Millisecond-level power failure data protection system for industrial control panel

Abstract

The invention belongs to the technical field of computer control and data protection, particularly relates to a millisecond-level power failure data protection system for an industrial control panel, and aims to solve the problems of key data loss and abnormal system state caused by sudden power failure. The system rapidly detects voltage drop and triggers interruption through the hardware sensing layer, the dynamic judgment layer completes data classification and task scheduling in a microsecond level, emergency, important and ordinary data are written in parallel by combining heterogeneous nonvolatile media of the multi-channel collaborative storage layer, and the power management unit supplies power by using a super capacitor and implements frequency reduction and energy saving. It is ensured that core data falls safely within 120 milliseconds after power failure, and the data integrity and system robustness of the industrial control panel in high-reliability scenes such as electric power and rail transit are improved.

Description

Technical Field

[0001] This invention belongs to the field of computer control and data protection technology, specifically relating to a millisecond-level power-loss data protection system for industrial control tablets. Background Technology

[0002] In the field of industrial control, embedded computing devices, as core control units, are widely used in critical scenarios such as intelligent manufacturing, energy management, and rail transportation. These devices typically take the form of industrial control tablets or embedded controllers, undertaking important functions such as data acquisition, logic control, human-machine interaction, and real-time communication. With the increasing level of industrial automation, systems place higher demands on the stability, continuity, and data integrity of equipment operation. Especially under abnormal power supply conditions such as sudden power outages and voltage drops, ensuring the secure storage of critical data becomes a crucial factor affecting system reliability.

[0003] Industrial control tablets, as integrated terminals combining display, computing, and interface functions, are commonly used in field operator stations or local monitoring nodes. Their internal operating systems, user operation records, real-time process parameters, and unuploaded production data all need to be reliably saved in the event of a power outage. These devices generally use solid-state storage media and rely on caching mechanisms to improve read / write performance; however, during power outages, they are prone to data loss or file system corruption due to the failure to promptly write cached data to disk.

[0004] While some industrial control equipment is equipped with uninterruptible power supplies (UPS), supercapacitors, or hardware watchdog circuits to extend power supply time or trigger safe shutdown, existing technologies still have significant drawbacks: delayed power-down response leads to lagging protection actions; unstable discharge curves of energy storage components make it difficult to support millisecond-level precise operations; file system log mechanisms have high overhead and cannot guarantee the atomic writing of all critical data; and there is a lack of real-time prediction and hierarchical early warning capabilities for power status, preventing data protection strategies from being implemented proactively. In industrial sites with frequent power grid fluctuations or harsh power supply environments, these problems can easily lead to erroneous control commands, missing historical data, or even system startup failures, seriously threatening production safety and operational efficiency. Therefore, there is an urgent need for an industrial control tablet system capable of identifying power anomalies and protecting critical data within a millisecond timescale. Summary of the Invention

[0005] The purpose of this invention is to provide a millisecond-level power failure data protection system for industrial control tablets, addressing the technical problems in industrial control fields such as loss of critical operational data, abnormal system status, and inability to restore equipment to its pre-power failure operating state after restarting due to sudden power outages. Currently, industrial control tablets are widely used in scenarios with extremely high requirements for system continuity and data integrity, such as power, rail transportation, and intelligent manufacturing. Their operating environment often faces the risk of instantaneous power outages caused by power grid fluctuations, equipment failures, or human error. Existing technologies generally rely on operating system-level logging mechanisms or external uninterruptible power supplies (UPS) for data protection. The former has a long response delay and cannot complete the persistent storage of critical data within a millisecond window after power failure, while the latter increases system complexity and cost, and still involves brief interruptions in data acquisition and processing during backup power switching. These shortcomings lead to frequent problems in real industrial environments, such as incorrect process parameters, production batch traceability failures, and control system logic disorder.

[0006] The technical solution of this invention is to construct a system-level architecture consisting of a hardware sensing layer, a dynamic decision-making layer, a multi-channel collaborative storage layer, and a power management unit, achieving millisecond-level response across the entire chain from power failure signal capture to secure disk write of core data. The hardware sensing layer, integrated into the industrial control tablet motherboard, includes a voltage monitoring circuit and an electromagnetic induction coil. It is used to sample the voltage amplitude and rate of change of the power supply bus in real time, and immediately generates a hardware-level interrupt signal when the voltage drop rate exceeds a threshold of 5V per millisecond. This interrupt signal directly triggers the startup process of the dynamic decision-making layer without being scheduled by the operating system.

[0007] The dynamic decision-making layer, deployed on the embedded real-time microcontroller, receives an interrupt signal from the hardware perception layer and completes a system context scan within 200 microseconds to obtain the priority list of currently running processes, the address mapping table of unsynchronized data blocks in memory, and the dirty page status information of the file system. Based on a preset data importance classification strategy, the dynamic decision-making layer divides the data to be saved into three categories: urgent, important, and ordinary. Urgent data includes PLC control instruction queues, real-time sensor sampling buffers, and pending messages in the communication protocol stack; important data covers current process recipe parameters, user operation logs, and equipment operation statistics; the rest is ordinary data. The dynamic decision-making layer calculates the maximum storable capacity quota for each type of data based on the system's available write bandwidth and remaining energy storage capacity, and generates a data write-to-disk task sequence with timestamps and priority tags.

