System self-detection and self-recovery method

Abstract

The invention provides a system self-detection and self-recovery method, which comprises the following steps: monitoring a main CPU (Central Processing Unit) by adopting a main control unit, and communicating the main control unit with the main CPU through an internal serial port; receiving and analyzing the system message sent by the main CPU by using the main control unit, and controlling the main control unit to output a preset storage space detection signal according to the system message so as to determine the starting permission of the main CPU to the standby system; wherein the standby system is stored in a preset storage space and is physically isolated from the main system; and carrying out self-detection, self-recovery and restart recovery on the main system in combination with the system message and the start permission. According to the method, the problem that the main system cannot be started and self-recovered when the main CPU goes wrong during running is solved.

Description

Technical Field

[0001] This application relates to the field of computer hardware and software systems, and more specifically, to a method for system self-detection and self-recovery. Background Technology

[0002] In embedded devices, abnormal power-ups or shutdowns, as well as developer errors, can damage the software system, preventing the device from booting and functioning properly. Currently, embedded device systems on the market typically employ a dual-system backup approach to address software system corruption, with the primary and backup systems usually stored in the same memory, making both highly susceptible to corruption. Monitoring the device's system status relies on the main CPU. When the main CPU malfunctions, the device cannot actively power down and restart to recover or report its operational status. Therefore, ensuring the embedded device can resume normal operation is paramount. Designing a robust and reliable system self-test mechanism that can restore normal system operation after detecting corruption is crucial for guaranteeing the reliability of embedded devices. Summary of the Invention

[0003] In view of one of the defects in the prior art, the purpose of this application is to provide a method for system self-detection and self-recovery.

[0004] The first aspect of this application provides a method for system self-detection and self-recovery, comprising: A main control unit is used to monitor the main CPU, and the main control unit communicates with the main CPU through an internal serial port; The main control unit receives and parses system messages sent by the main CPU, and controls the main control unit to output a preset storage space detection signal according to the system messages, so as to determine the main CPU's boot permission for the backup system; wherein, the backup system is stored in the preset storage space and is physically isolated from the main system; Based on the system messages and the startup permissions, the main system performs self-detection, self-recovery, and restart recovery.

[0005] Optionally, the step of using a main control unit to monitor the main CPU includes: The main control unit determines the startup source of the main CPU through a startup control signal, and the startup source includes: the startup of the main system or the startup of the backup system; The main control unit controls the power-on and power-off of the main CPU and peripheral circuits of the device through power control signals; Specifically, the main control unit receives and parses system messages sent by the main CPU. The system messages include system startup completion messages, main system normal operation messages, main system self-recovery messages, and main system self-recovery completion messages. The system startup completion messages include main system startup completion messages and backup system startup completion messages.

[0006] Optionally, the step of using the main control unit to perform self-detection, self-recovery, and restart recovery of the main system's operating status based on the system messages includes: Define the parameters for communication between the main control unit and the main CPU; The main CPU-side control process is executed using the start control signal and the parameters. Using the parameters and system messages generated during the main CPU-side control process, the main control unit-side control process is executed to perform self-detection, self-recovery, and restart recovery on the main system. The parameters include: time parameters, count parameters, and threshold parameters, which are used by the main control unit to determine the status of the main system. The time parameters include: defining the timeout period for the main control unit to wait for the main CPU system message as ctl_recv_msg_timeout_secs; The interval between the main CPU sending the system message to the main control unit is defined as cpu_send_msg_interval_secs; The counting parameters include: defining the main CPU normal startup count as cpu_normal_count and the main CPU abnormal startup count as cpu_abnormal_count; The threshold parameters include: defining the threshold for the number of normal startups of the main CPU as cpu_normal_thershold and the threshold for the number of abnormal startups of the main CPU as cpu_abnormal_thershold; The timeout period for the main control unit to wait for the system to start up is defined as system_start_timeout_secs; The timeout period is greater than or equal to twice the interval time.

[0007] Optionally, the step of executing the main CPU-side control process via the start control signal and the parameters includes: The main CPU starts up and runs to the UEFI stage, and reads the startup control signal output by the main control unit; If the startup control signal is high, the main CPU determines that it is starting from the main system and sends a main system startup completion message to the main control unit. Then, it sends a main system normal operation message to the main control unit every cpu_send_msg_interval_secs. If the startup control signal is low, the main CPU determines that it will start from the backup system and sends a backup system startup completion message to the main control unit, and enters self-recovery mode; The backup system is synchronized to the main system memory, and a message indicating that the main system is self-recovering and self-recovery is complete is sent to the main control unit.

[0008] Optionally, in the self-recovery mode, the main CPU locks the device operating system and displays the self-recovery progress, and sends a message to the main control unit every cpu_send_msg_interval_secs that the main system is self-recovering, until the self-recovery is complete.

[0009] Optionally, the step of executing the main control unit-side control process using the parameters and system messages generated during the main CPU-side control process to perform self-detection, self-recovery, and restart recovery on the main system includes: The main control unit is powered on and the start control signal is set to a high level to disable the preset storage space detection signal. If the main control unit receives a startup completion message from the main CPU within the system_start_timeout_secs, it determines that the main CPU has started normally and enters the subsequent message monitoring stage to continuously self-detect the operating status of the main system. If the system startup completion message is not received within the system_start_timeout_secs, the main system is determined to be abnormal, and abnormal startup counting is performed.

