Functional task fault tolerance method of high-safety airborne system

Abstract

The invention belongs to a system redundancy management and fault-tolerant technology, and particularly relates to a functional task fault-tolerant method of a high-safety airborne system, which is particularly suitable for the high-safety airborne system. Comprising the following steps: step 1, identifying and calculating node level marks according to channel marks; 2, identifying the priority of the function task according to the safety criticality of the function task; 3, deploying different levels of function tasks on the computing nodes according to the level marks of the computing nodes, the redundancy requirements of the function tasks and the priorities of the function tasks; wherein the redundancy requirement of the function task comprises the operation redundancy number and the working mode of the function task; and 4, according to the state flag of the computing node and the deployment condition of the current functional task, executing functional fault-tolerant logic, and realizing fault-tolerant switching of the functional task in the computing node in the system.

Description

Technical Field

[0001] This invention pertains to system redundancy management and fault tolerance technology, specifically relating to a functional task fault tolerance method for a high-safety airborne system, which is particularly suitable for high-safety airborne systems. Background Technology

[0002] Aircraft avionics systems are constantly evolving towards automation, integration, and intelligence. The scope of these systems is gradually expanding, and their functions and tasks are also gradually developing from single-function tasks to a combination of various safety-critical level functions and tasks. Therefore, more stringent requirements are being placed on the reliability, safety, and fault tolerance of these systems.

[0003] With the rapid development of electronic and computer technologies, a computing node now has the capability to deploy multiple functional tasks, making functional fault tolerance possible. However, traditional system fault tolerance mainly focuses on the monitoring and management of redundant signals and redundant equipment, lacking fault tolerance management design at the system functional task level. Therefore, researching and developing a functional task fault tolerance method for a high-security airborne system to achieve fault tolerance management for multiple functional tasks is one of the key means to address the current trend of integrated and lightweight development of airborne systems. Summary of the Invention

[0004] Purpose of the invention:

[0005] This paper proposes a functional task fault-tolerant method for high-safety airborne systems. This method can implement multiple system functions with different safety levels in a single redundant computing node without increasing computing resources. When a failure occurs at the system functional task level, it can extend the uptime of critical functional tasks as much as possible, ensuring system reliability and safety, and supporting the integrated and lightweight implementation of high-safety airborne systems.

[0006] Technical solution:

[0007] A functional task fault-tolerant method for a high-safety airborne system includes:

[0008] Step 1: Calculate node-level flags based on channel flag identification;

[0009] Step 2: Identify the priority of functional tasks based on their safety criticality;

[0010] Step 3: Deploy functional tasks of different levels on the computing nodes according to the computing node level flag, the redundancy requirements of functional tasks, and the priority of functional tasks; among which, the redundancy requirements of functional tasks include: the number of running redundancies and the working mode of functional tasks.

[0011] Step 4: Based on the computing node status flags and the current deployment status of functional tasks, execute the functional fault tolerance logic to achieve fault-tolerant switching of functional tasks among computing nodes within the system.

[0012] Further, step 1 includes:

[0013] Step 11: Collect the channel markers of the redundancy calculation node;

[0014] Step 12: The specific method for identifying and computing node-level flags based on channel flags is as follows:

[0015] 1) If the channel flag is “00”, then the current compute node level flag is 0, which is the highest level compute node;

[0016] 2) If the channel flag is “01”, then the current computing node level flag is 1, which is the second highest level computing node;

[0017] 3) If the channel flag is "10", then the current computing node level flag is 2, which is the second lowest level computing node;

[0018] 4) If the channel flag is "11", then the current computing node level flag is 3, which is the lowest level computing node;

[0019] 5) The number of computing nodes in an airborne system is usually no more than 4. If it is less than 4, the computing node level flag shall be identified according to the above rules based on the specific number.

[0020] Further, step 2 specifically involves:

[0021] 1) If a functional task is a safety-critical functional task, then the functional task is a high-priority functional task.

[0022] 2) If a functional task is not a safety-critical functional task, then the functional task is a low-priority functional task.

[0023] Furthermore, step 3 includes:

[0024] Step 31: To achieve orderly switching of functional tasks, define different running states of the software implementing the functional tasks: deployment, activation, and invocation.

