read to determine if it is the host.

[0010] The "standby I / O input 1" of the CPU standby unit is at a low level. This signal is read to determine if the CPU is a standby unit.

[0011] "Main I / O Output 1" and "Backup I / O Output 1" are used to represent the status of their respective CPUs and are connected to the I / O ports of the valve voting output module. They are used by the valve voting output module to arbitrate and output the valve control signal of a certain machine.

[0012] The trigger circuit converts the pulse signal of the "standby I / O output 2" of the CPU standby into a high-level signal and connects it to the "main I / O input 2" of the CPU host for the CPU host to query; the "main I / O output 2" of the CPU host is used to reset the trigger circuit, and the output of the trigger circuit becomes low-level, clearing the output to zero.

[0013] Preferably, after receiving a new communication instruction, the standby CPU outputs a pulse signal through "standby I / O output 2" to notify the host CPU of the information;

[0014] After the CPU host detects a high level through "Main I / O Input 2", if the CPU host does not receive a new instruction, it controls "Main I / O Output 2" to reset the trigger circuit and sets the state of "Main I / O Output 1", which represents its own health, to an error.

[0015] Preferably, the "backup I / O output 2" signal of the CPU standby is connected to the set terminal of the trigger circuit. When the "backup I / O output 2" outputs a high pulse signal with a signal width greater than the set time, the trigger circuit outputs a high level, which is then read by the host CPU via "main I / O input 2".

[0016] Preferably, the valve voting output module simultaneously receives bus data from both the CPU master and the CPU standby, and performs arbitration voting based on the output level states of "Master I / O Output 1" and "Standby I / O Output 1". A high output level indicates that the CPU communication status is normal, and a low output level indicates that the CPU communication status is abnormal.

[0017] Preferably, the specific voting output strategy of the valve voting output module is as follows:

[0018]

[0019]

[0020] Arbitration voting adopts a master-slave model strategy.

[0021] Preferably, when only one machine is in the correct state, the bus data of that machine is output; when both machines are in the correct state, the bus data of the host machine is output; when both machines are in the wrong state, the valve voting output module has no output.

[0022] Preferably, the CPU master and CPU standby operate in a dual-hot-engine mode. The CPU master is connected to communication interface C1 to receive communication commands and send telemetry data. The CPU standby is connected to communication interface C2 to receive communication commands and send telemetry data.

[0023] Preferably, the outputs of the I / O ports are equipped with filtering circuits to shape and filter the output signals.

[0024] A control method for dual-machine hot backup CPU information interaction provided by the present invention includes:

[0025] Step (1): Run the dual-machine hot backup CPU information exchange software function once at regular intervals;

[0026] Step (2): Determine whether a new instruction has been received from the communication interface; if a new instruction has been received, proceed to step (3); if no new instruction has been received, proceed to step (7).

[0027] Step (3): Determine whether it is a CPU host. If it is a CPU host, proceed to step (4). If it is a CPU standby, proceed to step (6).

[0028] Step (4): Delay and wait for the signal to stabilize;

[0029] Step (5): The CPU host’s “Main I / O Output 2” outputs a high pulse to reset the trigger circuit, causing the trigger circuit to output a low level; the CPU host’s “Main I / O Output 1” outputs a high level, and the CPU host sets the information representing its own health status; after the trigger circuit is reset, it returns to step (1).

[0030] Step (6): The standby CPU’s “standby I / O output 2” outputs a high pulse to set the trigger circuit, causing the trigger circuit to output a high level, indicating that the standby CPU has received a new instruction for the host CPU to query; the standby CPU’s “standby I / O output 1” outputs a high level, and the standby CPU sets the information representing its own health status; after the trigger circuit is set, return to step (1).

[0031] Step (7): Delay and wait for the signal to stabilize;

[0032] Step (8): Determine if it is the CPU host; if it is the CPU host, proceed to step (9); if it is the CPU standby, return to step (1).

