Dual microcontroller system and control method thereof

Abstract

The invention belongs to the technical field of fault-tolerant control of an electronic system, and particularly relates to a dual-microcontroller system and a control method thereof, and the dual-microcontroller system comprises a hardware architecture and a software architecture; the hardware architecture specifically comprises a main MCU module, a standby MCU module, a dual-power module, a dual-measurement acquisition module, a hardware arbiter and an output switching value module; the software architecture comprises the steps of initializing a data synchronization communication interface of the main MCU module and the standby MCU module, starting the main MCU module and the standby MCU module, reading data of the measurement acquisition module in a working program state machine by the main MCU module, interacting with external equipment through the communication interface and driving switching value output; and when the main MCU module has no fault, the hardware arbiter selects the switching value output of the main MCU module to drive the external equipment, and when the main MCU module has a fault, the hardware arbiter selects the switching value output of the standby MCU to drive the external equipment.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of fault-tolerant control of electronic systems, and in particular to a dual microcontroller system and a control method thereof. BACKGROUND

[0002] In the fields of industrial control, power systems, rail transit, etc. with high reliability requirements, the continuous and stable operation of the system is of great importance, and any interruption can lead to major production safety accidents, power supply paralysis or rail transit operation risks. In order to maximize the reliability and fault-tolerant capability of the system, the industry generally adopts a primary-backup redundancy mechanism as the core technical safeguard measure. This mechanism deploys an online primary unit and a standby backup unit to jointly constitute the system. Under normal working conditions, the primary unit executes the business logic and outputs the control. Once the primary unit fails, the system needs to transfer the control right to the backup unit, which takes over the work to maintain the overall function of the system.

[0003] However, the above-mentioned technology often has the following defects: 1. Long switching time: The traditional primary-backup redundancy mechanism uses "heartbeat" detection and switching decision. It takes hundreds of milliseconds or even longer from detecting a fault to completing the switching, which cannot meet the requirements of scenarios with strict requirements on interruption time; 2. Business interruption: After the control right is switched, the backup unit usually starts running from the initial state or a certain preset checkpoint, resulting in the forced interruption of the business task being executed at the time of failure, loss of data or state, and loss; 3. State inconsistency: The memory states of the primary and backup units are inconsistent during operation. After switching, the backup unit may not be able to immediately take over all the work of the primary unit, and may even issue incorrect control instructions, requiring an additional initialization or state reconstruction process; 4. Lack of top-level coordination: The traditional redundancy design may only back up at the core processor level, while a single failure of peripheral units such as power supply and sensors can still cause the entire system to fail.

[0004] Therefore, there is an urgent need for a primary-backup system solution that can achieve ultra-fast switching and uninterrupted business. The present application provides a dual microcontroller system and a control method thereof. SUMMARY

[0005] In order to make up for the deficiencies of the prior art and solve at least one technical problem raised in the background art.

[0006] The technical solution adopted by the present application to solve its technical problems is: the dual microcontroller system of the present application, comprising a hardware architecture and a software architecture; The hardware architecture specifically comprises a primary MCU module, a backup MCU module, a dual power supply module, a dual measurement and acquisition module, a hardware arbitrator and an output switching quantity module. The main MCU module and the backup MCU module are connected through a high-speed communication interface to form a main-backup MCU data synchronization communication interface for real-time data synchronization. The dual power supply modules independently supply power to the main MCU module and the backup MCU module. The dual measurement and collection modules are independently connected to the main MCU module and the backup MCU module. The input end of the hardware arbitrator is used to receive the running state signals from the main MCU module and the backup MCU module, and the output end is used to control the final output path of the output switching value module. The output switching value module is controlled by the hardware arbitrator to select the switching value command of the main MCU module or the backup MCU module to output to the external device.

[0007] Preferably, the specific running logic of the software architecture includes: After initializing the main-backup MCU data synchronization communication interface, the main MCU module and the backup MCU module are started, the main MCU module reads the measurement and collection module data in the working program state machine, interacts with the external device through the communication interface and drives the switching value output; when the main MCU module is fault-free, the hardware arbitrator selects the main MCU module switching value output to drive the external device, and when the main MCU module has a fault, the hardware arbitrator selects the backup MCU switching value output to drive the external device.

[0008] Preferably, the high-speed communication interface is an SPI or UART interface.

[0009] Preferably, the hardware arbitrator is a hardware logic circuit realized by CPLD or FPGA.