[0025] Step 32: Based on the redundancy working mode, define the identity identifiers of the compute nodes to represent the different operating states of compute nodes executing the same functional task in the "call" state, namely primary and backup:

[0026] Step 33: Based on the computing node level flag, the number of runtime redundancies and working modes of the functional tasks, determine the specific running status of the software implementing the functional tasks on each computing node, namely, deployment, activation, or invocation.

[0027] Furthermore, in step 31,

[0028] 1) "Deployment" means that the software that performs the functional task is stored within the compute node, but not loaded;

[0029] 2) "Enabled" means that the software that performs the functional task is loaded within the compute node, but not running;

[0030] 3) "Invoke" means that the software that performs the functional task runs within the computing node and outputs control commands.

[0031] Furthermore, in step 32,

[0032] 1) The control commands output by the functional tasks of the computing node that works as the "master" are received and used by other nodes in the system;

[0033] 2) A computing node that works as a "standby" node has its control commands output by its functional tasks received by other nodes in the system but not used.

[0034] Further, step 33 specifically includes:

[0035] 1) Configuration of high-priority functional tasks:

[0036] a) Based on the runtime redundancy requirements of high-priority functional tasks, start from the highest-level computing node among all computing nodes and select downwards level by level until the number of computing nodes meets the redundancy requirements of the highest-priority functional tasks.

[0037] b) Among the selected compute nodes, if they work in the "active parallel operation" mode, all compute nodes work as the "master" and execute high-priority functional task software in the "call" state, and configure low-priority functional task software in the "deploy" state.

[0038] c) Among the selected compute nodes, if working in "standby conversion run" mode, then work as "primary" on the higher-priority compute node, execute high-priority functional task software in "call" state, and configure low-priority functional task software in "deploy" state; or work as "standby" on the lower-priority compute node, execute high-priority functional task software in "call" state, and configure low-priority functional task software in "deploy" state.

[0039] 2) Configuration of low-priority functional tasks:

[0040] a) Based on the runtime slack of the low-priority functional tasks, start from the highest-level computing node among the remaining computing nodes and select downwards level by level until the number of computing nodes meets the slack of the second-highest priority functional tasks.

[0041] b) Among the selected compute nodes, if they are working in the "active parallel operation" mode, all compute nodes work as the "master" and execute low-priority functional task software in the "call" state, and configure high-priority functional task software in the "enabled" state.

[0042] c) Among the selected compute nodes, if the "standby switch-run" mode is used, the compute node with the highest priority is selected to work as the "primary" node, and the low-priority functional task software is executed in the "call" state, while the high-priority functional task software is configured in the "enabled" state; the compute node with the lowest priority is selected to work as the "standby" node, and the low-priority functional task software is executed in the "call" state, while the high-priority functional task software is configured in the "enabled" state.

[0043] 3) Continue in this manner until all functional tasks are configured;

[0044] Furthermore, in step 33,

[0045] The operating modes of "active parallel operation" and "standby conversion operation", as well as the number of "primary" and "standby" units, are determined according to the specific system requirements.

[0046] If operating on a single channel, the compute node will function as the "master" node.

[0047] Furthermore, step 4 includes:

[0048] Step 41: Collect the status flags of each computing node and determine their validity. The specific method is as follows:

[0049] Step 42: Based on the status of each computing node in the system and the execution status of the functional tasks on each computing node, perform fault-tolerant switching of functional tasks. The specific method is as follows:

[0050] 1) If all computing node status flags in the system are "1" and valid, then the system will operate according to the functional task configuration described in step 33.

[0051] 2) If a computing node in the system has a status flag of "0", it will be cut off. Other computing nodes will perform task fault tolerance according to the following strategy:

[0052] a) Level indicator and primary / backup identity switching

[0053] If the failed compute node is a compute node that is working as the "primary" node in the "standby conversion operation" mode, then the level and identity flags of the corresponding compute node that is working as the "standby" node will be switched to the level and identity flags of the failed node. Then, the level and identity flags of the lowest level node among the valid compute nodes in the system will be switched to the level and identity flags of the compute node that replaced the failed compute node, and so on.