[0033] Step (9): Determine if the CPU host's "Main I / O Input 2" is high. If it is high, it means the CPU standby has received a new instruction. Execute step (10), and the CPU host performs subsequent judgment and confirmation work. If it is low, it is assumed that neither the CPU host nor the CPU standby has received a new instruction, and return directly to step (1).

[0034] Step (10): The CPU host’s “Main I / O Output 2” outputs a high pulse to reset the trigger circuit, causing the trigger circuit to output a low level.

[0035] Step (11): Delay and wait for the signal to stabilize;

[0036] Step (12): Determine whether "Main I / O Input 2" is low. If it is high, the trigger circuit is considered to be faulty and the reset is unsuccessful. Return directly to step (1). If it is low, it means that the trigger circuit is working normally. It means that the CPU standby machine has received a new instruction but the CPU host has not received a new instruction. The CPU host will execute step (13) in the subsequent operation.

[0037] In step (13), the CPU host’s “Main I / O Output 1” outputs a low level, the host CPU sets the information representing its own health status to an error, and returns to step (1).

[0038] Preferably, the dual-machine hot backup CPU information interaction circuit described above is used.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. This invention relates to an I / O interface for dual-CPU systems that connects to peripheral hardware circuits and uses software algorithms to enable information exchange between the two CPUs. In the event of a sudden data interruption due to a communication interface failure, the system can quickly detect the problem and complete the switching operation, ensuring the correctness, continuity, and reliability of instruction execution.

[0041] 2. This invention enables faster primary / backup switchover, ensuring rapid, accurate, and reliable command execution even in the event of a single communication interface failure. This meets the requirements for high-precision and high-timeliness control, guaranteeing the reliability and safety of spacecraft thruster attitude and orbit control functions. The communication cycle for GNC control commands is typically 80–500ms. Due to the significant deviation in the GNC control command transmission cycle, traditional primary / backup switchover requires at least one communication cycle. This invention solves the problem of untimely CPU output conversion in dual-machine hot backup, reducing the conversion time from ≥80ms (one communication cycle) to 8ms.

[0042] 3. This invention solves the problem that the dual-machine hot redundancy CPU of the propulsion circuit box can quickly switch to the standby machine output in the event of a communication failure of the host machine, ensuring that no GNC instruction is missed, thereby increasing the timeliness and reliability of the propulsion circuit box in receiving and executing instructions.

[0043] 4. This invention detects communication interface faults through interactive circuits, regardless of the communication bus type, and is applicable to dual-machine hot redundancy systems, thereby improving the reliability and security of the communication interface. Attached Figure Description

[0044] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0045] Figure 1 This is a schematic diagram of the dual-machine hot backup CPU information interaction circuit of the present invention.

[0046] Figure 2 This is a schematic diagram of the information interaction software process of the present invention. Detailed Implementation

[0047] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0048] This invention discloses a control method for information interaction between dual-machine hot-standby CPUs. The CPU master and CPU standby operate in a dual-hot-machine mode. The CPU master is connected to communication interface C1 to receive communication commands and send telemetry data. The CPU standby is connected to communication interface C2 to receive communication commands and send telemetry data.

[0049] like Figure 1The diagram shows a dual-machine hot backup CPU information interaction circuit. The dual-machine hot backup CPU information interaction hardware circuit includes: two CPUs, two communication interfaces, a voting output module, a trigger circuit, and several filtering circuits.

[0050] After receiving a new communication command, the CPU standby unit outputs a pulse signal through "Standby I / O Output 2" to notify the CPU master unit of the information.

[0051] The trigger circuit is used to convert the pulse signal output from the CPU standby I / O port into a high-level signal and send it to the CPU host I / O port for the CPU host to query.

[0052] After the CPU host detects a high level through "Main I / O Input 2", if the CPU host does not receive a new instruction, it controls "Main I / O Output 2" to reset the trigger circuit and sets the state of "Main I / O Output 1", which represents its own health, to an error.

