A synchronization and switching method and system for a parallel redundant control system

Abstract

A synchronization and switching method and system for a parallel redundant control system, relating to the field of control systems, is disclosed. The method includes: controlling a master controller and a slave controller to operate in parallel, each outputting a first preset proportion of the current load demand; synchronizing control commands from the master controller to the slave controller; within a preset control cycle, controlling the master controller and slave controller to toggle the level states of their respective synchronization signal pins at the trigger time of each preset control cycle; responding to a master-slave switching command, controlling the slave controller to take over the logic calculation task, obtaining the current output value of the master controller, adjusting the output value of the slave controller to align with the current output value, increasing the output proportion of the slave controller from a first preset proportion to a second preset proportion, and decreasing the output proportion of the master controller from a first preset proportion to zero. Implementing this method can make the master-slave controller switching smoother.

Description

Technical Field

[0001] This application relates to the field of control systems, and more particularly to a synchronization and switching method and system for a parallel redundant control system. Background Technology

[0002] In high-reliability industrial control applications, such as emergency power systems, dual-winding motor drives, and dual-power converters, the requirements for system continuity and reliability are extremely high. To avoid system failure due to single points of failure, redundant control architectures are typically adopted, which improve the system's fault tolerance and availability by configuring multiple controllers.

[0003] Existing redundant control systems primarily employ a master-slave hot backup scheme. This means the master controller executes all control tasks and outputs 100% of the control commands, while the slave controller remains in standby mode and does not participate in actual output. The master controller periodically sends system status and control parameters to the slave controller via a communication bus, and the slave controller maintains state synchronization. When a master controller failure is detected, a watchdog mechanism triggers a switchover, allowing the slave controller to take over the control tasks and increase the output from zero to 100%.

[0004] However, since the slave controller does not participate in actual control before switching, its output state differs from the real-time output of the master controller. The output jump is likely to occur at the moment of switching, which may cause torque surges or current surges in applications such as motor drives, affecting the smooth operation of the load. Summary of the Invention

[0005] This application provides a synchronization and switching method and system for a parallel redundant control system, which makes the switching between master and slave controllers smoother.

[0006] In a first aspect, this application provides a synchronization and switching method for a parallel redundant control system, applied to a synchronization and switching system. The method includes: controlling a master controller and a slave controller to work in parallel, wherein the master controller and the slave controller respectively output a first preset ratio of the current load demand; synchronizing the control command of the master controller to the slave controller; within a preset control cycle, controlling the master controller and the slave controller to toggle the level state of their respective synchronization signal pins at the trigger time of each preset control cycle; responding to a master-slave switching command, controlling the slave controller to take over the logic calculation task; obtaining the current output value of the master controller, adjusting the output value of the slave controller to be aligned with the current output value, controlling the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio, and controlling the output ratio of the master controller to decrease from the first preset ratio to zero.

[0007] During normal operation, the master and slave controllers work together in parallel to execute control tasks, each undertaking approximately 50% of the load output. This fully utilizes the computing and output capabilities of both controllers, avoiding the idle resources of the slave controller in traditional hot standby solutions. Through a high-frequency synchronous monitoring mechanism on hardware I / O pins, the system can detect the execution synchronization of the master and slave controllers in real time within a 0.1ms-level low-level control cycle, ensuring the time consistency of the dual controller outputs and eliminating circulating current and torque ripple. During fault switching, because the slave controller always maintains synchronization with the master controller and participates in actual output, its output state is already aligned with the real-time output of the master controller. The switching process is smoothly transitioned through crossfading, avoiding the output jump problem caused by switching from zero to full load in traditional solutions, achieving a smooth and uninterrupted switching of the system under high reliability requirements.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the step of synchronizing the control commands of the master controller to the slave controller specifically includes: during the application layer control cycle, sending the torque commands and system logic status of the master controller to the slave controller via a communication link; the slave controller receiving the torque commands and system logic status, and executing the same control logic as the master controller based on the torque commands and system logic status.