[0010] Preferably, the main MCU module and the backup MCU module are real-time synchronized in the current state of the state machine, the key variables in the memory and the calculation results through a data synchronization mechanism. The data synchronization mechanism specifically includes: A data segment specially used for data synchronization is defined in the link script, the variables that need to be synchronized are stored in the data segment using the compiler attribute, a CRC checksum field is defined at the tail of the data segment, the main MCU module actively synchronizes the data segment to the backup MCU module in the main loop, the backup MCU module checks the synchronization data, and updates the local data segment after the check is passed.

[0011] The control method of the dual microcontroller system of the application is applied to the above-mentioned dual microcontroller system, and includes an initialization phase, a normal running and synchronization phase, and a fault detection and seamless switching phase.

[0012] Preferably, the initialization phase specifically includes the following steps: A1. Initialize the data synchronization communication interface between the main MCU module and the backup MCU module; A2. Start the working program state machine of the main MCU module and the standby MCU module, and run the same working program on both.

[0013] Preferably, the normal operation and synchronization phase specifically includes the following steps: B1. The main MCU module acts as the control entity, and its state machine operation state is output in the form of switch output. B2. The main MCU module synchronizes its current state of state machine, key variables in memory, and calculation results to the backup MCU module in real time through a data synchronization mechanism. B3. The main MCU module continuously sends a "normal operation" signal to the hardware arbitrator.

[0014] Preferably, the fault detection and seamless handover phase specifically includes the following steps: C1. Fault detection: The hardware arbiter monitors the operating status signals of the main MCU module and the backup MCU module; C2. Hardware Arbitration: When the hardware arbitrator detects a fault in the main MCU module, it immediately switches the control of the output switch module to the backup MCU module. C3. Seamless Business Transition: The backup MCU module takes over the business logic from the point of failure based on synchronized status and memory data.

[0015] The technical effects of this invention are as follows: 1. Fast switching path based on hardware arbitrator: An independent hardware arbitrator is innovatively introduced. This hardware arbitrator directly listens to the operating status signals issued by the main and backup MCU modules and controls the selection of the final switch output based on pure hardware logic, forming a fast switching path independent of MCU software decision-making.

[0016] 2. Lossless business takeover based on fine-grained state machine and real-time memory synchronization: The business logic of the software architecture is designed using a fine-grained state machine. The main and backup MCU modules synchronize the current state of the state machine, process context and all critical memory data in real time through a high-speed communication interface. This makes the backup MCU module not only run the same program as the main MCU module, but also maintain a completely consistent runtime state.

[0017] 3. Full-link hardware redundancy and collaborative design: This invention is not a simple dual MCU backup, but a complete redundancy architecture including dual power supply, dual measurement and acquisition modules, dual MCUs, and the final hardware arbitration and output selection. Furthermore, the synchronization mechanism between the hardware arbitrator and the MCU is designed collaboratively. Attached Figure Description

[0018] The invention will now be further described with reference to the accompanying drawings.

[0019] Fig. 1 This is a hardware architecture diagram of the present invention; Fig. 2 This is a software business block diagram of the present invention. Detailed Implementation

[0020] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0021] like Figs. 1-2 As shown, the dual microcontroller system of the present invention includes a hardware architecture and a software architecture; The hardware architecture specifically includes a main MCU module, a backup MCU module, a dual power supply module, dual measurement and acquisition modules, a hardware arbitrator, and an output switch module. The main MCU module and the backup MCU module are completely equivalent in hardware. They are connected through a high-speed communication interface (such as SPI or UART) to form a main and backup MCU data synchronization communication interface for real-time data synchronization. The dual power supply module independently supplies power to the main MCU module and the backup MCU module respectively; the dual measurement and acquisition module is independently connected to the main MCU module and the backup MCU module respectively; thus, full hardware redundancy is achieved from power supply and signal acquisition to the computing unit, avoiding single point of failure. The hardware arbitrator, as a key hardware logic circuit, receives operating status signals from the main and backup MCUs at its input and controls the final output path of the output switch module at its output. The hardware arbitrator determines which MCU's switch output to send to the external device based on preset logic (e.g., prioritizing the main MCU and instantly switching to the backup MCU when the main MCU fails). This hardware-level arbitration mechanism ensures a microsecond-level switching speed.

[0022] The output switch module is controlled by the hardware arbitrator and can select to output switch commands from the main MCU module or the backup MCU module to an external device.