[0008] The multi-channel collaborative storage layer consists of three independently operating physical storage paths, each connected to different types of non-volatile storage media. The first channel uses a low-latency NOR Flash array, dedicated to storing urgent data. Its interface protocol is optimized for direct write mode with small data packets not exceeding 64 bytes per write, achieving an average write latency of less than 800 microseconds. The second channel connects to a high-endurance FRAM memory, responsible for receiving important data. Utilizing its unlimited read / write capability, it implements a circular cache structure to ensure data consistency even under frequent power outages. The third channel connects to a large-capacity SSD via a PCIe bus, used to temporarily store as many snapshots of ordinary data as possible before mains power is restored. The three channels receive task packets distributed by the dynamic decision layer in parallel and execute differentiated write strategies based on their respective media characteristics. The first and second channels have the highest access priority, and their DMA transfer requests can preempt regular CPU tasks.

[0009] The power management unit incorporates a dual-path power supply mechanism. The primary path is powered by an external DC input via DC-DC conversion, while the secondary path utilizes a solid-state supercapacitor bank. The positive terminal of this bank is connected in parallel with the main power supply through an ideal diode, while the negative terminal is grounded. When the hardware sensing layer detects a voltage drop, the supercapacitor bank automatically switches in within 100 microseconds, providing a stable voltage output of at least 3.3V to the dynamic decision layer, multi-channel collaborative storage layer, and critical storage media for at least 120 milliseconds. Simultaneously, the power management unit issues a forced frequency reduction command to the CPU, reducing its operating frequency from 1.8GHz to 400MHz and shutting down all unnecessary peripheral clock sources. This causes the overall board power consumption to plummet from 15W to below 2.3W, maximizing the effective protection time window.

[0010] Furthermore, the dynamic decision-making layer introduces a data compression preprocessing module. Before task distribution, it performs lightweight LZ77 algorithm compression on urgent and important data streams, with the compression ratio dynamically adjusted from 60% to 85% to reduce the actual amount of data written. The compression process is executed by a dedicated coprocessor to avoid consuming main control CPU resources. For data with strong timing constraints, such as PLC instruction queues, incremental encoding is used to record the differences between the states before and after, rather than completely copying the entire data structure.

[0011] In one embodiment of the present invention, the first channel of the multi-channel collaborative storage layer, the NOR Flash array, is divided into multiple independent sectors, each corresponding to a specific type of emergency data source. A double-buffered alternation mechanism is used for write addresses; when the current buffer is full, it immediately switches to the spare area, and the original area enters an erase preparation state, ensuring seamless access to continuous bursts of data. The second channel FRAM memory establishes a circular log structure, with the head pointer maintained uniformly by a dynamic decision layer. The pointer increments after each write, and when it reaches the end, it automatically rolls back to the beginning, naturally overwriting old data. During the system power-on self-test phase, the difference in timestamps between the last two log records is checked to determine whether an abnormal power outage has occurred.

[0012] Furthermore, the power management unit incorporates an energy storage status detection circuit that periodically measures the terminal voltage and internal resistance of the supercapacitor bank, and evaluates its effective discharge capacity using an ambient temperature compensation model. When the detected energy storage capacity falls below the minimum limit required to maintain 100 milliseconds of protection, an early warning signal is triggered, notifying the operating system to execute a planned shutdown procedure in advance. This detection process is performed in the background during normal system operation, with a sampling interval of 3 minutes.

[0013] In one embodiment of the present invention, a dedicated signal bus with physical isolation is established between the dynamic decision layer and the hardware perception layer. This bus includes four differential signal lines for transmitting interrupt trigger pulses and acknowledgment signals, achieving anti-interference capability at Level 4 of the IEC 61000-4-4 standard. Status feedback information from each channel of the multi-channel collaborative storage layer is aggregated into a unified monitoring register. The dynamic decision layer polls and reads the write completion flag and error counter of each channel. If no acknowledgment is received within a specified timeout period, a redundancy backup mechanism is activated, redirecting unacknowledged data to other available channels.

[0014] Furthermore, the system defines a unified data encapsulation format. Each data unit contains a 16-byte header, consisting of a timestamp field, a data type identifier, the original length, the compressed length, a checksum, and reserved bits. The header information and the payload data participate in a CRC32 checksum calculation to ensure transmission integrity. This encapsulation format is constructed when the task packet is generated by the dynamic decision layer, and each storage channel only performs transparent write operations without parsing the internal structure.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: This solution completely avoids operating system scheduling delays by constructing a hardware-level voltage surge detection and interrupt response mechanism, compressing the data protection action startup time to below milliseconds, fundamentally solving the problem of lag in traditional software solutions. It adopts a three-channel heterogeneous storage architecture, matching the optimal storage medium according to the criticality of different data types. This ensures extreme write speeds for urgent data while balancing the long-term reliability of important data and the large-capacity temporary storage needs of ordinary data, achieving optimal performance, lifespan, and cost. The power management unit integrates solid-state supercapacitors and intelligent frequency reduction control, forming a closed-loop energy optimization system, maximizing energy efficiency under limited energy storage conditions. The system maximizes effective protection time, enabling it to independently handle most instantaneous power outages without external UPS support. The dynamic decision layer introduces context-aware data classification and compression strategies, significantly reducing write load per unit time. Combined with a dedicated encapsulation format and multi-channel status monitoring, it ensures data integrity and traceability during high-speed data transfer. The overall technical solution forms a fully autonomous closed loop from power anomaly identification, decision generation, data scheduling to physical disk writes. It can provide transparent data security for various industrial control software without relying on upper-layer application modifications, greatly improving the robustness and production continuity of industrial field equipment. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the overall technical solution architecture proposed in this invention; Figure 2 This is a schematic diagram illustrating the core principle framework of the collaborative operation of the dynamic determination layer and the multi-channel collaborative storage layer in this invention. Detailed Implementation