[0009] In the above embodiments, the control commands and system status of the master and slave controllers are synchronized at the application layer through a communication link. After receiving the torque command, the slave controller performs the same control logic calculation as the master controller, ensuring the consistency of the two controllers at the logic level. This two-layer synchronization mechanism, which combines application-layer synchronization with underlying hardware synchronization monitoring, ensures both the uniformity of control logic and the precise alignment of execution timing, achieving deep collaboration between the master and slave controllers when working in parallel.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, after the step of controlling the master controller and the slave controller to flip the level states of their respective synchronization signal pins at the trigger time of each preset control cycle, the method further includes: acquiring the level state of the synchronization signal pin of the master controller through the slave controller, comparing the acquired level state with the level state of the synchronization signal pin of the slave controller, counting the number of times the level states are consistent within a preset number of control cycles, calculating the synchronization rate based on the number of synchronizations; determining whether the synchronization rate is lower than a preset synchronization threshold; when the synchronization rate is lower than the preset synchronization threshold, triggering a synchronization recovery process, and restoring the time alignment between the slave controller and the master controller by adjusting the interrupt triggering timing of the slave controller.

[0011] In the above embodiment, the system continuously monitors the synchronization rate. When the synchronization rate is detected to be lower than a preset threshold, it actively triggers a synchronization recovery process. By dynamically adjusting the interrupt triggering timing of the slave controller, it re-aligns the time with the master controller. This synchronization self-recovery mechanism can proactively intervene when synchronization deteriorates but has not yet caused serious impact, striving to maintain a collaborative parallel working state. It avoids triggering master-slave switching due to slight synchronization deviations, thus improving the availability and stability of the system.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the step of acquiring the level state of the synchronization signal pin of the master controller from the slave controller, comparing the acquired level state with the level state of the synchronization signal pin of the slave controller, counting the number of times the level state is consistent within a preset number of control cycles, and calculating the synchronization rate based on the number of synchronizations specifically includes: monitoring the synchronization signal pins of the master controller and the slave controller within a lower-level control cycle, wherein the duration of the lower-level control cycle is shorter than the duration of the application-level control cycle; acquiring the level state of the synchronization signal pin of the master controller from the slave controller in each lower-level control cycle, comparing the acquired level state with the level state of the synchronization signal pin of the slave controller, and recording the number of times the level states are consistent and inconsistent; and calculating the synchronization rate based on the ratio of the number of times the level states are consistent within a preset number of control cycles to the total number of cycles.

[0013] In the above embodiments, by switching and comparing the levels of hardware I / O pins during high-speed low-level control cycles, the system can monitor the execution synchronization of the master and slave controllers at a frequency far exceeding that of the application-level control cycles. By calculating the synchronization rate by statistically analyzing the percentage of times the level states are consistent within a certain number of control cycles, the timing alignment of the master and slave controllers can be quantitatively evaluated. This high-frequency synchronization monitoring mechanism based on hardware signals, compared to relying solely on software-level communication confirmation, offers higher real-time performance and accuracy, enabling timely detection of synchronization degradation and providing a reliable basis for triggering synchronization recovery or fault switching.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, before the steps of obtaining the current output value of the master controller, adjusting the output value of the slave controller to align with the current output value, controlling the output ratio of the slave controller to increase from a first preset ratio to a second preset ratio, and controlling the output ratio of the master controller to decrease from the first preset ratio to zero, the method further includes: controlling the master controller to detect the fault status of the slave controller, controlling the slave controller to detect the fault status of the input components, computing components, and output components of the master controller; exchanging detection results between the master controller and the slave controller through a communication link; and generating a master-slave switching instruction when the detection results of the master controller and the slave controller are consistent and both determine that the master controller has failed.

[0015] In the above embodiments, the master and slave controllers mutually detect each other's fault status and exchange detection results through a communication link, forming a two-way cross-verification mechanism. A switching command is only generated when both sides' detection results are consistent and both determine that the master controller has failed, effectively avoiding erroneous switching caused by unilateral misjudgment. By refining fault detection to three levels—input components, calculation components, and output components—the system can accurately identify fault types, providing a basis for subsequent differentiated switching strategies and achieving high reliability and accuracy in fault detection.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, the steps of responding to receiving a master-slave switching instruction, controlling the slave controller to take over the logic calculation task, obtaining the current output value of the master controller, adjusting the output value of the slave controller to align with the current output value, controlling the output ratio of the slave controller to increase from a first preset ratio to a second preset ratio, and controlling the output ratio of the master controller to decrease from the first preset ratio to zero, specifically include: parsing the fault type information carried in the master-slave switching instruction; when the fault type information indicates that the input component of the master controller has failed but the calculation component and output component of the master controller have not failed, controlling the slave controller to take over the logic calculation task; obtaining the current output value of the master controller, adjusting the output value of the slave controller to align with the current output value, linearly adjusting the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio within a preset gradual change time according to a preset step size, and simultaneously linearly adjusting the output ratio of the master controller to decrease from the first preset ratio to zero; when the fault type information indicates that the calculation component or output component of the master controller has failed, controlling the slave controller to take over the logic calculation task, controlling the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio within a control switching time, and controlling the output ratio of the master controller to decrease to zero.