[0010] Optionally, the subsequent message monitoring phase involves continuously self-monitoring the main system's operating status, including: The main control unit reads the serial port messages of the main CPU and determines whether a system message has been received within ctl_recv_msg_timeout_secs; If the main control unit does not receive any system message sent by the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system is running abnormally and performs abnormal startup counting processing. If the main control unit receives the main system normal operation message sent by the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system is operating normally and performs normal startup counting processing. If the main control unit receives a message from the main CPU indicating that the main system is self-recovering within ctl_recv_msg_timeout_secs, it determines that the main system is in the recovery process, continues to maintain the message monitoring phase, continuously self-detects the main system's operating status, and tracks the recovery progress. If the main control unit receives the main system self-recovery completion message sent by the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system has recovered normally and performs post-recovery reset processing.

[0011] Optionally, the abnormal startup counting process, used to trigger a backup system call, includes: The main control unit increments the value of cpu_abnormal_count by 1, and simultaneously sets the value of cpu_abnormal_count to 0; If cpu_abnormal_count is greater than or equal to cpu_abnormal_thershold, the main system is determined to be faulty, and the backup system is activated; the value of cpu_abnormal_count is set to 0, the main control unit sets the startup control signal to a low level, outputs the preset storage space detection signal in an enabled state, and then controls the main CPU and peripheral circuits to restart via the power control signal, starting from the backup system, and the main system performs self-recovery; If cpu_abnormal_count is less than cpu_abnormal_thershold, the main system is determined to be an intermittent abnormality. The main control unit directly controls the main CPU and the peripheral circuit to restart through the power control signal and retry to start from the main system.

[0012] Optionally, the normal startup counting process includes: If the cpu_normal_count is less than the cpu_normal_thershold, the main control unit increments the value of the cpu_normal_count by 1; If cpu_abnormal_count > 0 and cpu_normal_count equals cpu_normal_thershold, then the main system is determined to have recovered to stable operation, and the main control unit sets the value of cpu_abnormal_count to 0; The main control unit returns to the message monitoring phase and continuously performs self-detection on the main system's operating status.

[0013] Optionally, controlling the main control unit to output a preset storage space detection signal according to the system message to control the main CPU's boot permission for the backup system includes: When the main control unit determines that the main system is normal, the main control unit deactivates the preset storage space detection signal, causing the main CPU to lose access to the preset storage space, and the main CPU only boots from the main system; When the main control unit determines that the main system is faulty, the main control unit enables the preset storage space detection signal, enabling the main CPU to obtain access to the preset storage space. The main CPU then starts from the backup system and enters self-recovery mode.

[0014] This application provides a system self-detection and self-recovery method. It employs a separate main control unit to monitor the main CPU. The main control unit communicates with the main CPU via a proprietary protocol on its internal serial port. By receiving and parsing messages from the main CPU and outputting corresponding control signals, combined with the startup permissions of the backup system, the system can achieve self-recovery and restart recovery functions, solving the problem of system failure to start and self-recover when the main CPU malfunctions. Simultaneously, by storing the backup system in a preset storage space, physically isolated from the main system, and having the main control unit control the main CPU's access to the preset storage space, the backup system is protected from damage, solving the problem of accidental damage to the backup system. This overcomes the problem in existing technologies where the system cannot start and self-recover when the main CPU malfunctions or both the main and backup systems are damaged.

[0015] Other technical effects resulting from the additional features will be further illustrated in the corresponding embodiments. Attached Figure Description

[0016] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating a system self-detection and self-recovery method according to an exemplary embodiment; Figure 2This is a schematic diagram of a self-detection and self-recovery system architecture according to an exemplary embodiment; Figure 3 This is a control flowchart on the main CPU side according to an exemplary embodiment; Figure 4 This is a control flowchart of the main control unit side according to an exemplary embodiment; Figure 5 This is a schematic diagram illustrating the communication format between the main CPU and the main control unit according to an exemplary embodiment. Detailed Implementation

[0017] The present application will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any way. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application, and these all fall within the protection scope of the present application. Parts not described in detail in the following embodiments can be implemented using existing technology.

[0018] In existing technologies, to address the problem of abnormal software system corruption, current embedded device systems on the market generally employ a dual-system backup approach, with the primary and backup systems typically stored in the same memory, making both highly susceptible to corruption. Monitoring the device system status relies on the device's main CPU; when the main CPU malfunctions, the device cannot actively power down and restart to recover or report its operational status. Based on the above problems, this application provides a system self-detection and self-recovery method to solve these issues.

[0019] Reference Figure 1 As shown in one embodiment of this application, a method for system self-detection and self-recovery includes: S1. The main control unit monitors the main CPU, and the main control unit communicates with the main CPU through an internal serial port. S2. The main control unit receives and parses the system messages sent by the main CPU, and controls the main control unit to output a preset storage space detection signal according to the system messages to determine the main CPU's boot permission for the backup system; wherein, the backup system is stored in the preset storage space and is physically isolated from the main system; It is understood that in the embodiments of this application, the preset storage space can be a TF card to store the backup system, and there is no limitation here.

[0020] S3. Based on system messages and startup permissions, perform self-testing, self-recovery, and restart recovery on the main system.

[0021] The main control unit determines whether the main system is normal by system messages. If the main system is normal, it disables the preset storage space detection signal to prevent the main CPU from accessing the backup system. If the main system is abnormal, it enables the main CPU's access to the backup system by enabling the preset storage space detection signal, and the backup system completes the self-recovery of the main system.