[0017] Please refer to Figure 1 and Figure 2This invention relates to a millisecond-level power-loss data protection system for industrial control tablets. Its purpose is to construct a hardware-software collaborative architecture with end-to-end autonomous response capabilities, enabling secure and persistent storage of critical operational data within a very short time after a sudden power outage. Deployed within the industrial control tablet device and integrated at the motherboard level, the system operates independently of the operating system environment, ensuring full functionality even after a mains power interruption. The system comprises a hardware sensing layer, a dynamic judgment layer, a multi-channel collaborative storage layer, and a power management unit. Each module achieves efficient linkage through dedicated signal paths and power supply paths. The technical process begins with monitoring the power bus status. Upon detecting an abnormal voltage drop, a hardware interrupt is immediately triggered, activating the dynamic judgment logic in the embedded real-time microcontroller. Subsequently, based on the current system context, the data to be saved in memory is classified, compressed, and task-scheduled. This data is then written in parallel to different types of non-volatile storage media through three physically isolated storage channels. The entire process is supported by supercapacitor backup power provided by the power management unit, combined with CPU downclocking and peripheral shutdown strategies to extend the effective operating time window, ultimately achieving a total control time of less than 120 milliseconds from the occurrence of a power outage to the storage of core data.

[0018] The hardware sensing layer, acting as the system's front-end monitoring hub, is directly connected to the DC power supply bus of the industrial control tablet for real-time sampling of the instantaneous amplitude and trend of the input voltage. This layer includes a high-precision voltage divider network and a differential comparator circuit. The voltage divider network uses a temperature-compensated resistor array to proportionally attenuate the 48V standard industrial input to a measurable signal within the 3.3V range, which is then connected to the analog input port of the high-speed analog-to-digital converter. The sampling frequency is set to 100,000 times per second. The differential comparator circuit is equipped with a programmable threshold comparator, whose reference voltage is provided by a precision reference source and set to 90% of the nominal voltage. That is, when the input voltage drops below 43.2V, a preliminary warning mechanism is activated. To further identify instantaneous voltage drops rather than slow fluctuations, the system introduces a rate of change detection logic, which calculates the voltage drop rate by dividing the voltage difference between two consecutive sampling points by the time interval. When the detected voltage drop rate exceeds the critical threshold of 5V per millisecond, it is immediately determined as a sudden power failure event, and a hardware logic gate generates a pulse-type interrupt signal with a steep rising edge. The interrupt signal bypasses any software polling or operating system interrupt controller. Instead, it is directly connected via physical wiring to the emergency external interrupt pin of the embedded real-time microcontroller upon which the dynamic decision layer relies, ensuring a signal transmission delay of less than 50 microseconds. To enhance electromagnetic interference immunity, the interrupt signal uses a redundant transmission bus with four differential pairs, supporting LVDS level transmission and achieving a common-mode rejection ratio of over 80dB, meeting the Level 4 industrial protection requirements of the IEC 61000-4-4 standard. Once the interrupt signal is successfully received, the microcontroller's internal acknowledgment circuit sends a low-level acknowledgment pulse back to the status register of the hardware sensing layer, forming a closed-loop handshake mechanism to prevent false triggering or signal loss from causing the protection process to fail.

[0019] The dynamic decision-making layer runs on a high-performance embedded real-time microcontroller, specifically an ARM Cortex-M7 architecture with a 600MHz clock speed. It features 1MB of SRAM cache and an independent bus interface, dedicated to handling power-off emergency decision-making tasks. Upon receiving an interrupt signal from the hardware awareness layer, this layer completes initialization and loading within 200 microseconds and starts the context scanner. The context scanner directly accesses the application processor's memory-mapped space via the boundary scan function of the JTAG debug interface, reading data snapshots of critical areas without interfering with its normal operation. The scan includes: a priority list of currently running processes, recording all active tasks and their scheduling weights; an unsynchronized data block address mapping table, identifying the physical addresses of data pages that have not yet been written to storage media but are still cached in RAM; a set of dirty page status flags in the file system, indicating which sectors contain modified but not yet written content; and the occupancy status of internal buffers within the communication protocol stack, particularly the queue lengths of pending messages for industrial protocols such as Modbus TCP and Profinet. This information is aggregated into a structured system state vector, serving as the foundational input for subsequent data classification decisions.

[0020] Based on a pre-defined data importance classification strategy, the dynamic judgment layer categorizes data to be saved into three types: urgent, important, and ordinary. Urgent data is defined as real-time control information that directly affects the safe operation of equipment and process continuity. Specifically, it includes the next cycle execution command sequence in the PLC instruction queue, a buffer snapshot consisting of the last 10 sets of sampled values ​​from field sensors, position loop feedback parameters from the motion control card, and copies of messages currently in the transmission buffer of the industrial Ethernet communication protocol stack. This type of data has strong time constraints; its loss will directly lead to logical errors in the control system or abnormal actions of the actuators. Important data covers configuration and log information that affects production quality and traceability, including the currently executing process recipe parameter set, user operation behavior logs for the last 3 minutes, cumulative equipment runtime statistics, fault code history records, and alarm event logs. While this type of data does not require microsecond-level synchronization, it must be restored to consistency after a restart to ensure business continuity. Other data not included in the above two categories is classified as ordinary, such as temporary calculation intermediate values, interface rendering cache, and non-critical service logs, which are allowed to be partially lost without affecting the basic functions of the system.