[0053] The primary and standby CPUs receive the same communication command data through their respective communication interfaces, with a time difference of less than 10μs between the two interfaces receiving the same instruction frame. The primary and standby CPUs have identical software configurations and are distinguished by the high and low levels of I / O port input signals. For example... Figure 1 As shown, when "Main I / O Input 1" is high, the software determines it to be the master unit by reading this signal; when "Backup I / O Input 1" is low, the software determines it to be the backup unit by reading this signal.

[0054] All I / O port outputs are equipped with filtering circuits to shape and filter the output signals, preventing erroneous outputs due to signal interference. "Main I / O Output 1" and "Backup I / O Output 1" represent the status of their respective CPUs. Their outputs, after passing through their respective filtering circuits, are connected to the I / O ports of the valve voting output module for arbitration of valve control signals from a specific unit. The voltage levels are controlled by the CPU software; a high voltage level indicates normal communication, while a low voltage level indicates a communication malfunction.

[0055] The trigger circuit converts the pulse signal from "Backup I / O Output 2" into a high-level signal and connects it to "Main I / O Input 2" for the CPU host to query. "Main I / O Output 2" resets the trigger circuit, causing its output to go low and clear the output. The configuration includes the "Backup I / O Output 2" signal being connected to the set terminal of the trigger circuit via filter circuit 2. When "Backup I / O Output 2" outputs a high pulse signal with a width greater than 10μs, the trigger circuit outputs a high level signal, which is then filtered by filter circuit 5 and connected to "Main I / O Input 2" for the host CPU to read. "Main I / O Output 2" is connected to the reset terminal of the trigger circuit via filter circuit 3. When "Main I / O Output 2" outputs a high pulse signal with a width greater than 10μs, it resets the trigger circuit, causing it to output a low level. More specifically, the trigger circuit converts the pulse signal output from the CPU backup I / O port into a high-level signal and sends it to the CPU host I / O port for the CPU host to query. When the CPU master detects a high level through "Main I / O Input 2", it indicates that the CPU standby has received a new instruction. If the CPU master does not receive a new instruction, it controls "Main I / O Output 2" to reset the trigger circuit and sets the "Main I / O Output 1" signal, which indicates its own health, to an error state. The CPU master and CPU standby have the same software configuration items, which is beneficial for software management. The master and standby are distinguished by the high and low levels of the I / O port input signals.

[0056] The valve voting output module simultaneously receives bus data from both the CPU master and backup units. It arbitrates and votes based on the output levels of "Master I / O Output 1" and "Backup I / O Output 1." A high output indicates normal CPU communication, while a low output indicates abnormal CPU communication. The specific voting output strategy of the valve voting output module is detailed in the voting arbitration output description table. The arbitration voting adopts a master-slave mode strategy: when only one unit is in the correct state, it outputs the bus data of that unit; when both units are in the correct state, it outputs the bus data of the master unit; when both units are in the wrong state, the valve voting output module has no output.

[0057] The function of the filtering circuit is to shape and filter the output signal of the I / O port to avoid signal interference and erroneous output.

[0058] Table of Voting Arbitration Output Explanation

[0059]

[0060] The flowchart of the information exchange software for dual-machine hot backup CPUs is shown below. Figure 2 As shown, its software algorithm includes:

[0061] Step (1): Run the dual-machine hot backup CPU information exchange software function once every 8ms. The 8ms timer can be adjusted according to the system's allowable requirements.

[0062] Step (2): Determine if a new instruction has been received from the communication interface. If a new instruction has been received, proceed to step (3); otherwise, proceed to step (7).

[0063] Step (3) determines whether it is a CPU master, the purpose of which is to distinguish between master and standby machines and execute the corresponding operation steps. If it is a CPU master, execute step (4); if it is a CPU standby machine, execute step (6).

[0064] Step (4): Delay for 50μs to wait for the signal to stabilize to avoid the risk of signal misjudgment. The 50μs time can be adjusted according to the actual situation of the system.