[0022] Specifically, firstly, an independent main control unit is set up in the device. The main control unit outputs start control signals and power control signals to monitor the main CPU. The main control unit communicates with the main CPU via an internal serial port. Next, the main control unit receives and parses the system messages sent by the main CPU. Based on the system messages, the main control unit outputs a preset storage space detection signal to control the main CPU's access permissions to the preset storage space. The main control unit determines whether the main system is normal based on the received system messages. If the main system is normal, it enables the preset storage space detection signal and prohibits the main CPU from accessing the backup system. If the main system is abnormal, it enables the preset storage space detection signal, opens the main CPU's access permissions to the backup system, and then completes the self-recovery of the main system through the backup system.

[0023] The embodiments described above in this application, by employing a main control unit to monitor the main CPU and utilizing internal serial communication to analyze signals, help solve the problem of system failure to start and self-recover when the main CPU malfunctions. Simultaneously, by using a backup system stored in a preset storage space, physically isolated from the main system, and with the main control unit controlling the main CPU's access to the preset storage space, the backup system achieves data separation, avoiding single-point failures from affecting overall availability. This solves the problem of potential backup system damage due to accidents. Furthermore, the technical means of storing the backup system in a physically isolated preset storage space and controlling access permissions by the main control unit enables precise monitoring and flexible control of the device system's operating status. During normal operation of the main system, access to the backup system by the main CPU is prohibited, avoiding unnecessary resource consumption and potential interference, ensuring the stable and efficient operation of the main system. When the main system malfunctions, access to the backup system by the main CPU can be quickly granted, allowing the backup system to promptly complete the self-recovery of the main system, effectively improving the reliability and stability of the device system and reducing the risk of downtime and data loss due to system failures.

[0024] It should be noted that "physical isolation" means that the primary system and the backup system are stored on different, physically independent storage media (such as the primary system on eMMC and the backup system on a TF card), rather than different partitions of the same storage device.

[0025] Reference Figure 2As shown in the system framework diagram, the main control unit and the main CPU are connected via serial communication. The main control unit outputs a start control signal and a TF card detection signal to the main CPU. The main control unit also outputs a power control signal to the main CPU's power module. The main CPU's power module controls the power-on and power-off of the main CPU. Meanwhile, the backup system is stored in the TF card. Communication between the main CPU and the TF card is achieved through the TF card detection signal.

[0026] By storing the backup system in a preset storage space, physically isolated from the main system, and having the main control unit control the main CPU's access to the preset storage space by outputting a preset storage space detection signal, the backup system can be protected from damage, thus solving the problem of accidental damage to the backup system.

[0027] It should be noted that the preset storage space data signal, i.e., the TF card data signal in this embodiment, copies the data from the main CPU to the backup system during normal operation of the main system, synchronizing the data. Data backup is a pre-operation during normal operation, not a backup performed only after the main system crashes. When the main system malfunctions and self-recovers, the backup system takes over the device operation and uses the main system backup data stored in the backup system to repair the main system. The data from the backup system is synchronized to the main system's memory and written back or refreshed to the main system's storage area, overwriting the damaged parts. This overcomes the problem in the prior art where the system cannot start and self-recover when the main CPU malfunctions or both the main and backup systems are damaged.

[0028] In some specific embodiments of this application, monitoring the main CPU using a main control unit includes: The main control unit sets the startup source of the main CPU through the startup control signal, which can be either the main system or the backup system; the main control unit controls the power-on and power-off of the main CPU and peripheral circuits of the device through the power control signal.

[0029] The system receives and parses system messages sent by the main CPU using the main control unit. These system messages include system startup completion messages, main system normal operation messages, main system self-recovery messages, and main system self-recovery completion messages. The main control unit uses these system messages to perform self-detection, self-recovery, and restart recovery of the main system's operating status.

[0030] The system startup completion messages include the main system startup completion message and the backup system startup completion message; the startup control signal and the power control signal are the control outputs of the main control unit.

[0031] In the embodiments described above, the main control unit monitors the main CPU by first receiving the main CPU's startup control signal and determining the startup source based on this signal, thus deciding whether to start from the main system or the backup system. Next, it receives the main CPU's power control signal and uses this signal to control the power-on and power-off operations of the main CPU and peripheral circuits, enabling the main CPU to restart and recover. Simultaneously, the main control unit receives and parses system messages sent by the main CPU, including system startup completion messages, main system normal operation messages, main system self-recovery messages, and self-recovery completion messages. Based on the parsing results, the main control unit performs self-detection, self-recovery, and restart recovery operations on the main system's operating status. This ensures precise control over the main CPU's startup method and the device's power status, guaranteeing startup from the correct system at the appropriate time. Furthermore, by performing real-time self-detection and analysis of different system messages, abnormal situations during the main system's operation can be detected promptly, and self-recovery and restart recovery measures can be quickly implemented, effectively improving the stability and reliability of the device system, reducing the risk of operational interruptions due to system failures, and ensuring continuous and stable operation of the equipment.

[0032] In some specific embodiments of this application, the use of the main control unit to perform self-detection, self-recovery, and restart recovery of the main system's operating status based on system messages includes: The parameters for communication between the main control unit and the main CPU are defined; the main CPU-side control process is executed by starting control signals and parameters; the main control unit-side control process is executed by power control signals, parameters and system messages generated during the main CPU-side control process, and the main system performs self-detection, self-recovery and restart recovery.