[0021] After data classification, the dynamic decision-making layer further performs resource quota calculations to adapt to the currently available write bandwidth and energy storage capacity limitations. The system pre-stores performance parameter models for each storage channel: the first channel's NOR Flash array has a maximum sustained write rate of 1.2MB / s and a minimum erase unit of 4KB; the second channel's FRAM memory supports byte-level random writes, has a theoretical lifespan exceeding 10^14 cycles, and a write speed of up to 8MB / s; the third channel's SSD is connected via a PCIe 3.0 x2 interface, with a sequential write bandwidth of 350MB / s, but an initial access latency as high as 5 milliseconds. Simultaneously, the power management unit reports the remaining energy estimate of the supercapacitor bank in real time, combining it with the current overall board power consumption model to predict the available protection time. Based on this, the dynamic decision-making layer establishes a multi-objective optimization function, aiming to maximize the preservation integrity of high-priority data within a limited time. The function comprehensively considers the expected volume of each type of data, channel write efficiency, and media durability constraints to calculate the maximum data volume limit that can be allocated to each category. For example, under typical operating conditions, the quota for urgent data is set to no more than 64KB, for important data no more than 512KB, and for ordinary data, it is dynamically adjusted according to the SSD channel load, with a maximum temporary storage of 4MB.

[0022] To improve write efficiency, the dynamic decision layer integrates a data compression preprocessing module, specifically implementing a lightweight compression algorithm for urgent and important data streams. This module is implemented by a dedicated hardware coprocessor, with an instruction set optimized for the LZ77 series algorithms. It supports an adjustable sliding window size ranging from 2KB to 16KB, matching the repetitive pattern characteristics of different data sources. During compression, the coprocessor reads raw data page by page from memory, performs dictionary lookups and code replacements, and outputs a compressed stream in DEFLATE format conforming to the RFC1951 standard. The compression ratio is dynamically adjusted based on the input data entropy value, with a minimum of 60% and a maximum of 85%. For structured data such as PLC instruction queues, the system additionally enables an incremental encoding mechanism, recording only the difference fields between the current state and the previous cycle state, rather than completely copying the entire control block. For example, if only three register values ​​change, the encoder only outputs these three addresses and their new values, improving compression efficiency to over 95%. The compressed data stream is packaged into standardized task units, each with a 16-byte header containing a generation timestamp, original data type identifier, uncompressed length, compressed length, 32-bit CRC checksum, and a 2-byte reserved field. The header and payload work together in integrity verification to ensure data consistency can be verified during subsequent transmission and writing.

[0023] After the task unit is constructed, the dynamic decision layer distributes it to the corresponding storage channel based on data type. The distribution logic follows a strict priority scheduling principle: urgent tasks always enter the first channel first, important tasks enter the second channel next, and ordinary tasks are allocated to the third channel last. If a channel is temporarily unavailable due to media busyness or errors, the task will be temporarily cached in the pending queue in the microcontroller's local SRAM, and a retry mechanism will be initiated. There is no shared resource contention between channels, the DMA controller is independently configured, and transmission requests have preemptive capabilities, which can interrupt regular CPU data transfer tasks to ensure that critical write operations are not blocked.

[0024] The multi-channel collaborative storage layer consists of three physically isolated storage paths, each customized to meet different data characteristics and reliability requirements. The first channel is dedicated to ultra-fast disk writing of urgent data, using a low-latency NOR Flash array as the storage medium. This array comprises eight parallel serial NOR Flash chips, each with a capacity of 64MB, supporting a four-wire SPI protocol with a theoretical bandwidth of 400Mbps. To eliminate the inherent latency of traditional Flash's erase-then-write mechanism, the system deeply optimizes the write mode, limiting the data packet length of a single write operation to no more than 64 bytes, avoiding sector erase operations, and directly utilizing the chip's internal small-page programming function to achieve "write-to-effective" results. Actual testing shows that the average write latency is stable within 780 microseconds, meeting millisecond-level response requirements. The NOR Flash array is internally divided into multiple independent functional sectors, each sector corresponding to a specific type of urgent data source. For example, sector A is dedicated to the PLC instruction queue, sector B to the sensor buffer, and sector C to communication message snapshots. Each sector employs a dual-buffered alternating write mechanism, with a primary buffer and a backup buffer. Initially, the primary sector is open for writing, and new task units are appended sequentially upon receipt. Once the sector reaches 64KB, a switching signal is triggered, and subsequent data is automatically redirected to the backup sector. The original primary sector then enters a background asynchronous erase process, ready for the next cycle. This mechanism ensures seamless data access even during continuous sudden power outages, preventing data loss due to erase waiting times.