[0065] In step (5), "Main I / O Output 2" outputs a 10μs high pulse to reset the trigger circuit, causing the trigger circuit to output a low level. "Main I / O Output 1" outputs a high level, and the CPU host sets the information representing its own health status. After the trigger circuit is reset, return to step (1).

[0066] In step (6), "Backup I / O Output 2" outputs a 10μs high pulse to set the trigger circuit, causing the trigger circuit to output a high level, indicating that the standby CPU has received a new instruction for the host CPU to query. "Backup I / O Output 1" outputs a high level, and the standby CPU sets the information representing its own health status. After the trigger circuit is set, return to step (1);

[0067] Step (7): Delay for 50μs to wait for the signal to stabilize to avoid the risk of signal misjudgment. The 50μs time can be adjusted according to the actual situation of the system.

[0068] Step (8) determines whether it is a CPU master, the purpose of which is to distinguish between master and standby machines and perform corresponding operations. If it is a CPU master, proceed to step (9); if it is a CPU standby machine, return to step (1).

[0069] Step (9): Determine if "Main I / O Input 2" is high. If it is high, it means the CPU standby has received a new instruction. Execute step (10), and the CPU master performs subsequent judgment and confirmation. If it is low, it is assumed that neither the CPU master nor the standby has received a new instruction, and return directly to step (1).

[0070] Step (10): "Main I / O Output 2" outputs a 10μs high pulse to reset the trigger circuit, causing the trigger circuit to output a low level.

[0071] Step (11): Delay for 50μs to wait for the signal to stabilize to avoid the risk of signal misjudgment. The 50μs time can be adjusted according to the actual situation of the system.

[0072] Step (12): Determine whether "Main I / O Input 2" is low. If it is high, the trigger circuit is considered to be faulty and the reset is unsuccessful. Return directly to step (1). If it is low, it means that the trigger circuit is working normally. It means that the CPU standby machine has received a new instruction but the CPU host has not received a new instruction. The CPU host will execute step (13) in the subsequent operation.

[0073] In step (13), the "Main I / O Output 1" outputs a low level, the host CPU sets the information representing its own health status to an error, and returns to step (1).

[0074] In the description of this application, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0075] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A dual-machine hot backup CPU information interaction circuit, characterized in that, include: CPU main unit, CPU backup unit, trigger circuit, valve voting output module; The CPU master and CPU standby receive the same communication command data through their respective communication interfaces; The CPU master and CPU standby have the same software configuration items, and the master and standby are distinguished by the high and low level of the I / O port input signal; The CPU host's "Main I / O Input 1" is at a high level; this signal is read to determine if it is the host. The "standby I / O input 1" of the CPU standby unit is at a low level. This signal is read to determine if the CPU is a standby unit. "Main I / O Output 1" and "Backup I / O Output 1" are used to represent the status of their respective CPUs and are connected to the I / O ports of the valve voting output module. They are used by the valve voting output module to arbitrate and output the valve control signal of a certain machine. The trigger circuit converts the pulse signal of the "standby I / O output 2" of the CPU standby machine into a high-level signal and connects it to the "main I / O input 2" of the CPU host for the CPU host to query; the "main I / O output 2" of the CPU host is used to reset the trigger circuit, and the output of the trigger circuit becomes low-level, clearing the output to zero.

2. The dual-machine hot backup CPU information interaction circuit according to claim 1, characterized in that, After receiving a new communication command, the standby CPU outputs a pulse signal through "Standby I / O Output 2" to notify the host CPU of the information. After the CPU host detects a high level through "Main I / O Input 2", if the CPU host does not receive a new instruction, it controls "Main I / O Output 2" to reset the trigger circuit and sets the state of "Main I / O Output 1", which represents its own health, to an error.

3. The dual-machine hot backup CPU information interaction circuit according to claim 1, characterized in that, The "Backup I / O Output 2" signal of the CPU standby is connected to the set terminal of the trigger circuit. When "Backup I / O Output 2" outputs a high pulse signal with a signal width greater than the set time, the trigger circuit outputs a high level, which is then read by the host CPU via "Main I / O Input 2".