[0017] In the above embodiments, the system adopts differentiated switching strategies based on the fault type. When the main controller only experiences a fault in the input component while its computing and output capabilities remain normal, a gradual and smooth switching is employed. The output ratio of the two controllers is linearly adjusted within a preset time using a cross-fading method to ensure stable and uninterrupted overall output. Conversely, when the main controller experiences a fault in either the computing or output component, a rapid switching strategy is used to complete the switch in a very short time to prevent fault propagation. This approach ensures both output stability under input fault scenarios and rapid response under core fault scenarios, achieving an optimal balance between reliability and stability.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the control switching duration is less than a preset time threshold.

[0019] In the above embodiments, the duration of rapid switching is limited to a preset time threshold, such as less than 50ms, which ensures the system's rapid response capability in core failure scenarios, meets the strict requirements of high reliability applications for fault switching time, and avoids the risk of system failure caused by excessively long fault duration.

[0020] In a second aspect, embodiments of this application provide a synchronization and switching system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the synchronization and switching system to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a synchronization and switching system, cause the synchronization and switching system to perform the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a synchronization and switching system, cause the synchronization and switching system to perform the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the synchronization and switching system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. Due to the adoption of an architecture in which master and slave controllers work in parallel and each undertakes a preset proportion of load output, coupled with a two-layer synchronization strategy of high-frequency synchronous monitoring mechanism for hardware I / O pins and application layer control command synchronization mechanism, the system fully utilizes the computing and output capabilities of the two controllers during normal operation, avoiding the problem of idle slave controller resources in traditional hot standby solutions. At the same time, the execution synchronization of the master and slave controllers is monitored in real time through hardware signal comparison at the 0.1ms level at the bottom layer, ensuring that the time of output of the two controllers is precisely aligned. This effectively solves the problems of low resource utilization and circulating current or torque pulsation caused by asynchronous output of the two controllers in existing redundant control systems, thereby maximizing system capacity and performance and achieving extremely high stability of output quality.

[0026] 2. By employing an application-layer synchronization mechanism that synchronizes torque commands and system logic states via communication links during the application-layer control cycle, enabling the slave controller to execute the same control logic as the master controller, and a low-level synchronization monitoring mechanism that calculates the synchronization rate by comparing and switching hardware I / O pin levels during the low-level control cycle, the system establishes a complete synchronization system covering the logic and execution layers. Application-layer synchronization ensures the consistency of control decisions, while low-level synchronization monitoring detects the alignment of execution timing in real time at a frequency far higher than that of the application layer. Through quantified synchronization rate indicators, it can promptly detect synchronization degradation, effectively solving the problem of insufficient real-time performance and accuracy of synchronization monitoring caused by relying solely on software-level communication confirmation in existing technologies. This, in turn, achieves deep collaboration and high-precision synchronization assurance for master and slave controllers working in parallel.

[0027] 3. Due to the adoption of a bidirectional cross-verification mechanism in which master and slave controllers mutually detect fault status and exchange detection results through a communication link, a switching command is only generated when the detection results of both parties are consistent and both determine that the master controller has failed. The system also refines the fault into three levels: input component, calculation component, and output component for identification, and adopts an intelligent fault response method that adopts differentiated switching strategies according to the fault type. Therefore, the system can effectively avoid erroneous switching caused by unilateral misjudgment, accurately identify the fault type and adopt the optimal switching strategy. When the input component fails, a smooth and gradual switching is achieved through cross-fading to ensure uninterrupted output. When the calculation or output component fails, a rapid switching is achieved to avoid fault propagation. This effectively solves the problems of insufficient fault detection reliability and coarse switching strategies in existing technologies, resulting in switching errors or output jumps. As a result, the system achieves high reliability of fault detection and intelligent and precise control of the switching process. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the synchronization and switching method of the parallel redundant control system in an embodiment of this application;