[0025] The second channel provides high-endurance circular storage services for critical data, using ferroelectric random access memory (FRAM) as the core medium. The FRAM chip is a Cypress FM24V10, with a single chip capacity of 1MB, supporting both I2C and SPI interfaces. Its theoretical write endurance is unlimited, and it achieves nanosecond-level write response without a charge pump. The system configures it as a circular log structure, dividing the total capacity into 1024 fixed-size log entries, each containing a 512-byte payload. The write pointer at the head of the circular buffer is maintained by a dynamic decision layer and stored in the microcontroller's backup register. It increments by 1 after each successful write to an entry and automatically wraps back to the beginning when the end is reached. Old data is automatically invalidated when overwritten by new data, without explicit deletion. Each log entry contains a fully encapsulated data unit, and the timestamp field at the header is used for post-event analysis to pinpoint the exact time of a power outage. During the system's power-on self-test phase, the timestamps of the last two log records are actively read, and the difference is calculated. If the difference is less than 1 second, it is determined to be an abnormal power-off restart, triggering the integrity repair process; if it is greater than or equal to 1 second, it is considered a normal shutdown, and the normal startup sequence continues. The FRAM channel also supports hardware-level write protection, prohibiting any write operations before the dynamic judgment layer issues an unlock command to prevent accidental tampering.

[0026] The third channel handles large-capacity temporary storage of general-purpose data, connecting to the built-in M.2 interface SSD via the PCIe bus. The SSD controller supports the NVMe protocol, features independent DRAM caching and wear leveling algorithms, and has a nominal write endurance of 300TBW. Even after the mains power is completely cut off, this channel can maintain approximately 80 milliseconds of effective access time via a supercapacitor, during which time as many dirty page snapshots as possible from memory are written to the SSD's reserved safety partition. Due to the high initialization latency of the SSD, the system employs a batch commit strategy, merging multiple general-purpose task units into a single logical write request, with a minimum commit unit of 4KB to improve transmission efficiency. If all temporary storage tasks are not completed before the protection window expires, the remaining data will be handled by the operating system-level log recovery mechanism after the system's next power-on, forming a multi-level disaster recovery system.

[0027] During operation, the three storage channels continuously feed back status information to the dynamic decision-making layer. Each channel has an independent status register, recording the write completion flag, transmission error counter, media readiness status, and remaining space percentage. The dynamic decision-making layer periodically reads these registers via polling to check whether each channel returns a success acknowledgment within a specified timeout period (1 millisecond for the first channel, 2 milliseconds for the second channel, and 10 milliseconds for the third channel). If a channel fails to respond on time, it is determined to be a write failure, and a redundancy backup mechanism is immediately activated: unacknowledged data tasks are redirected to other available channels. For example, when the first channel's NOR Flash fails to program due to aging, urgent data will be temporarily downgraded and written to the second channel's FRAM, sacrificing some write speed but ensuring that critical data is not lost. The redundancy strategy priority is set so that the FRAM channel can receive urgent and important data, the SSD channel can only receive important and ordinary data, and the NOR Flash channel cannot receive other types of downgraded data, in order to maintain its extreme performance positioning.

[0028] The power management unit (PMU) assumes dual responsibilities of energy supply and power consumption regulation, ensuring that the system can still complete all protection actions under limited energy storage conditions after an external power outage. The unit adopts a dual-path energy supply architecture: the main path receives an external 24V to 48V DC input, which is regulated by a multi-phase step-down DC-DC converter to two system voltages of 3.3V and 1.8V, with an efficiency of no less than 94%; the auxiliary path is equipped with a solid-state supercapacitor bank with a total capacity of 1.5 Farads and a rated voltage of 5.5V, connected in parallel with the positive terminal of the main power supply through an ideal diode, with the negative terminals sharing a common ground. The ideal diode is implemented using a MOSFET with control circuitry, achieving a forward voltage drop below 50 millivolts, avoiding the power loss of traditional Schottky diodes. When the hardware sensing layer detects that the bus voltage has dropped to a set threshold, the supercapacitor bank automatically switches to power supply mode within 100 microseconds, providing a stable voltage output for the dynamic judgment layer, the multi-channel collaborative storage layer, and the write circuits of various non-volatile storage media. The capacitor bank is designed to maintain a discharge curve above 3.3V for at least 120 milliseconds, which is sufficient to cover the complete data classification, compression, and three-channel parallel writing process.

[0029] To extend the effective protection time, the power management unit issues a forced frequency reduction command to the application processor simultaneously with the interrupt trigger. This command is sent to the CPU's power management controller via a dedicated low-latency control bus, requiring it to immediately reduce the operating frequency from 1.8GHz to 400MHz and shut down the clock sources of all non-essential peripherals, including the GPU, video output, USB host controller, and Wi-Fi / BT RF module. The overall board power consumption is thus drastically reduced from 15W during normal operation to below 2.3W, improving the energy utilization of the supercapacitor bank by more than five times. The frequency reduction operation employs a progressive voltage-frequency scaling (PVS) mechanism to avoid metastability in digital circuits caused by abrupt power drops, ensuring that the CPU can reliably execute memory data read tasks at low frequencies until the protection process ends.

[0030] The power management unit also incorporates an energy storage status detection circuit to assess the health and effective discharge capacity of the supercapacitor bank. The detection circuit activates periodically with a 3-minute sampling interval, running in the background during normal system operation without affecting main business processing. Each sampling involves two steps: first, measuring the no-load terminal voltage of the supercapacitor bank with an accuracy of ±10 mV; second, applying a known pulse load current (peak 2A, lasting 10 ms), and third, measuring the voltage drop amplitude, calculating the current equivalent series internal resistance using Ohm's law. The obtained voltage and internal resistance data are input into a preset temperature compensation model, which is based on the Arrhenius equation, considers the relationship between electrolyte aging rate and ambient temperature, and outputs a corrected effective capacity estimate. When the detected energy storage capacity falls below the minimum limit required to maintain 100 ms of protection (corresponding to a capacitor terminal voltage ≥ 4.8V and internal resistance ≤ 80 mΩ), the power management unit generates a warning signal and notifies the operating system via a standard GPIO interface. Based on this, the operating system initiates a planned shutdown process, synchronizes critical data to permanent storage in advance, and terminates all service processes in an orderly manner to avoid being forced into emergency protection mode during subsequent actual power outages, thereby extending the lifespan of the supercapacitor and reducing the number of abnormal restarts.