[0033] The parameters include: time parameters, count parameters, and threshold parameters, used by the main control unit to determine the main system status. The time parameters include: a timeout period defined as ctl_recv_msg_timeout_secs for the main control unit to wait for system messages from the main CPU; and a time interval defined as cpu_send_msg_interval_secs for the main CPU to send system messages to the main control unit. The count parameters include: a normal CPU startup count defined as cpu_normal_count; an abnormal CPU startup count defined as cpu_abnormal_count. The threshold parameters include: a threshold for the number of normal CPU startups defined as cpu_normal_thershold; a threshold for the number of abnormal CPU startups defined as cpu_abnormal_thershold; and a timeout period defined as system_start_timeout_secs for the main control unit to wait for system startup completion. The timeout period is greater than or equal to twice the aforementioned interval period.

[0034] That is, satisfying ctl_recv_msg_timeout_secs≥2 cpu_send_msg_interval_secs.

[0035] The time unit defined in the above parameters is seconds.

[0036] Specifically, logical constraints are established by defining communication parameters between the main control unit and the main CPU. Then, during the UEFI stage of the main CPU startup, the startup control signal is read, and the system selects to start from the main system or the backup system based on the level, and sends corresponding status messages according to the parameter requirements. Finally, after the main control unit is powered on and initialized, the control process is executed in combination with the power control signal, communication parameters and signals fed back by the main CPU. Through startup timeout judgment and counting processing in the message monitoring stage, when the abnormal count reaches the threshold, the startup control signal is switched, the preset storage space detection signal is enabled and the main CPU is restarted to call the backup system to achieve self-recovery. If the threshold is not reached, the main CPU is directly restarted. When the normal count reaches the threshold, the abnormal count is reset, thus completing the self-recovery and restart recovery of the main system.

[0037] The embodiments described above in this application, through detailed parameter definitions, specify parameters such as the timeout period for the main control unit to wait for system messages from the main CPU, the message sending interval of the main CPU, the normal and abnormal startup counts and thresholds, and the timeout period for waiting for system startup completion, and set reasonable parameter relationships (such as satisfying ctl_recv_msg_timeout_secs≥2). The `cpu_send_msg_interval_secs` parameter provides a reference value for the main control unit to judge the status of the main system. This enables the main control unit to execute the control process between the main CPU side and the main control unit side based on the parameter, avoiding misjudgments caused by communication delays, unclear or unreasonable parameters, and improving the accuracy and timeliness of system self-detection and self-recovery.

[0038] Reference Figure 3 As shown, in some specific embodiments of this application, the execution of the main CPU-side control process by starting control signals and parameters includes: the main CPU starts up and runs to the UEFI stage, and reads the start control signal output by the main control unit; If the startup control signal is high, the main CPU determines that it is starting from the main system and sends a main system startup completion message to the main control unit. Then, it sends a main system normal operation message to the main control unit every cpu_send_msg_interval_secs (the interval between the main CPU sending system messages to the main control unit).

[0039] If the startup control signal is low, the main CPU determines that it is starting from the backup system and sends a backup system startup completion message to the main control unit, entering self-recovery mode; it synchronizes the backup system to the main system memory and sends a main system self-recovery message and a self-recovery completion message to the main control unit.

[0040] Specifically, during main CPU-side control, when the main CPU starts up and reaches the UEFI stage, it reads the startup control signal output by the main control unit. If the read startup control signal is high, the main CPU determines that the startup is from the main system and then sends a system startup complete message to the main control unit. Afterward, it sends a main system normal operation message to the main control unit every preset interval `cpu_send_msg_interval_secs`. If the startup control signal is low, the main CPU determines that the startup is from the backup system. It also first sends a system startup complete message to the main control unit, then enters self-recovery mode. During self-recovery, the data from the backup system is synchronized to the main system memory, and the main CPU sequentially sends a system startup complete message, a system self-recovery message, and a self-recovery complete message to the main control unit.

[0041] During data backup, the data of the main system is backed up to the backup system. During self-recovery, the standby system takes over the operation of the equipment and uses the backup data of the main system stored in the standby system to repair the main system. The data of the backup system is synchronized to the memory of the main system and written back or refreshed to the storage area of ​​the main system to overwrite the damaged parts.

[0042] In the embodiments described above, the startup source is accurately determined based on the startup control signal output by the main control unit. Regardless of whether the startup originates from the main system or the backup system, key information can be promptly fed back to the main control unit. When starting from the main system, normal operation messages are sent periodically, enabling the main control unit to monitor the main system status in real time. When starting from the backup system, the system enters self-recovery mode and feeds back detailed messages, allowing the main control unit to obtain the self-recovery process. This helps the main control unit to take timely measures to ensure stable system operation, improves the efficiency and reliability of system self-detection and self-recovery, and reduces the risks caused by system startup anomalies or operational failures.

[0043] Reference Figure 5 As shown, the communication format between the main CPU and the main control unit is as follows: System startup completion message: 0XFE, 0X01, 0XFF; Main system normal operation message: 0XFE, 0X02, 0XFF; Main system self-recovery message: 0XFE, 0X03, 0XFF; Main system self-recovery completion message: 0XFE, 0X04, 0XFF; Among them, the main system startup completion message and the backup system startup completion message are collectively referred to as the system startup completion message, with the format 0XFE, 0X01, 0XFF.

[0044] In some specific embodiments of this application, when the main CPU is in self-recovery mode, the main CPU locks the device operating system and displays the self-recovery progress. Every cpu_send_msg_interval_secs, it sends a message to the main control unit that the main system is self-recovering until the self-recovery is complete.

[0045] In some specific embodiments of this application, the main CPU sends a message that the main system is self-recovering to the main control unit every 5 seconds. After the main CPU completes the system self-recovery, it sends a message that the self-recovery is complete to the main control unit. The specific time is not limited here and can be customized as needed.