[0029] Figure 2 This is another flowchart illustrating the synchronization and switching method of the parallel redundant control system in this application embodiment;

[0030] Figure 3 This is a schematic diagram of the physical device structure of a synchronization and switching system in the embodiments of this application. Detailed Implementation

[0031] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0032] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0033] In emergency power systems with dual-winding motor drive systems or dual-power converter architectures, the controller, as the core decision-making unit, is responsible for receiving sensor signals, executing control algorithms, and outputting drive signals to regulate motor torque or power output. In these high-reliability applications, the system needs to maintain continuous operation under extreme conditions; any single point of failure can lead to system failure, causing serious safety hazards or economic losses. Sensors are devices used to detect system status, such as current sensors for acquiring motor phase current, position sensors for obtaining rotor position, and voltage sensors for monitoring bus voltage. Sampling circuits are circuit modules that convert analog signals from sensors into digital signals that the controller can process, including signal conditioning and analog-to-digital conversion. Input components are hardware modules in the controller responsible for receiving and processing external signals, encompassing sensor interfaces, sampling circuits, and communication interfaces. Computational components are the processor core and related circuits in the controller that execute control algorithms and logical operations. Output components are hardware modules in the controller responsible for generating and outputting control signals, such as PWM generators and drive circuits.

[0034] In related technologies, redundant control can be achieved by employing a master-slave hot standby scheme. In this scheme, the master controller undertakes all control tasks and outputs 100% of the control commands, while the slave controller is in hot standby mode, not participating in actual output but maintaining state synchronization with the master controller. The master controller periodically sends system status, control parameters, and torque commands to the slave controller via the CAN bus. The slave controller receives this information and executes the same control logic internally, but does not generate actual output. When the master controller fails, a watchdog timeout mechanism detects the fault and triggers a switchover, with the slave controller taking over the control tasks and rapidly increasing its output from zero to 100%. However, this scheme has significant drawbacks. First, the slave controller does not participate in actual output during normal operation, and its computing and output capabilities are completely idle, resulting in low system resource utilization. Second, although the slave controller maintains logical synchronization, its output state differs from the real-time output of the master controller because it does not participate in actual output. The sudden jump from zero to full load during the switchover can cause torque surges in the motor drive system and current surges in the dual-power converter system, affecting the smooth operation of the load. Furthermore, the watchdog timeout detection mechanism has a relatively long response time, which cannot meet the stringent requirements of some applications for switching times of less than 50ms. The following describes a scenario using the master-slave hot standby method from related technologies: In an emergency power supply system, a master-slave hot standby scheme is adopted. The master controller operates normally, outputting 100% power, while the slave controller is in standby mode. When a sensor failure on the master controller causes the watchdog timeout, the system triggers a switchover. The slave controller rapidly increases its output from 0% to 100%, a switching process that takes approximately 150ms. During this period, the load current fluctuates significantly, affecting power quality.

[0035] The synchronization and switching method of the parallel redundant control system in this application embodiment achieves collaborative parallel operation by allowing the master and slave controllers to each output approximately 50% of the load demand during normal operation, fully utilizing the capabilities of the dual controllers. Simultaneously, a high-frequency synchronization monitoring mechanism employing hardware I / O pin level switching and comparison within a 0.1ms control cycle at the lower level detects the execution synchronization of the master and slave controllers in real time, ensuring precise alignment of the dual controller outputs. During fault switching, since the slave controller always maintains output and is synchronized with the master controller, the switching process uses a crossfading method, smoothly increasing the slave controller output from 50% to 100%, and smoothly decreasing the master controller output from 50% to 0%, ensuring a smooth and uninterrupted process. The following describes a scenario using the synchronization and switching method of the parallel redundant control system in this application: In the same emergency power system, using the scheme of this application, the master and slave controllers operate in parallel, each outputting 50% of the power, maintaining precise alignment through 0.1ms-level hardware synchronization monitoring. When the main controller sensor fails, the system confirms the fault through bidirectional cross-verification and triggers a differentiated switching strategy. The switching is completed within 30ms through cross-fading. The controller output smoothly increases from 50% to 100%, and the main controller output smoothly decreases from 50% to 0%. The load current is stable throughout the switching process without significant fluctuations, and the power supply quality is fully guaranteed.