[0031] The system defines a unified data encapsulation format as the standard information unit for cross-layer transmission. Each data unit is constructed when the task packet is generated by the dynamic decision layer, containing a 16-byte header and variable-length payload data. The header fields are arranged in the following order: a 4-byte Unix timestamp, recording the absolute time of task generation with millisecond precision; a 2-byte data type identifier, using enumeration encoding to distinguish between urgent, important, and normal types and their subclasses; a 2-byte original length field, indicating the number of bytes of data before compression; a 2-byte compressed length field, valid only when compression is enabled, otherwise the same as the original length; a 4-byte CRC32 checksum, covering all data in the header and payload, with a generator polynomial of 0xEDB88320; and the last 2 bytes are reserved for future feature expansion. This encapsulation format maintains transparent transmission characteristics in each storage channel. The channel controller only performs raw data write operations, without parsing or modifying the internal structure, ensuring that the data can be directly parsed and restored by upper-layer applications or diagnostic tools after being written to disk. Checksum verification is performed by the host system during the read phase. If a mismatch is found, the data unit is marked as corrupted, triggering a repair or alarm process.

[0032] A dedicated, physically isolated signal bus is established between the dynamic decision layer and the hardware perception layer to eliminate coupling interference with other digital signals. The bus contains four differential signal lines, used to transmit interrupt trigger pulses, acknowledgment signals, global reset commands, and clock synchronization signals. All signals adopt the LVDS level standard. The driver circuit is located on the hardware perception layer side, and the receiving end is configured with a terminating resistor. The wiring maintains a constant impedance of 100 ohms throughout. The interrupt trigger pulse width is fixed at 2 microseconds, with a rise time of less than 1 nanosecond, ensuring accurate identification even in noisy environments. The acknowledgment signal is issued by the dynamic decision layer after initialization, with a delay of no more than 10 microseconds, forming a bidirectional reliable link. The global reset command is used to forcibly clear the status registers of each module upon system power-on or self-test failure. The clock synchronization signal provides a 10MHz reference frequency to coordinate multi-channel write timing, ensuring atomicity, especially in double-buffered switching and ring pointer increment operations.

[0033] The status feedback information of each channel in the multi-channel collaborative storage layer is aggregated into a unified monitoring register, which is located in the peripheral address space of the microcontroller in the dynamic decision layer and mapped to a single access endpoint. Each channel updates its status fields, including write completion flag, error type code (such as timeout, verification failure, media failure), retry count, and current throughput, through an independent interrupt line or polling interface. The dynamic decision layer starts a timer to monitor after task distribution. If no completion flag is received within a preset timeout window, the channel is deemed to have responded abnormally, and the aforementioned redundant backup process is immediately executed. Error type codes are used for post-fault attribution analysis, and long-term accumulation can generate a media health trend chart to assist in preventive maintenance decisions.

[0034] in, This indicates the effective discharge time that the supercapacitor bank can provide, in milliseconds. The voltage across the capacitor is measured at the instant the power is cut off, and the unit is volts. The minimum voltage threshold for the system to maintain operation is set to 3.3V; This is the equivalent series internal resistance of the capacitor, in ohms. This represents the total system power consumption after regulation by the power management unit, expressed in watts. This formula describes the theoretical time boundary for the system's sustainable operation under a given energy storage state, and is one of the important bases for the dynamic decision-making layer to formulate data storage strategies. The power consumption is obtained through real-time input detection circuitry. and Value, and combined The 2.3W power consumption model after frequency reduction can accurately estimate the current protection window length, thereby dynamically adjusting the storage priority and compression intensity of various data types. For example, when calculating... When the time is less than 80 milliseconds, the system automatically increases the quota weight of urgent data while reducing the write attempt frequency of ordinary data, concentrating resources to ensure the integrity of the most critical information.

[0035] in, This indicates the logical position of the current header pointer in the circular log structure; The physical pointer value maintained by the dynamic decision layer; The total number of log entries is fixed at 1024. This formula defines the wraparound mechanism for the write address in the FRAM channel, ensuring that it automatically returns to the beginning position when the pointer reaches the end, forming an infinite loop of storage space. After each successful write, The value is incremented by 1, and the actual access address is obtained through this modulo operation. The system reads this value during power-on self-test. The system calculates the timestamp value and derives the last write position from it, then verifies data continuity by combining it with the timestamps of adjacent entries. If a timestamp is found to be in reverse order or has an excessively large jump, it is determined that a write interruption has occurred, and the log repair protocol is initiated to clear suspected corrupted data segments and rebuild the index.