[0046] Reference Figure 4 As shown, in some specific embodiments of this application, for system messages generated during the control process via parameters and the main CPU side, the main control unit side control process is executed to perform self-detection, self-recovery, and restart recovery on the main system, including: The main control unit powers on and starts up, setting the startup control signal to a high level to disable the TF card detection signal.

[0047] If the main control unit receives a system startup completion message from the main CPU within system_start_timeout_secs, it determines that the main CPU has started normally and enters the subsequent message monitoring stage, continuously performing self-detection on the main system's operating status.

[0048] If a system startup completion message is not received within system_start_timeout_secs, the main CPU startup is determined to be abnormal, and abnormal startup count processing is performed.

[0049] In the embodiments described above, the main control unit uses a preset system_start_timeout_secs as the time limit. If it successfully receives a system startup completion message from the main CPU within this time limit, it determines that the main CPU has started normally and enters the subsequent message monitoring stage to continuously track system operation. If the message is not received after this time limit, it determines that the main CPU has started abnormally and performs abnormal startup counting processing. Through a clear time determination mechanism, the startup status of the main CPU can be quickly and accurately identified, enabling the main control unit to accurately obtain the system status.

[0050] The system startup completion message includes either "main system startup complete" or "standby system startup complete".

[0051] In some specific embodiments of this application, upon entering the subsequent message monitoring phase, continuous self-monitoring of the main system's operating status is performed, including: The main control unit reads the serial port messages from the main CPU and determines whether a system message has been received within ctl_recv_msg_timeout_secs.

[0052] If the main control unit does not receive any system messages from the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system is running abnormally and performs abnormal startup counting processing.

[0053] If the main control unit receives a normal system operation message from the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system is operating normally and performs normal startup counting processing.

[0054] If the main control unit receives a message from the main CPU that the system is self-recovering within ctl_recv_msg_timeout_secs, it determines that the system is in the recovery process, continuously performs self-detection on the main system's running status, and tracks the recovery progress.

[0055] If the main control unit receives a self-recovery completion message from the main CPU within ctl_recv_msg_timeout_secs, it determines that the system has recovered normally and performs a post-recovery reset.

[0056] In the embodiments described above, the main control unit, through its message monitoring mechanism, can monitor the operating status of the main system in real time and make accurate judgments based on different message reception conditions. It can then take corresponding counting or resetting measures for different states such as abnormal, normal, and self-recovery, which helps to quickly identify system problems, implement timely countermeasures, and ensure stable system operation. Simultaneously, tracking the self-recovery process ensures the system fully recovers to normal, avoiding subsequent failures due to incomplete recovery, improving system reliability and fault tolerance, and reducing the risk of system interruption due to abnormal operation.

[0057] It should be noted that the above information is obtained by reading serial port information through the main control unit.

[0058] Reference Figure 4 As shown in some specific embodiments of this application, the abnormal startup counting process, used to trigger a backup system call, includes: The main control unit increments the value of cpu_abnormal_count by 1, and simultaneously sets the value of cpu_abnormal_count to 0; If cpu_abnormal_count is greater than or equal to cpu_abnormal_thershold, the main system is determined to be faulty and the backup system needs to be activated. The value of cpu_abnormal_count is set to 0, the main control unit sets the startup control signal to low level, and outputs the TF card detection signal in the enabled state. Then, the main CPU and peripheral circuits are restarted through the power control signal to start from the backup system, and the main system performs self-recovery.

[0059] If cpu_abnormal_count is less than cpu_abnormal_thershold, the main system is determined to be an intermittent abnormality. The main control unit directly controls the main CPU and peripheral circuits to restart via the power control signal and retry to start from the main system.

[0060] Specifically, after determining an abnormal state, during the process of triggering the backup system call using the abnormal startup count processing, the main control unit first increments the abnormal startup count cpu_abnormal_count by 1, while setting the normal startup count cpu_abnormal_count to 0. Next, it performs a numerical check. If cpu_abnormal_count is greater than or equal to the preset abnormal startup count threshold cpu_abnormal_thershold, it determines that the main system has failed and the backup system needs to be activated. At this time, the main control unit sets the startup control signal to a low level, resets the cpu_abnormal_count value to 0, outputs an enabled TF card detection signal, and then controls the main CPU and peripheral circuits to restart via the power control signal, enabling the main CPU to start from the backup system and the main system to perform self-recovery.

[0061] If cpu_abnormal_count is less than cpu_abnormal_thershold, the main system is determined to be experiencing intermittent anomalies. The main control unit directly controls the main CPU and peripheral circuits to restart via the power control signal, allowing the system to attempt to boot from the main system again. If the number of restarts exceeds the set threshold (i.e., cpu_abnormal_count is greater than or equal to cpu_abnormal_thershold), indicating that multiple restarts still result in an anomaly, the boot control signal is set to low to enable the backup system; the TF card detection signal is enabled so that the CPU can read the backup data; the main control unit sets the power control signal to control the power-on and power-off of the main CPU and peripheral circuits to enable the CPU to use the backup system, while the main system enters self-recovery mode.

[0062] It should be noted that the CPU restarts upon power-up, which does not affect the counting. The main control unit sends control signals to the main CPU, and the main CPU sends messages to the main control unit.

[0063] The above embodiments of this application, by setting an abnormal startup count handling adjustment mechanism, can judge based on the number of abnormal startups of the main system; when the number of abnormal startups reaches the threshold, the main system is promptly identified as faulty and the backup system is activated, avoiding the overall system from failing to operate normally due to continuous failure of the main system, thus ensuring the stability and reliability of the system; for occasional abnormalities, the main system is directly restarted to attempt to start again, reducing unnecessary system switching and improving system operating efficiency.