[0036] To facilitate understanding, the method provided in this implementation will be described in detail below, using the above scenario as an example. Please refer to [link / reference]. Figure 1 This is a flowchart illustrating the synchronization and switching method of the parallel redundant control system in this application embodiment.

[0037] S101, Control the main controller and the slave controller to work in parallel, and the main controller and the slave controller respectively output the first preset ratio of the current load demand.

[0038] Parallel operation refers to the simultaneous execution of control tasks and generation of actual outputs by both the master and slave controllers, rather than a hot standby mode where one controller works while the other remains in reserve. The first preset ratio refers to the proportion of the load output undertaken by a single controller to the total load demand under normal collaborative parallel operation, typically set to 50%, meaning the master and slave controllers each handle half of the output task. Current load demand represents the total output required by the system in its current operating state; for example, the target torque in a motor drive system or the target power in a power conversion system. A controller is an embedded processing unit with signal acquisition, algorithm calculation, and output control capabilities, typically including modules such as a microprocessor, memory, communication interface, and PWM output.

[0039] Specifically, after system initialization, the master and slave controllers enter a collaborative parallel working state. The synchronization and switching system determines the master-slave relationship according to a preset role allocation strategy, typically implemented through hardware DIP switches or configuration parameters. The master and slave controllers load the same control program, including the same control algorithm, parameter configuration, and state machine logic. In this mode, both controllers simultaneously receive sensor signals, execute control algorithm calculations, and each generate an output signal to drive the corresponding power circuit. To avoid output conflicts and circulating current, the system allocates the total load demand according to a first preset ratio, typically set to 50%, meaning the master controller is responsible for 50% of the total output demand, and the slave controller is also responsible for 50%. For example, when the system target torque is 100 Nm, the master controller outputs 50 Nm, the slave controller outputs 50 Nm, and the two are combined to form a total output of 100 Nm.

[0040] In some embodiments, parallel operation and load sharing of master and slave controllers can be achieved in several ways: Optionally, the system achieves load sharing by configuring output limiting parameters for the master and slave controllers. The upper limit of the master controller's output is set to 50% of the total demand, and the upper limit of the slave controller's output is also set to 50% of the total demand. The two controllers independently calculate and output according to the same control algorithm, and the system uses hardware circuitry to superimpose the two outputs to form the total output. Optionally, the system adopts a centralized torque distribution strategy. The master controller calculates the target output values ​​of the master and slave controllers based on the total load demand. The master controller sends the target value of the slave controller to the slave controller through a communication link. After receiving the target value, the slave controller executes closed-loop control to achieve the target. The master controller simultaneously controls its own output to achieve its own target value. In this way, precise load sharing and collaborative operation are achieved. It is understood that other methods can also be used to achieve parallel operation and load sharing of master and slave controllers, such as parallel current sharing control based on the inner current loop or load balancing control based on the outer power loop, etc., which are not limited here.

[0041] S102. Synchronize the control commands of the master controller to the slave controller.

[0042] Control commands refer to the decision information calculated by the master controller based on the current system state and control algorithm, including key parameters such as torque commands, system logic states, and operating modes. The torque command represents the system's current target output torque value and is the core output of the control algorithm. The system logic state refers to the system's operating state identifier, such as state machine information like start-up, running, fault, and shutdown states. Synchronization refers to transmitting the master controller's control commands to the slave controller via a communication link, ensuring that the slave controller receives consistent control objectives and state information with the master controller, thus guaranteeing logical coordination between the two controllers.

[0043] Specifically, in each application-layer control cycle, the master controller executes a complete control algorithm, including state estimation, control law calculation, and output limiting, to obtain the current control command. To ensure that the slave controller can maintain logical synchronization with the master controller, the master controller needs to send key control commands and status information to the slave controller. This information typically includes torque commands, motor speed, system logic state, and fault flags. After receiving this information, the slave controller uses it as input parameters or reference targets for its own control algorithm and executes the same control logic as the master controller. For example, when the system switches from the running state to the stopped state, the master controller updates the system logic state flags and sends them to the slave controller via the communication link. After receiving the state update, the slave controller synchronously enters the stopped state and executes the corresponding stop control procedures, including output ramping and energy recovery operations, ensuring that the state machine transitions of the master and slave controllers remain consistent.