[0054] If the failed computing node is a computing node operating in "active parallel operation" mode or a computing node operating in "standby" mode as a "standby" node, then the lowest-level node among the valid computing nodes in the system will perform the switch, that is, switch the level and identity flags of the lowest-level computing node to the level and identity flags of the disconnected computing node. If there is no computing node in the system with a lower level than the failed node at this time, then no switch operation will be performed.

[0055] b) Accordingly, based on the switched computing node level flag and identity flag, and according to the content described in step 33, the functional task status on the computing node is reconfigured to achieve functional task fault tolerance in case of failure and to prioritize the execution of critical functional tasks.

[0056] c) The fault-tolerant function is executed until only one valid computing node exists in the system.

[0057] Further, step 41 specifically includes:

[0058] 1) If the status flag of a compute node is "1", then the compute node is in a valid state, indicating that the functional tasks deployed on it are valid. At this time, the node works normally and performs the corresponding functional task switching operation when other compute nodes fail.

[0059] 2) If the status flag of a compute node is “0”, the compute node is invalid, indicating that the functional tasks deployed on it have failed. At this time, the compute node is disconnected, the compute node stops working and its level flag and identity flag are cleared.

[0060] Beneficial effects:

[0061] 1. High availability and reliability: Through functional task fault tolerance, the system can maintain the operation of critical functional tasks even when failures occur;

[0062] 2. High resource utilization: Through functional task fault tolerance, it supports the sharing and reuse of computing and communication resources among multiple functional tasks, reducing hardware redundancy;

[0063] 3. Strong dynamic adaptability: The system can configure and adjust the deployment of functional tasks according to redundancy requirements to meet the fault tolerance requirements of system functions. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 This is a flowchart illustrating a functional task fault-tolerant method for a high-safety airborne system, provided as an embodiment of the present invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] The features and illustrative embodiments of various aspects of the present invention will now be described in detail. Numerous specific details are set forth in the following detailed description to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention. The invention is by no means limited to any specific setups and methods set forth below, but covers any improvements, substitutions, and modifications to structures, methods, and devices without departing from the spirit of the invention. Well-known structures and techniques are not shown in the drawings and the following description to avoid unnecessarily obscuring the invention.

[0068] It should be noted that, unless otherwise specified, the embodiments of the present invention and the features thereof can be combined with each other, and the various embodiments can be referenced and cited in each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0069] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0070] This invention proposes a functional task fault-tolerant method for a high-security airborne system, which enables dynamic judgment and switching of system functional tasks, meeting the high security requirements of airborne systems. For example... Figure 1 The method includes:

[0071] Step 1: Calculate node-level flags based on channel flag identification;

[0072] Step 2: Identify the priority of functional tasks based on their safety criticality;

[0073] Step 3: Deploy functional tasks of different levels on the computing nodes according to the computing node level flag, the redundancy requirements of functional tasks, and the priority of functional tasks; among which, the redundancy requirements of functional tasks include: the number of running redundancies and the working mode of functional tasks.

[0074] Step 4: Based on the computing node status flags and the current deployment status of functional tasks, execute the functional fault tolerance logic to achieve fault-tolerant switching of functional tasks among computing nodes within the system.

[0075] Furthermore, step 1 includes:

[0076] Step 11: Collect the channel markers of the redundancy calculation node;

[0077] Step 12: The specific method for identifying and computing node-level flags based on channel flags is as follows:

[0078] 1) If the channel flag is “00”, then the current compute node level flag is 0, which is the highest level compute node;

[0079] 2) If the channel flag is “01”, then the current computing node level flag is 1, which is the second highest level computing node;

[0080] 3) If the channel flag is "10", then the current computing node level flag is 2, which is the second lowest level computing node;

[0081] 4) If the channel flag is “11”, then the current computing node level flag is 3, which is the lowest level computing node.

[0082] 5) The number of computing nodes in an airborne system is usually no more than 4. If it is less than 4, the computing node level flag can be identified according to the above rules based on the specific number.

[0083] Furthermore, step 2 specifically involves:

[0084] 1) If a functional task is a safety-critical functional task, then the functional task is a high-priority functional task.

[0085] 2) If a functional task is not a safety-critical functional task, then the functional task is a low-priority functional task.

[0086] Furthermore, step 3 includes

[0087] Step 31: To achieve orderly switching of functional tasks, define different running states of the software implementing the functional tasks: deployment, activation, and invocation.