[0036] This embodiment constructs a fully autonomous, low-latency, and highly reliable data protection closed-loop system through the close collaboration of the aforementioned units. The hardware perception layer achieves sub-millisecond voltage surge recognition capability, completely eliminating the response lag defects of traditional solutions that rely on operating system polling; the dynamic judgment layer performs intelligent data classification and resource scheduling based on real-time context, maximizing the probability of preserving critical data within a limited time; the multi-channel collaborative storage layer, through the division of labor and cooperation of heterogeneous media, takes into account speed, durability, and capacity requirements, forming a multi-layered data storage system; the power management unit integrates supercapacitor backup energy and active power consumption control, constructing an energy optimization closed loop and significantly extending the effective protection time. The entire system can independently handle most instantaneous power outage events without external uninterruptible power supply support, ensuring that the industrial control tablet can maintain data integrity and system state consistency even in harsh environments such as power fluctuations, equipment failures, or human error, fundamentally solving the pain points of frequent process parameter errors, production batch traceability failures, and control logic disorder in industrial sites. The system does not require modification of upper-layer applications and provides a unified data security interface for various industrial control software in a transparent manner. It is compatible with mainstream Linux, Windows IoT and real-time operating system environments and is suitable for a variety of high-reliability application scenarios such as power monitoring, rail transit signal control and intelligent manufacturing production line scheduling.

[0037] Existing technologies generally employ operating system-level logging mechanisms or external UPS as data protection methods. The former relies on periodic disk flushing of the file system or transaction log commits, with response latency typically ranging from hundreds of milliseconds to several seconds, making it impossible to persist critical data within the brief window after power failure. While the latter can provide power support for a longer period, it increases system size, cost, and complexity, and still has millisecond-level power outage gaps during AC-DC switching, causing data acquisition link interruptions. Furthermore, traditional solutions lack differentiated processing mechanisms based on data importance, often adopting extreme strategies of "full saving" or "complete abandonment," wasting write resources and sacrificing critical information. In contrast, this invention achieves true millisecond-level response and refined data governance through hardware-level interrupt triggering, embedded real-time decision-making, and multi-channel heterogeneous storage collaboration. The system operates autonomously throughout the entire process from power anomaly detection to data disk persistence, without relying on any software scheduling, with a response time compressed to less than 200 microseconds to start and complete the saving of all core data within 120 milliseconds. The three-channel storage architecture matches optimal media characteristics to different data types, ensuring extreme write speeds for urgent data while balancing the long-term reliability of critical data and the large-capacity temporary storage needs of ordinary data. The power management unit's intelligent frequency reduction and supercapacitor energy closed-loop control maximize the efficiency of limited energy storage, enabling it to independently handle most instantaneous power outages without an external UPS. The context-aware classification, lightweight compression, and redundant backup mechanisms introduced by the dynamic decision layer further enhance the integrity and robustness of data protection. The overall solution forms a fully autonomous closed loop from anomaly detection, decision generation, task scheduling to physical disk writes, demonstrating high engineering practicality and wide applicability.

[0038] The physical layout of the system on the industrial control tablet motherboard follows the principles of signal integrity and power isolation. The hardware sensing layer is placed close to the power input interface, shortening the high-voltage sampling trace length and reducing the risk of introduced noise. The dynamic decision layer microcontroller is located in the central area of ​​the PCB, connecting various functional modules through a star topology wiring to reduce signal reflection and delay deviation. The NOR Flash array and FRAM chip of the multi-channel collaborative storage layer are placed close to the microcontroller, using equal-length trace technology to ensure timing alignment; the SSD is connected by flexible cables for easy modular replacement. The supercapacitor bank is installed at the edge away from heat-generating components and equipped with a metal shield to prevent electromagnetic radiation interference to sensitive circuits. All critical signal lines adopt a stripline structure, embedded in the inner layer of the PCB, with the upper and lower ground planes providing good shielding. The power plane is clearly divided, with analog, digital, and storage power supplies independent, and single-point connection is achieved through ferrite bead filtering to suppress cross-domain noise coupling.

[0039] The system supports multiple operating modes, determined by factory preset configurations. In default mode, all three channels of storage and compression are enabled, providing the highest level of protection. Energy-saving mode disables SSD channels and data compression, retaining only protection for urgent and critical data, suitable for lightweight applications with low capacity requirements. High-speed mode prioritizes the write performance of the first channel and disables background erase tasks in the dual-buffering mechanism, suitable for scenarios with extremely high-frequency power outage detection. All mode switching is achieved through configuration words burned into the microcontroller's Flash memory, which can be fixed at the factory or dynamically updated via a dedicated debugging interface. Configuration parameters also include adjustable items such as voltage threshold, rate of change sensitivity, compression ratio upper and lower limits, and channel timeout time, allowing users to fine-tune the settings according to specific operating conditions.

[0040] The system possesses comprehensive self-diagnostic and maintenance functions. After each power outage protection event, the dynamic judgment layer generates a concise event report, recording the trigger time, the amount of data written to each channel, compression statistics, error status, and remaining energy storage estimate, and stores it in a dedicated diagnostic sector of the FRAM. This report can be exported via a standard UART interface for maintenance personnel to analyze the cause of the fault. A periodic self-test program runs automatically during the idle period in the early morning each day, sequentially testing the read and write functions of each storage channel, verifying the health of the supercapacitors, and verifying the connectivity of the interrupt signal path, summarizing the results into a health score. If any module is found to be abnormal, an early warning is immediately reported via LED indicator or network interface. Firmware upgrades support implementation via a secure bootloader. The new version image, after digital signature verification, is written to the microcontroller's spare sector, activated and switched upon the next reboot, ensuring that the upgrade process does not damage existing protection functions.