[0044] In some embodiments, the synchronous transmission and processing of control commands can be achieved in several ways: Optionally, the system uses a CAN bus as the communication link between the master and slave controllers, defining a dedicated control command message format, including fields such as message ID, torque command data field, status flag, and checksum. The master controller packages and sends the control command message at the end of each application layer control cycle. The slave controller obtains and parses the message through the CAN receive interrupt, updating the torque command and status information to the control variables. The entire communication process is implemented using a hardware CAN controller, with a transmission delay of less than 1ms. Optionally, the system adopts a dual-channel redundant communication architecture, establishing two independent communication links between the master and slave controllers, such as CAN and SPI. The master controller sends control commands simultaneously through both links, and the slave controller receives two data streams and compares and verifies them. When the two data streams are consistent, the command is used; when the two data streams are inconsistent, a communication fault handling process is triggered. This redundant communication mechanism significantly improves the reliability of command synchronization. It is understood that other methods can also be used to achieve control command synchronization, such as high-speed communication based on Ethernet or tightly coupled synchronization based on shared memory, etc., which are not limited here.

[0045] S103. Within a preset control cycle, at the trigger time of each preset control cycle, control the master controller and slave controller to flip the level state of their respective synchronization signal pins.

[0046] The preset control cycle refers to the execution cycle of the system's lowest-level control task, typically the motor current closed-loop control cycle, with a duration of 0.1ms. This is the control level with the highest real-time requirements. The trigger moment indicates the start time of the control cycle, usually triggered by a timer interrupt, marking the beginning of a new round of control tasks. The synchronization signal pin refers to the dedicated digital I / O pins on the controller used for synchronization monitoring. Each controller is configured with one output pin to send its own synchronization signal and one input pin to receive the synchronization signal from the other. The level switching state refers to switching the I / O pin's level from high to low, or vice versa. This periodic level switching generates a square wave signal, and its switching frequency reflects the execution frequency of the control cycle.

[0047] Specifically, to achieve precise synchronization monitoring of the master and slave controllers at the lower-level control cycle, the system configures a dedicated synchronization signal pin on each of the two controllers. At the trigger moment of each lower-level control cycle, i.e., at the entry point of the timer interrupt service routine, the master and slave controllers respectively execute a level toggle operation on their synchronization signal pins. This operation is usually the first or first few instructions of the controller's interrupt service routine, ensuring that the toggle time is as close as possible to the interrupt trigger moment to reduce time deviation. For example, assuming that the master controller's synchronization pin is at a high level at the beginning of the current cycle, it is toggled to a low level when the interrupt is triggered, and then toggled to a high level again when the next cycle is triggered, and so on. The slave controller performs the exact same operation, also toggling its own synchronization pin at the trigger moment of each cycle. Since the two controllers run the same program and ideally their timer interrupts should trigger synchronously, the synchronization signal pins of the master and slave controllers should toggle at the same time, generating square wave signals with consistent frequency and phase.

[0048] In some embodiments, the generation and acquisition of synchronization signals can be achieved in several ways: Optionally, the system implements a GPIO fast toggle function in the controller's underlying driver. This function directly operates the output data register of the GPIO register and achieves level toggle in a single instruction cycle through bit manipulation instructions, ensuring that the execution time of the toggle operation is predictable and extremely short. The master and slave controllers call this toggle function at the beginning of the timer interrupt, and the toggle time jitter is controlled within 10ns. The slave controller reads the level of the master controller's synchronization pin through the GPIO input sampling function. The sampling operation is also performed at the interrupt entry point, and the interval between the sampling time and the toggle time is fixed. Optionally, the system uses the controller's hardware capture unit to achieve accurate acquisition of synchronization signals. The synchronization output pin of the master controller is connected to the timer capture input channel of the slave controller. Whenever the level of the master controller's synchronization pin changes, the capture unit of the slave controller automatically records the timestamp of the change moment. By comparing the timestamps of two consecutive captures, the actual control cycle of the master controller is calculated, and then it is determined whether the cycles of the master and slave controllers are consistent. This hardware capture-based method has higher measurement accuracy, reaching the nanosecond level. It is understandable that other methods can be used to process synchronization signals, such as using dedicated synchronization chips or FPGAs to achieve high-precision signal comparison, etc., which are not limited here.