[0088] 1) "Deployment" means that the software that performs the functional task is stored within the compute node, but not loaded;

[0089] 2) "Enabled" means that the software that performs the functional task is loaded within the compute node, but not running;

[0090] 3) "Invoke" means that the software that performs the functional task runs within the computing node and outputs control commands.

[0091] Step 32: Based on the redundancy working mode, define the identity identifiers of the compute nodes to represent the different operating states of compute nodes executing the same functional task in the "call" state, namely primary and backup:

[0092] 1) The control commands output by the functional tasks of the computing node that works as the "master" are received and used by other nodes in the system;

[0093] 2) A computing node that works as a "standby" node has its control commands output by its functional tasks received by other nodes in the system but not used.

[0094] Step 33: Based on the requirements of the computing node level flags, the number of runtime redundancies for functional tasks, and their working modes, determine the running status of functional tasks on each computing node. The specific method is as follows:

[0095] 1) Configuration of high-priority functional tasks:

[0096] a) Based on the runtime redundancy requirements of high-priority functional tasks, start from the highest-level computing node among all computing nodes and select downwards level by level until the number of computing nodes meets the redundancy requirements of the highest-priority functional tasks.

[0097] b) Among the selected compute nodes, if they work in the "active parallel operation" mode, all compute nodes work as the "master" and execute high-priority functional task software in the "call" state, and configure low-priority functional task software in the "deploy" state.

[0098] c) Among the selected compute nodes, if working in "standby conversion run" mode, then work as "primary" on the higher-priority compute node, execute high-priority functional task software in "call" state, and configure low-priority functional task software in "deploy" state; or work as "standby" on the lower-priority compute node, execute high-priority functional task software in "call" state, and configure low-priority functional task software in "deploy" state.

[0099] 2) Configuration of low-priority functional tasks:

[0100] a) Based on the runtime slack of the low-priority functional tasks, start from the highest-level computing node among the remaining computing nodes and select downwards level by level until the number of computing nodes meets the slack of the second-highest priority functional tasks.

[0101] b) Among the selected compute nodes, if they are working in the "active parallel operation" mode, all compute nodes work as the "master" and execute low-priority functional task software in the "call" state, and configure high-priority functional task software in the "enabled" state.

[0102] c) Among the selected compute nodes, if the "standby switch-run" mode is used, the compute node with the highest priority is selected to work as the "primary" node, and the low-priority functional task software is executed in the "call" state, while the high-priority functional task software is configured in the "enabled" state; the compute node with the lowest priority is selected to work as the "standby" node, and the low-priority functional task software is executed in the "call" state, while the high-priority functional task software is configured in the "enabled" state.

[0103] 3) Continue in this manner until all functional tasks are configured;

[0104] 4) The operating modes of "active parallel operation" and "standby conversion operation", as well as the number of "primary" and "standby" units, are determined according to the specific system requirements;

[0105] 5) If it is running on a single channel, the compute node will work as the "master".

[0106] Furthermore, step 4 includes:

[0107] Step 41: Collect the status flags of each computing node and determine their validity. The specific method is as follows:

[0108] 1) If the status flag of a compute node is "1", then the compute node is in a valid state, indicating that the functional tasks deployed on it are valid. At this time, the node works normally and performs the corresponding functional task switching operation when other compute nodes fail.

[0109] 2) If the status flag of a compute node is “0”, the compute node is invalid, indicating that the functional tasks deployed on it have failed. At this time, the compute node is disconnected, the compute node stops working and its level flag and identity flag are cleared.

[0110] Step 42: Based on the status of each computing node in the system and the execution status of the functional tasks on each computing node, perform fault-tolerant switching of functional tasks. The specific method is as follows:

[0111] 1) If the status flags of all computing nodes in the system are "1", then the system will operate according to the functional task configuration described in step 33.

[0112] 2) If there is a compute node in the system with a compute node status flag of "0", then other compute nodes will perform task fault tolerance according to the following strategy:

[0113] a) Level indicator and primary / backup identity switching

[0114] If the failed computing node is a computing node that is working as the "primary" node in the "standby conversion operation" mode, then the level and identity flags of the corresponding computing node that is working as the "standby" node will be switched to the level and identity flags of the failed node. Then, the level and identity flags of the lowest level node among the valid computing nodes in the system will be switched to the level and identity flags of the computing node that replaced the failed computing node, and so on.