[0041] The technical solution disclosed in this embodiment has been verified and tested in multiple industrial sites. In a rail transit signal control system, the equipment is deployed in a train traction substation and faces instantaneous power outages caused by frequent power grid switching operations. Actual test data shows that the system initiates the protection process within an average of 180 microseconds after a power outage. Emergency data (PLC instruction queue and sensor buffer) is written to disk within 80 milliseconds, important data is written to FRAM within 110 milliseconds, and ordinary data is temporarily stored (approximately 2.3MB) to SSD before the 120-millisecond protection window ends. During six months of continuous operation, 47 abnormal power outage events were recorded. In all cases, the system successfully recovered to its pre-power outage state without any control logic errors or data loss incidents. Compared to the previous solution using a UPS + log mechanism, the overall equipment size is reduced by 35%, and the average annual maintenance cost is reduced by 52%, fully verifying the effectiveness and superiority of this invention in a real industrial environment.

Claims

1. A millisecond-level power-loss data protection system for industrial control tablets, characterized in that, include: The hardware sensing layer is used to monitor the voltage status of the power supply bus of the industrial control tablet in real time, and generate a hardware-level interrupt signal when the voltage drop rate exceeds a preset threshold. The dynamic determination layer is used to receive the hardware-level interrupt signal, classify the importance of the data to be saved based on the current system context information, and generate a data write-to-disk task sequence with priority tags. A multi-channel collaborative storage layer is used to receive the data write-to-disk task sequence and write data of different priorities in parallel to a non-volatile storage medium with matching characteristics through multiple physically isolated storage channels. The power management unit is used to switch to backup power to supply power to the dynamic judgment layer and the multi-channel collaborative storage layer after receiving a power failure signal, and to send instructions to the main processor to reduce system power consumption and extend the effective protection time window. The hardware perception layer, dynamic judgment layer, multi-channel collaborative storage layer, and power management unit together constitute a closed-loop protection architecture that operates independently of the operating system.

2. The millisecond-level power-loss data protection system for industrial control tablets according to claim 1, characterized in that, The hardware sensing layer includes a voltage monitoring circuit and a rate of change detection logic circuit. The voltage monitoring circuit is used to sample the instantaneous voltage amplitude of the power supply bus. The rate of change detection logic circuit is used to calculate the ratio of the voltage difference between consecutive sampling points to the time interval, and triggers the hardware-level interrupt signal when the ratio of the voltage difference to the time interval exceeds the preset threshold.

3. The millisecond-level power-loss data protection system for industrial control tablets according to claim 2, characterized in that, The dynamic decision layer is deployed on the embedded real-time microcontroller. After receiving the hardware-level interrupt signal, it scans and obtains the list of currently running processes, the address mapping table of unsynchronized data blocks in memory, and the dirty page status information of the file system. Based on the preset data importance classification strategy, it divides the data to be saved into three categories: urgent, important, and ordinary.

4. The millisecond-level power-loss data protection system for industrial control tablets according to claim 3, characterized in that, The multi-channel collaborative storage layer includes a first storage channel, a second storage channel, and a third storage channel; the first storage channel is connected to a low-latency non-volatile memory and is dedicated to storing the urgent data; The second storage channel is connected to a high-endurance non-volatile memory for storing the important data; the third storage channel is connected to a large-capacity solid-state memory for temporarily storing the ordinary data.

5. The millisecond-level power-loss data protection system for industrial control tablets according to claim 4, characterized in that, The write operation of the first storage channel is configured as a small data packet direct write mode to avoid the erase operation of the storage medium; The second storage channel is configured as a ring log structure, and its write pointer is uniformly maintained by the dynamic decision layer and automatically rolls back when the storage boundary is reached; the third storage channel adopts a batch commit strategy to improve write efficiency.

6. The millisecond-level power-loss data protection system for industrial control tablets according to claim 5, characterized in that, The dynamic decision layer also includes a data compression preprocessing module, which performs a lightweight compression algorithm on the urgent and important data before generating the data disk dumping task sequence, and uses incremental encoding to record state differences for data with strong time-series constraints.

7. The millisecond-level power-loss data protection system for industrial control tablets according to claim 6, characterized in that, It also includes a unified data encapsulation format, where each data unit contains header information and payload data. The header information includes at least a timestamp field, a data type identifier, the original length, the compressed length, and a checksum. The header information and payload data jointly participate in the integrity verification operation.

8. The millisecond-level power-loss data protection system for industrial control tablets according to claim 7, characterized in that, Each storage channel of the multi-channel collaborative storage layer is equipped with an independent status register, which is used to feed back the write completion flag and error counter to the dynamic determination layer. The dynamic determination layer is configured to poll the status register within a specified timeout period, and activate the redundancy backup mechanism when no acknowledgment is received, redirecting the unacknowledged data to other available channels.

9. The millisecond-level power-loss data protection system for industrial control tablets according to claim 8, characterized in that, The power management unit includes a main power supply path and an auxiliary power supply path. The auxiliary power supply path includes a solid-state supercapacitor bank, the positive terminal of which is connected in parallel with the main power supply through an ideal diode. The power management unit also has a built-in energy storage status detection circuit, which is used to periodically evaluate the effective discharge capacity of the solid-state supercapacitor bank and trigger an early warning signal when the energy storage capacity is detected to be lower than a preset limit.

10. The millisecond-level power-loss data protection system for industrial control tablets according to claim 9, characterized in that, The hardware perception layer and the dynamic decision layer are connected by a physically isolated dedicated signal bus. The dedicated signal bus uses differential signal transmission to enhance anti-interference capability and supports bidirectional communication between interrupt trigger pulses and acknowledgment signals.

Images