[0064] Reference Figure 4 As shown in some specific embodiments of this application, the normal startup count processing for resetting abnormal states includes: If cpu_normal_count is less than cpu_normal_thershold, the main control unit increments the value of cpu_normal_count by 1; if cpu_abnormal_count is greater than 0 and cpu_normal_count is equal to cpu_normal_thershold, the main system is determined to have recovered to stable operation, and the main control unit sets the value of cpu_abnormal_count to 0; the main control unit returns to the message monitoring stage and continues to self-monitor the operating status of the main system.

[0065] Specifically, after the main control unit receives the main system normal operation message sent by the main CPU, it determines whether the number of normal startups of the main CPU is less than the threshold number of normal startups of the main CPU. If it is less, the number of normal startups of the main CPU is incremented by 1. If it is greater, it then determines whether the number of normal startups of the main CPU is equal to the threshold number of normal startups of the main CPU. If it is, the abnormal startup count of the main CPU is set to 0, the operation is determined to be stable, and the detection continues.

[0066] In the above embodiments of this application, during the operation of the main system, the normal startup count is gradually accumulated when it has not reached the threshold. When the normal startup count reaches the threshold and there is an abnormal startup count, it is determined that the main system has recovered to stability, and the abnormal startup count is reset in time. This effectively distinguishes between occasional system anomalies and a continuously stable state, avoids unnecessary backup system calls due to misjudgment of brief anomalies, and clears the anomaly records after the system recovers to stability. At the same time, after the counting process is completed, the system returns to the message monitoring stage for continuous self-detection, which can monitor the system's operating status in real time and ensure the long-term stable operation of the system.

[0067] It should be noted that, in this application, some specific implementation methods are as follows: the abnormal startup threshold cpu_abnormal_thershold can be set to 3, the normal startup threshold cpu_normal_thershold can be set to 3; the interval between the main CPU sending system messages to the main control unit cpu_send_msg_interval_secs can be set to 5 seconds, the timeout period for the main control unit to wait for the system to start up completely system_start_timeout_secs can be set to 180 seconds, and the timeout period for the main control unit to wait for the main CPU system messages ctl_recv_msg_timeout_secs can be set to 15 seconds.

[0068] The specific parameter values ​​mentioned above can be customized as needed, and are not limited here.

[0069] In some specific embodiments of this application, the control unit outputs a preset storage space detection signal to control the main CPU's access permissions to the preset storage space, including: When the main control unit determines that the main system is normal, the main control unit disables the preset storage space detection signal, causing the main CPU to lose access to the preset storage space, and the main CPU only boots from the main system; when the main control unit determines that the main system is faulty, the main control unit enables the preset storage space detection signal, causing the main CPU to gain access to the preset storage space, the main CPU boots from the backup system, and enters self-recovery mode.

[0070] Specifically, after the main control unit determines the operating status of the main system, it executes corresponding operations based on the determination result. If the main system is determined to be in a normal state, the main control unit will enable the preset storage space detection signal, preventing the main CPU from detecting the preset storage space and thus losing access to it. In this case, the main CPU can only boot from the main system and run according to the main system's configuration and programs. If the main control unit determines that the main system has malfunctioned, it will enable the preset storage space detection signal, allowing the main CPU to detect the preset storage space and gain access to it. The main CPU will boot from the backup system and enter self-recovery mode, using the data and programs in the backup system to repair and restore the system.

[0071] In the embodiments described above, the main control unit controls the preset storage space detection signal to ensure the stability and security of the system under different operating conditions. When the main system is normal, the main CPU's access to the preset storage space is restricted to avoid potential risks caused by unnecessary access operations, ensuring that the system starts up and runs efficiently and stably from the main system. When the main system is abnormal, the preset storage space detection signal is enabled in a timely manner, granting the main CPU the permission to access the preset storage space, enabling it to start from the backup system and enter the self-recovery mode, quickly restoring system functions and reducing the impact of system failure.

[0072] When determining whether the main system is normal or faulty, the specific determination process is as follows: if the main control unit receives the system startup completion message sent by the main CPU within system_start_timeout_secs, and reads the main system normal operation message, main system self-recovery message, or main system self-recovery completion message sent by the main CPU within ctl_recv_msg_timeout_secs, then the main system is determined to be normal. If the main control unit receives or does not receive the system startup completion message sent by the main CPU within system_start_timeout_secs, and does not read the system message sent by the main CPU within ctl_recv_msg_timeout_secs, and after the exception count is processed, cpu_abnormal_count is less than cpu_abnormal_thershold, then the main system is determined to be an occasional exception, and the main CPU is restarted to perform multiple self-tests. If the main control unit does not receive the system startup completion message from the main CPU within system_start_timeout_secs, and after the exception count is handled, cpu_abnormal_count is greater than or equal to cpu_abnormal_thershold, then the main system is determined to be abnormal. If the main control unit receives the system startup completion message sent by the main CPU within system_start_timeout_secs, does not read the system message sent by the main CPU within ctl_recv_msg_timeout_secs, and after the exception count is processed, cpu_abnormal_count is greater than or equal to cpu_abnormal_thershold, then the main system is determined to be abnormal.