[0115] If the failed computing node is a computing node operating in "active parallel operation" mode or a computing node operating in "standby" mode as a "standby" node, then the lowest-level node among the valid computing nodes in the system will perform the switch, that is, switch the level and identity flags of the lowest-level computing node to the level and identity flags of the disconnected computing node. If there is no computing node in the system with a lower level than the failed node at this time, then no switch operation will be performed.

[0116] b) Accordingly, based on the switched computing node level flag and identity flag, and according to the content described in step 33, the functional task status on the computing node is reconfigured to achieve functional task fault tolerance in case of failure and to prioritize the execution of critical functional tasks.

[0117] c) The fault-tolerant function is executed until only one valid computing node exists in the system.

[0118] Example 1

[0119] Taking a certain type of flight control system as an example, the system contains four computing nodes: A, B, C, and D. It integrates safety-critical basic flight control functions and non-safety-critical flight management functions. The basic flight control functions operate in a dual-redundancy primary / backup mode, as do the flight management functions. During system operation, if the status flag of computing node A changes from "1" to "0", the system's functional fault tolerance is as follows:

[0120] 1. If the channel flag of compute node A is “00”, then the level flag of compute node A is “0”; if the channel flag of compute node B is “01”, then the level flag of compute node B is “1”; if the channel flag of compute node C is “10”, then the level flag of compute node C is “2”; if the channel flag of compute node D is “11”, then the level flag of compute node D is “3”.

[0121] 2. If the basic flight control function is a critical function, then it is a high-priority function; if the flight management function is a non-critical function, then it is a low-priority function.

[0122] 3. High-priority basic flight control tasks operate with dual redundancy (primary and backup). Therefore, according to the level flags, compute node A, with a level flag of "0", operates as the "primary" node, executing the basic flight control task software in a "call" state and configuring the flight management task software in a "deploy" state. Compute node B, with a level flag of "1", operates as the "backup" node corresponding to compute node A, executing the basic flight control task software in a "call" state and configuring the flight management task software in a "deploy" state. Low-priority flight management tasks also operate with dual redundancy (primary and backup). Therefore, according to the level flags, compute node C, with a level flag of "2", operates as the "primary" node, executing the flight management task software in a "call" state and configuring the basic flight control task management software in an "enabled" state. Compute node D, with a level flag of "3", operates as the "backup" node corresponding to compute node C, executing the flight management task software in a "call" state and configuring the basic flight control task software in an "enabled" state.

[0123] 5. The status flag of compute node A changes from "1" to "0", the compute node is cut off, and its level flag is cleared.

[0124] 6. Since compute node A is running as the "primary" compute node in the "standby switch operation" mode, the level flag of compute node B, which is running as the "standby" compute node, is switched to "0". Compute node B then runs as the "primary" compute node. After that, the level flag of compute node D, which is the lowest level of the valid compute nodes in the system at this time, is switched from "3" to "1". Compute node D also runs as the "standby" compute node corresponding to compute node B. Compute node C does not need to be switched.

[0125] 7. Based on the level flags, reconfigure the functional task execution status on the computing nodes. That is, computing node B with level flag "0" works as the "master" and executes the basic flight control function task software in the "call" state, and configures the flight management function task software in the "deploy" state. On computing node D with level flag "1", it works as the "standby" corresponding to computing node B, executes the basic flight control function task software in the "call" state, and configures the flight management function task software in the "deploy" state. Computing node C with level flag "2" does not perform a switch, still works as the "master", executes the flight management function task software in the "call" state, and configures the basic flight control function task management software in the "enabled" state.

[0126] Example 2

[0127] Taking a certain type of flight control system as an example, the system includes three computing nodes: A, B, and C. It integrates safety-critical basic flight control functions and non-safety-critical flight management functions. The basic flight control functions operate in a dual-redundancy master-master mode, while the flight management functions operate in a single-channel mode. During system operation, if the status flag of computing node A changes from "1" to "0", the system's functional fault tolerance is as follows:

[0128] 1. If the channel flag of compute node A is “00”, then the level flag of compute node A is “0”; if the channel flag of compute node B is “01”, then the level flag of compute node B is “1”; if the channel flag of compute node C is “10”, then the level flag of compute node C is “2”.