[0023] The software architecture employs a fine-grained state machine design for its business logic, which synchronizes the primary and backup MCU memory in real time. This enables the system to continue running from the point of failure when switching to the backup MCU, ensuring seamless integration of business logic.

[0024] The specific operational logic of the software architecture includes: After initializing the data synchronization communication interface of the main and backup MCU modules, the main and backup MCU modules are started. The main MCU module reads the measurement and acquisition module data in the working program state machine, interacts with external devices through the communication interface, and drives the digital output. When the main MCU module is fault-free, the hardware arbitrator selects the digital output of the main MCU module to drive the external device. When the main MCU module is faulty, the hardware arbitrator selects the digital output of the backup MCU to drive the external device.

[0025] The hardware arbitrator is a hardware logic circuit implemented by a CPLD or FPGA.

[0026] The main MCU module and the backup MCU module synchronize the current state of the state machine, key variables in memory, and calculation results in real time through a data synchronization mechanism. The data synchronization mechanism specifically includes: In the linker script, a dedicated data segment for data synchronization is defined. The compiler properties specify that the variables to be synchronized are stored in the data segment. A CRC checksum field is defined at the end of the data segment. The main MCU module actively synchronizes the data segment to the backup MCU module in the main loop. The backup MCU module verifies the synchronized data, and updates the local data segment after the verification is successful.

[0027] like Figs. 1-2 As shown, the control method for the dual microcontroller system of the present invention is applied to the above-mentioned dual microcontroller system and includes an initialization phase, a normal operation and synchronization phase, and a fault detection and seamless switching phase.

[0028] The initialization phase specifically includes the following steps: After the system is powered on, the primary and backup MCU modules first initialize the data synchronization communication interface between them; Then, both run the same working program, the core of which is a working program state machine.

[0029] The normal operation and synchronization phase specifically includes the following steps: During operation, the main MCU module synchronizes its current state of state machine, key variables in memory, and calculation results to the backup MCU module in real time through the communication interface, so that the memory state of the backup MCU module is highly consistent with the state of the main MCU module. Meanwhile, the main MCU module will continuously send a "normal operation" signal to the hardware arbitrator.

[0030] The fault detection and seamless handover phase specifically includes the following steps: Fault detection: The fault may be caused by the MCU's own hardware failure or the software watchdog timeout. Once the hardware arbitrator detects that the main MCU module's running signal has disappeared or is abnormal, or the backup MCU module detects that the main MCU module is abnormal, the switching logic is triggered. Hardware Arbitration: After detecting a fault in the main MCU module, the hardware arbitrator immediately (within the hardware circuit response time) switches the control of the output switch module to the backup MCU module. Seamless business continuity: At this time, because the backup MCU module has almost all the operating states (including state machine position and memory data) before the main MCU module failed, it does not need to be restarted or initialized. It can directly take over the business logic of the main MCU module from the point of failure and continue to execute, realizing a seamless switch that is imperceptible to the user.

[0031] The key technology of this invention lies in its hardware-software co-design, which elevates the traditional primary / standby redundancy mechanism from coarse-grained "system-level cold backup" or "warm backup" to fine-grained "task-level hot backup," thereby achieving truly seamless business switching. Specifically, the advantages of this invention are as follows: Achieving microsecond-level switching: The response speed of hardware logic circuits is much faster than that of software processes, which can shorten the system switching time from milliseconds to microseconds, greatly reducing system failure time; Improved switching reliability: Even if the main MCU module experiences a complete failure such as a crash, its "running signal" will disappear. The hardware arbitrator can reliably detect and execute the switching, without relying on the MCU's own software functions, thus eliminating a single point of failure. Achieving true seamless integration: When the main MCU module fails, the backup MCU module, with its memory and state machine position that are completely synchronized with the main MCU module, can continue execution directly from the next state cycle as if nothing had happened, resulting in zero interruption and no awareness for external services; Ensuring the continuity and correctness of control logic: This fundamentally avoids faults caused by state loss and switching, and ensures the accuracy and consistency of system control behavior; Eliminate system-level single points of failure: From input, power supply, calculation to output, every link of the system is redundant, and the failure of any single component will not cause the system to lose its function, which significantly improves the overall fault tolerance and availability of the system. Architectural robustness: The co-design of hardware and software (such as the MCU sending a run signal to the arbitrator) enables the entire system to not only back up the hardware, but also back up the "running state", forming an organic and highly available whole.