[0073] The above determination process will be illustrated with examples, combined with... Figure 4 and Figure 5As shown, when the device starts up, the main CPU defaults to booting from the main system; the main control unit powers on and sets the boot control signal to a high level, disables the TF detection signal, and confirms that the main CPU has lost the boot privileges of the backup system; at the same time, when the main CPU receives a high-level boot control signal from the main control unit, it selects the boot path as booting from the main system and sends system boot completion messages 0XFE, 0X01, and 0XFF to the main control unit. If the main control unit receives the system startup completion message 0XFE 0X01 0XFF sent by the main CPU within system_start_timeout_secs, then the main control unit reads the serial port message from the main CPU and enters self-test. If no system message sent by the main CPU is read within ctl_recv_msg_timeout_secs, the main CPU abnormal startup count cpu_abnormal_count is changed from 0 + 1 = 1, and the threshold for the number of normal startups of the main CPU is reset to 0. Furthermore, cpu_abnormal_count=1 is less than the main CPU abnormal startup count threshold of cpu_abnormal_thershold=3; at this point, it may be an occasional system abnormality. You can try restarting, setting the power control signal, restarting the main CPU and peripheral circuits, and entering the restart recovery state. Then, the main control unit continues to read the serial port messages of the main CPU. If no system message sent by the main CPU is read within ctl_recv_msg_timeout_secs, the main CPU abnormal startup count cpu_abnormal_count is changed from 1+1=2, and the threshold for the number of normal startups of the main CPU is reset to 0; the operation is repeated. If no system message sent by the main CPU is read within ctl_recv_msg_timeout_secs, the main CPU abnormal startup count cpu_abnormal_count will be 2+1=3, which is greater than or equal to cpu_abnormal_thershold=3. The threshold for the number of normal startups of the main CPU will be reset to 0. At this time, the main system is judged to be faulty. The startup control signal is set to low level, the TF card detection signal is enabled, the power control signal is set, the main CPU and peripheral circuits are restarted, the main CPU obtains the startup permission of the backup system, and at the same time, the main CPU receives the startup control signal sent by the main control unit as low level, selects the startup path as starting from the backup system, sends a system startup completion message to the main control unit, locks the system, enters self-recovery mode, and backs up the backup system to the main system. Furthermore, every system message interval cpu_send_msg_interval_secs, such as 1 second, the main CPU sends a message indicating that the main system is in self-recovery to the main control unit; the main control unit reads the serial port messages of the main CPU, and if it finds that the system message sent by the main CPU is the message indicating that the main system is in self-recovery (0XFE 0X030XFF) within ctl_recv_msg_timeout_secs, it determines that the main system is in the recovery process. Continue the message monitoring phase and repeat the operation. The main control unit continues to read the serial port messages of the main CPU and reads the system message sent by the main CPU within ctl_recv_msg_timeout_secs, which is the message that the main system is self-recovering (0XFE 0X03 0XFF). It continuously performs self-detection on the running status of the main system and tracks the recovery progress until the self-recovery is completed. The main control unit reads the serial port messages from the main CPU and, within ctl_recv_msg_timeout_secs, finds that the system message sent by the main CPU is a main system self-recovery completion message (0XFE 0X04 0XFF). If so, it determines that the main system self-recovery is complete. It then sets the boot control signal to high level, disables the TF detection signal, and confirms that the main CPU has lost boot privileges for the backup system. Simultaneously, when the main CPU receives a high-level boot control signal from the main control unit, it selects the boot path as booting from the main system and sends a system boot completion message to the main control unit. Then, the main control unit continues to read the serial port messages of the main CPU. If the system message sent by the main CPU within ctl_recv_msg_timeout_secs is a normal system operation message 0XFE 0X02 0XFF, it is determined that the main system is operating normally. At this time, if the main CPU normal startup count of 0 is less than the main CPU normal startup count threshold of 3, the main CPU normal startup count is incremented by 1. Since the main CPU normal startup count is not equal to the main CPU normal startup count threshold of 3, the main control unit continues to read the serial port messages of the main CPU and repeats the operation until the main CPU normal startup count equals the main CPU normal startup count threshold of 3. Then, the main CPU abnormal startup count cpu_abnormal_count is set to 0, and message monitoring continues.

[0074] The foregoing has described some specific embodiments of this application. It should be understood that this application is not limited to the specific embodiments described above, and those skilled in the art can make various modifications or variations within the scope of the claims, which do not affect the substantive content of this application. The above-described preferred features can be used in any combination without conflict.

Claims

1. A method for system self-detection and self-recovery, characterized in that, include: A main control unit is used to monitor the main CPU, and the main control unit communicates with the main CPU through an internal serial port; The main control unit receives and parses system messages sent by the main CPU, and controls the main control unit to output a preset storage space detection signal according to the system messages, so as to determine the main CPU's boot permission for the backup system; wherein, the backup system is stored in the preset storage space and is physically isolated from the main system; Based on the system messages and the startup permissions, the main system performs self-detection, self-recovery, and restart recovery.

2. The method for system self-detection and self-recovery according to claim 1, characterized in that, The method of using a main control unit to monitor the main CPU includes: The main control unit determines the startup source of the main CPU through a startup control signal, and the startup source includes: the startup of the main system or the startup of the backup system; The main control unit controls the power-on and power-off of the main CPU and peripheral circuits of the device through power control signals; Specifically, the main control unit receives and parses system messages sent by the main CPU. The system messages include system startup completion messages, main system normal operation messages, main system self-recovery messages, and main system self-recovery completion messages. The system startup completion messages include main system startup completion messages and backup system startup completion messages.