4. The dual-machine hot backup CPU information interaction circuit according to claim 1, characterized in that, The valve voting output module simultaneously receives bus data from both the CPU master and the CPU standby. It performs arbitration voting based on the output level status of "Master I / O Output 1" and "Standby I / O Output 1". A high output level indicates that the CPU communication status is normal, while a low output level indicates that the CPU communication status is abnormal.

5. The dual-machine hot backup CPU information interaction circuit according to claim 1, characterized in that, The specific voting output strategy of the valve voting output module is as follows: Arbitration voting adopts a master-slave model strategy.

6. The dual-machine hot backup CPU information interaction circuit according to claim 5, characterized in that, When only one machine is in the correct state, the bus data of that machine is output; when both machines are in the correct state, the bus data of the master machine is output; when both machines are in the wrong state, the valve voting output module has no output.

7. The dual-machine hot backup CPU information interaction circuit according to claim 1, characterized in that, The CPU master and CPU standby operate in a dual-hot-engine mode. The CPU master is connected to communication interface C1 to receive communication commands and send telemetry data. The CPU standby is connected to communication interface C2 to receive communication commands and send telemetry data.

8. The dual-machine hot backup CPU information interaction circuit according to claim 1, characterized in that, The outputs of the I / O ports are all equipped with filtering circuits to shape and filter the output signals.

9. A control method for information interaction between dual-machine hot backup CPUs, characterized in that, include: Step (1): Run the dual-machine hot backup CPU information exchange software function once at regular intervals; Step (2): Determine whether a new instruction has been received from the communication interface; if a new instruction has been received, proceed to step (3); if no new instruction has been received, proceed to step (7). Step (3): Determine whether it is a CPU host. If it is a CPU host, proceed to step (4). If it is a CPU standby, proceed to step (6). Step (4): Delay and wait for the signal to stabilize; Step (5): The CPU host’s “Main I / O Output 2” outputs a high pulse to reset the trigger circuit, causing the trigger circuit to output a low level; the CPU host’s “Main I / O Output 1” outputs a high level, and the CPU host sets the information representing its own health status; after the trigger circuit is reset, it returns to step (1). Step (6): The standby CPU's "standby I / O output 2" outputs a high pulse to set the trigger circuit, causing the trigger circuit to output a high level, indicating that the standby CPU has received a new instruction for the host CPU to query; the standby CPU's "standby I / O output 1" outputs a high level, and the standby CPU sets the information representing its own health status; after the trigger circuit is set, it returns to step (1). Step (7): Delay and wait for the signal to stabilize; Step (8): Determine if it is the CPU host; if it is the CPU host, proceed to step (9); if it is the CPU standby, return to step (1). Step (9): Determine if the CPU host's "Main I / O Input 2" is high. If it is high, it means the CPU standby has received a new instruction. Execute step (10), and the CPU host performs subsequent judgment and confirmation work. If it is low, it is assumed that neither the CPU host nor the CPU standby has received a new instruction, and return directly to step (1). Step (10): The CPU host’s “Main I / O Output 2” outputs a high pulse to reset the trigger circuit, causing the trigger circuit to output a low level. Step (11): Delay and wait for the signal to stabilize; Step (12): Determine if "Main I / O Input 2" is low. If it is high, the trigger circuit is considered to be faulty and the reset is unsuccessful. Return directly to step (1). If it is low, the trigger circuit is working normally. This means that the CPU standby has received a new instruction but the CPU host has not received a new instruction. The CPU host will execute step (13) in the subsequent operation. In step (13), the CPU host outputs a low level on "Main I / O Output 1", and the host CPU sets the information representing its own health status to an error and returns to step (1).

10. The control method for dual-machine hot backup CPU information interaction according to claim 9, characterized in that, The dual-machine hot backup CPU information interaction circuit according to any one of claims 1 to 8 is adopted.

Images