[0032] Overall, the core function of this invention is to combine the "speed" of hardware arbitration with the "accuracy" of state machine synchronization. Through deep collaboration between software and hardware, it solves the core contradiction in high-reliability systems where "rapid switching" and "lossless business operations" are difficult to balance.

[0033] The terms "front," "back," "left," "right," "top," and "bottom" all refer to the figures in the accompanying drawings. Fig. 1 Based on the perspective of the observer, the side of the device facing the observer is defined as the front, the left side of the observer is defined as the left, and so on.

[0034] In the description of this invention, it should be understood that the terms "center", "longitudinal", "lateral", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting the scope of protection of this invention.

[0035] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A dual-microcontroller system, characterized in that: This includes both hardware and software architecture; The hardware architecture specifically includes a main MCU module, a backup MCU module, a dual power supply module, dual measurement and acquisition modules, a hardware arbitrator, and an output switch module. The main MCU module and the backup MCU module are connected through a high-speed communication interface to form a main and backup MCU data synchronization communication interface for real-time data synchronization. The dual power supply module independently supplies power to the main MCU module and the backup MCU module respectively; The dual measurement and acquisition modules are independently connected to the main MCU module and the backup MCU module, respectively. The input terminal of the hardware arbitrator is used to receive the operating status signals from the main MCU module and the backup MCU module, and the output terminal is used to control the final output path of the output switch module. The output switch module is controlled by the hardware arbitrator and can select to output switch commands from the main MCU module or the backup MCU module to an external device.

2. The dual microcontroller system according to claim 1, characterized in that: The specific operational logic of the software architecture includes: After initializing the data synchronization communication interface between the main and backup MCU modules, the main and backup MCU modules are started. The main MCU module reads the measurement and acquisition module data in the working program state machine, interacts with external devices through the communication interface, and drives the digital output. When the main MCU module is fault-free, the hardware arbitrator selects the digital output of the main MCU module to drive the external device. When the main MCU module is faulty, the hardware arbitrator selects the digital output of the backup MCU to drive the external device.

3. The dual microcontroller system according to claim 1, characterized in that: The high-speed communication interface is either an SPI or a UART interface.

4. The dual microcontroller system according to claim 1, characterized in that: The hardware arbitrator is a hardware logic circuit implemented by a CPLD or FPGA.

5. The dual microcontroller system according to claim 1, characterized in that: The main MCU module and the backup MCU module synchronize the current state of the state machine, key variables in memory, and calculation results in real time through a data synchronization mechanism. The data synchronization mechanism specifically includes: In the linker script, a dedicated data segment for data synchronization is defined. The compiler properties specify that the variables to be synchronized are stored in the data segment. A CRC checksum field is defined at the end of the data segment. The main MCU module actively synchronizes the data segment to the backup MCU module in the main loop. The backup MCU module verifies the synchronized data, and updates the local data segment after the verification is successful.

6. A control method for a dual-microcontroller system, the method being applied to the dual-microcontroller system according to any one of claims 1-5, characterized in that: It includes the initialization phase, the normal operation and synchronization phase, and the fault detection and seamless switching phase.

7. The control method for a dual-microcontroller system according to claim 6, characterized in that: The initialization phase specifically includes the following steps: A1. Initialize the data synchronization communication interface between the main MCU module and the backup MCU module; A2. Start the working program state machine of the main MCU module and the standby MCU module, and run the same working program on both.

8. The control method for a dual microcontroller system according to claim 7, characterized in that: The normal operation and synchronization phase specifically includes the following steps: B1. The main MCU module acts as the control entity, and its state machine operation state is output in the form of switch output. B2. The main MCU module synchronizes its current state of state machine, key variables in memory, and calculation results to the backup MCU module in real time through a data synchronization mechanism. B3. The main MCU module continuously sends a "normal operation" signal to the hardware arbitrator.

9. The control method for a dual microcontroller system according to claim 8, characterized in that: The fault detection and seamless handover phase specifically includes the following steps: C1. Fault detection: The hardware arbiter monitors the operating status signals of the main MCU module and the backup MCU module; C2. Hardware Arbitration: When the hardware arbitrator detects a fault in the main MCU module, it immediately switches the control of the output switch module to the backup MCU module. C3. Seamless Business Transition: The backup MCU module takes over the business logic from the point of failure based on synchronized status and memory data.

Images