3. The system self-detection and self-recovery method according to claim 2, characterized in that, The step of utilizing the main control unit to perform self-detection, self-recovery, and restart recovery of the main system's operating status based on the system messages includes: Define the parameters for communication between the main control unit and the main CPU; The main CPU-side control process is executed using the start control signal and the parameters. Using the parameters and system messages generated during the main CPU-side control process, the main control unit-side control process is executed to perform self-detection, self-recovery, and restart recovery on the main system. The parameters include: time parameters, count parameters, and threshold parameters, which are used by the main control unit to determine the status of the main system. The time parameters include: defining the timeout period for the main control unit to wait for the main CPU system message as ctl_recv_msg_timeout_secs; The interval between the main CPU sending the system message to the main control unit is defined as cpu_send_msg_interval_secs; The counting parameters include: defining the main CPU normal startup count as cpu_normal_count and the main CPU abnormal startup count as cpu_abnormal_count; The threshold parameters include: defining the threshold for the number of normal startups of the main CPU as cpu_normal_thershold and the threshold for the number of abnormal startups of the main CPU as cpu_abnormal_thershold; The timeout period for the main control unit to wait for the system to start up is defined as system_start_timeout_secs; The timeout period is greater than or equal to twice the interval time.

4. The system self-detection and self-recovery method according to claim 3, characterized in that, The process of executing the main CPU-side control via the start control signal and the parameters includes: The main CPU starts up and runs to the UEFI stage, and reads the startup control signal output by the main control unit; If the startup control signal is high, the main CPU determines that it is starting from the main system and sends a main system startup completion message to the main control unit. Then, it sends a main system normal operation message to the main control unit every cpu_send_msg_interval_secs. If the startup control signal is low, the main CPU determines that it will start from the backup system and sends a backup system startup completion message to the main control unit, and enters self-recovery mode; The backup system is synchronized to the main system memory, and a message indicating that the main system is self-recovering and self-recovery is complete is sent to the main control unit.

5. The system self-detection and self-recovery method according to claim 4, characterized in that, In the self-recovery mode, the main CPU locks the device operating system and displays the self-recovery progress. Every cpu_send_msg_interval_secs, the main CPU sends a message to the main control unit that the main system is self-recovering until the self-recovery is complete.

6. The system self-detection and self-recovery method according to claim 4, characterized in that, The process of executing the main control unit-side control process using the parameters and system messages generated during the main CPU-side control process, and performing self-detection, self-recovery, and restart recovery on the main system, includes: The main control unit is powered on and the start control signal is set to a high level to disable the preset storage space detection signal. If the main control unit receives a startup completion message from the main CPU within the system_start_timeout_secs, it determines that the main CPU has started normally and enters the subsequent message monitoring stage to continuously self-detect the operating status of the main system. If the system startup completion message is not received within the system_start_timeout_secs, the main CPU startup is determined to be abnormal, and abnormal startup counting is performed.

7. The method for system self-detection and self-recovery according to claim 6, characterized in that, The subsequent message monitoring phase involves continuous self-monitoring of the main system's operational status, including: The main control unit reads the serial port messages of the main CPU and determines whether a system message has been received within ctl_recv_msg_timeout_secs; If the main control unit does not receive any system message sent by the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system is running abnormally and performs abnormal startup counting processing. If the main control unit receives the main system normal operation message sent by the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system is operating normally and performs normal startup counting processing. If the main control unit receives a message from the main CPU indicating that the main system is self-recovering within ctl_recv_msg_timeout_secs, it determines that the main system is in the recovery process, continues to maintain the message monitoring phase, continuously self-detects the main system's operating status, and tracks the recovery progress. If the main control unit receives the main system self-recovery completion message sent by the main CPU within ctl_recv_msg_timeout_secs, it determines that the main system has recovered normally and performs post-recovery reset processing.

8. The method for system self-detection and self-recovery according to claim 7, characterized in that, The abnormal startup counting process, used to trigger backup system calls, includes: The main control unit increments the value of cpu_abnormal_count by 1, and simultaneously sets the value of cpu_abnormal_count to 0; If cpu_abnormal_count is greater than or equal to cpu_abnormal_thershold, the main system is determined to be faulty, and the backup system is activated; the value of cpu_abnormal_count is set to 0, the main control unit sets the startup control signal to a low level, outputs the preset storage space detection signal in an enabled state, and then controls the main CPU and peripheral circuits to restart via the power control signal, starting from the backup system, and the main system performs self-recovery; If cpu_abnormal_count is less than cpu_abnormal_thershold, the main system is determined to be an intermittent abnormality. The main control unit directly controls the main CPU and the peripheral circuit to restart through the power control signal and retry to start from the main system.

9. The method for system self-detection and self-recovery according to claim 7, characterized in that, The normal startup counting process includes: If the cpu_normal_count is less than the cpu_normal_thershold, the main control unit increments the value of the cpu_normal_count by 1; If cpu_abnormal_count > 0 and cpu_normal_count equals cpu_normal_thershold, then the main system is determined to have recovered to stable operation, and the main control unit sets the value of cpu_abnormal_count to 0; The main control unit returns to the message monitoring phase and continuously performs self-detection on the main system's operating status.

10. A system self-detection and self-recovery method according to claim 1, characterized in that, The step of controlling the main control unit to output a preset storage space detection signal according to the system message, so as to control the main CPU's boot permission for the backup system, includes: When the main control unit determines that the main system is normal, the main control unit deactivates the preset storage space detection signal, causing the main CPU to lose access to the preset storage space, and the main CPU only boots from the main system; When the main control unit determines that the main system is faulty, the main control unit enables the preset storage space detection signal, enabling the main CPU to obtain access to the preset storage space. The main CPU then starts from the backup system and enters self-recovery mode.

Images