[0129] 2. If the basic flight control function is a critical function, then it is a high-priority function; if the flight management function is a non-critical function, then it is a low-priority function.

[0130] 3. High-priority basic flight control functions operate with dual redundancy. Therefore, according to the level flag, compute node A, with a level flag of "0", operates as the "master", executing the basic flight control function software in "call" state and configuring the flight management function software in "deployment" state. Compute node B, with a level flag of "1", operates as the "master" corresponding to compute node A, executing the basic flight control function software in "call" state and configuring the flight management function software in "deployment" state. Low-priority flight management functions operate on a single channel. Therefore, according to the level flag, compute node C, with a level flag of "2", operates as the "master", executing the flight management function software in "call" state and configuring the basic flight control function management software in "enabled" state.

[0131] 5. The status flag of compute node A changes from "1" to "0", the compute node is cut off, and its level flag is cleared.

[0132] 6. Since compute node A is running as the "master" in the "active parallel operation" mode, the level flag of compute node C, the lowest level among the current valid nodes, is switched from "2" to "0", and it runs as the "master" corresponding to compute node B.

[0133] 7. Based on the level flag, reconfigure the execution status of the functional tasks on the computing nodes. Specifically, on computing node C with level flag "0", execute the basic flight control function task software in the "call" state and configure the flight management function task software in the "deploy" state. On computing node B with level flag "1", execute the basic flight control function task software in the "call" state and configure the flight management function task software in the "deploy" state.

[0134] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A functional task fault-tolerant method for a high-safety airborne system, characterized in that, include: Step 1: Calculate node-level flags based on channel flag identification; Step 2: Identify the priority of functional tasks based on their safety criticality; Step 3: Deploy functional tasks of different levels on the computing nodes according to the computing node level flag, the redundancy requirements of functional tasks, and the priority of functional tasks; among which, the redundancy requirements of functional tasks include: the number of running redundancies and the working mode of functional tasks. Step 4: Based on the computing node status flags and the current deployment status of functional tasks, execute the functional fault tolerance logic to achieve fault-tolerant switching of functional tasks among computing nodes within the system.

2. The method according to claim 1, characterized in that, Step 1 includes: Step 11: Collect the channel markers of the redundancy calculation node; Step 12: When the number of computing nodes in the airborne system does not exceed 4, the specific method for identifying the computing node level flag based on the channel flag is as follows: 1) If the channel flag is "00", then the current compute node level flag is 0, which is the highest level compute node; 2) If the channel flag is "01", then the current computing node level flag is 1, which is the second highest level computing node; 3) If the channel flag is "10", then the current computing node level flag is 2, which is the second lowest level computing node; 4) If the channel flag is "11", then the current computing node level flag is 3, which is the lowest level computing node.

3. The method according to claim 2, characterized in that, Step 2, specifically: 1) If a functional task is a safety-critical functional task, then the functional task is a high-priority functional task. 2) If a functional task is not a safety-critical functional task, then the functional task is a low-priority functional task.

4. The method according to claim 3, characterized in that, Step 3 includes: Step 31: To achieve orderly switching of functional tasks, define different running states of the software implementing the functional tasks: deployment, activation, and invocation. Step 32: Based on the redundancy working mode, define the identity identifier of the computing nodes to represent the different operating states of computing nodes executing the same functional task in the "call" state, namely primary and backup: Step 33: Based on the computing node level flag, the number of runtime redundancies and working modes of the functional tasks, determine the specific running status of the software implementing the functional tasks on each computing node, namely, deployment, activation, or invocation.

5. The method according to claim 4, characterized in that, In step 31, 1) "Deployment" means that the software that performs the functional task is stored within the compute node, but not loaded; 2) "Enabled" means that the software that performs the functional task is loaded within the compute node, but not running; 3) "Invoke" means that the software that performs the functional task runs within the computing node and outputs control commands.

6. The method according to claim 5, characterized in that, In step 32, 1) The control commands output by the functional tasks of the computing node that works as the "master" are received and used by other nodes in the system; 2) A computing node that works as a "standby" node receives control commands output by its functional tasks but does not use them.

7. The method according to claim 6, characterized in that, Step 33, specifically: 1) Configuration of high-priority functional tasks: a) Based on the runtime redundancy requirements of high-priority functional tasks, start from the highest-level computing node among all computing nodes and select downwards level by level until the number of computing nodes meets the redundancy requirements of the highest-priority functional tasks. b) Among the selected compute nodes, if they work in the "active parallel operation" mode, all compute nodes work as the "master" and execute high-priority functional task software in the "call" state and configure low-priority functional task software in the "deploy" state. c) Among the selected compute nodes, if working in "standby conversion run" mode, the compute node with the highest priority is selected to work as the "primary" node, and the high-priority functional task software is executed in "call" state, while the low-priority functional task software is configured in "deployment" state; the compute node with the lowest priority is selected to work as the "standby" node, and the high-priority functional task software is executed in "call" state, while the low-priority functional task software is configured in "deployment" state. 2) Low-priority function task configuration: a) Based on the runtime slack of the low-priority functional tasks, start from the highest-level computing node among the remaining computing nodes and select downwards level by level until the number of computing nodes meets the slack of the second-highest priority functional tasks. b) Among the selected compute nodes, if they are working in the "active parallel operation" mode, all compute nodes work as the "master" and execute low-priority functional task software in the "call" state, and configure high-priority functional task software in the "enabled" state. c) Among the selected compute nodes, if the "standby conversion run" mode is used, the compute node with the highest priority is selected to work as the "primary" node, and the low-priority functional task software is executed in the "call" state, while the high-priority functional task software is configured in the "enabled" state; the compute node with the lowest priority is selected to work as the "standby" node, and the low-priority functional task software is executed in the "call" state, while the high-priority functional task software is configured in the "enabled" state. 3) Continue in this manner until all functional tasks are configured.

8. The method according to claim 7, characterized in that, In step 33, The operating modes of "active parallel operation" and "standby switching operation", as well as the number of "primary" and "standby" systems, are determined according to the specific system requirements. If it operates on a single channel, the compute node will work as the "master".

9. The method according to claim 8, characterized in that, Step 4 includes: Step 41: Collect the status flags of each computing node and determine their validity. The specific method is as follows: Step 42: Based on the status of each computing node in the system and the execution status of the functional tasks on each computing node, perform fault-tolerant switching of functional tasks. The specific method is as follows: 1) If all computing node status flags in the system are "1" and valid, then the system will operate according to the functional task configuration described in step 33. 2) If a compute node in the system has a status flag of "0", it will be cut off. Other compute nodes will perform task fault tolerance according to the following strategy: a) Level indicator and primary / backup identity switching If the failed compute node is a compute node that is working as the "primary" node in the "standby conversion operation" mode, then the level and identity flags of the corresponding compute node that is working as the "standby" node will be switched to the level and identity flags of the failed node. Then, the level and identity flags of the lowest level node among the valid compute nodes in the system will be switched to the level and identity flags of the compute node that replaced the failed compute node, and so on. If the failed compute node is a compute node operating in "active parallel operation" mode or a compute node operating in "standby" mode as a "standby" node, then the lowest-level node among the valid compute nodes in the system will perform the switch, that is, switch the level and identity flags of the lowest-level compute node to the level and identity flags of the compute node that was cut off. If there is no compute node in the system with a lower level than the failed node at this time, then no switch operation will be performed. b) Accordingly, based on the switched computing node level flag and identity flag, the functional task status on the computing node is reconfigured according to step 33, so as to achieve functional task fault tolerance in the event of failure and prioritize the execution of critical functional tasks. c) The fault-tolerant function is executed until only one valid computing node exists in the system.

10. The method according to claim 9, characterized in that, Step 41, specifically: 1) If the status flag of a compute node is "1", the compute node is in a valid state, indicating that the functional tasks deployed on it are valid. At this time, the node works normally and performs the corresponding functional task switching operation when other compute nodes fail. 2) If the status flag of a compute node is "0", the compute node is invalid, indicating that the functional tasks deployed on it have failed. At this time, the compute node is disconnected, the compute node stops working and its level flag and identity flag are cleared.

Images