[0049] S104. In response to the master-slave switching instruction, control the slave controller to take over the logic calculation task. The triggering conditions for the master-slave switching instruction include detecting a fault in the input component of the master controller or the synchronization rate being lower than a preset synchronization threshold.

[0050] The master-slave switchover command is a control instruction generated by the system based on fault detection results. It initiates the master-slave controller role transition process and typically includes information such as switchover type, fault type, and timestamp. Taking over logical calculation tasks means the slave controller is upgraded to the new master controller, assuming all the control decision-making responsibilities of the original master controller, including upper-level control tasks such as torque calculation, state machine management, and communication coordination. The response indicates that the system immediately executes the corresponding processing flow after detecting the trigger condition of the master-slave switchover command.

[0051] Specifically, when the system detects a fault in the main controller and a master-slave switch is required, the fault detection module generates a master-slave switch command and notifies the relevant control unit via a communication link or internal event queue. Upon receiving the master-slave switch command, the slave controller first verifies the command's validity, including checking the command format, verifying if the timestamp is within a reasonable range, and checking if the command sequence number is consecutive. After confirming the command's validity, the slave controller triggers a state machine transition, switching from the collaborative parallel state to the takeover state. In the takeover state, the slave controller stops receiving control commands from the original main controller for synchronization and instead independently executes complete control logic calculations, including the entire process from sensor acquisition, state estimation, control law calculation to output generation. The logical tasks that the slave controller needs to take over include: calculating the target torque based on motor speed and load requirements; managing the system state machine and determining state transition conditions such as start-up, operation, and shutdown; handling fault diagnosis and protection logic; and managing communication protocols with the host computer or other systems. Because the slave controller maintains logical synchronization with the main controller throughout the collaborative parallel phase, its internal state variables, such as speed estimates and integrator states, are essentially consistent with the main controller. Therefore, a smooth transition can be achieved when taking over logical tasks, without control jumps due to state discontinuity.

[0052] In some embodiments, logical takeover from the controller can be implemented in several ways: Optionally, the system adopts a state machine-driven takeover process. The controller defines a master-slave switching state machine, including states such as collaborative parallelism, takeover preparation, logical takeover, output adjustment, and stand-alone operation. When a master-slave switchover command is received, the state machine transitions from the collaborative parallelism state to the takeover preparation state. In this state, the slave controller stops synchronizing the torque command of the master controller and instead uses its own calculated torque value. At the same time, the state update of the master controller is frozen. Then, the state machine transitions to the logical takeover state, and the slave controller fully takes over the control task. After completion, it enters the output adjustment state. Optionally, the system adopts a task priority switching takeover method. During normal operation, the slave controller runs two control tasks: one is a low-priority complete control task containing all control logic, and the other is a high-priority simplified control task that only handles output synchronization and state tracking. In the collaborative parallelism state, the high-priority task dominates. When a master-slave switchover command is received, the system immediately increases the priority of the low-priority task and decreases the priority of the high-priority task, realizing a rapid switch of control logic. It is understandable that other methods can be used to implement logical takeover, such as preemptive switching based on interrupt priority or task migration based on dual-core processors, etc., which are not limited here.

[0053] S105. Obtain the current output value of the main controller, adjust the output value of the slave controller to be aligned with the current output value, control the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio, and control the output ratio of the main controller to decrease from the first preset ratio to zero.

[0054] Here, the current output value refers to the actual output of the main controller at the moment of switching, such as the PWM duty cycle or current command value in a motor drive system. Output value alignment means adjusting the output of the slave controller to the same level as the current output value of the main controller, ensuring that the output states of the two controllers are consistent before switching. The second preset ratio refers to the proportion of the load output undertaken by the slave controller to the total demand after switching, usually 100%, meaning that the slave controller fully takes over the output task. Output ratio adjustment refers to achieving a smooth transition of output by gradually changing the output gain or limiting value of the controller.

[0055] Specifically, after the logic takeover is completed, the system enters the output adjustment phase. The goal of this phase is to smoothly reduce the output of the main controller to zero while simultaneously increasing the output of the slave controller to 100%, ensuring that the total output remains stable and does not fluctuate during the switching process. First, the slave controller reads the current output value of the main controller via the communication link or shared memory, for example, the current PWM duty cycle is 40% and the target current is 80A. The slave controller adjusts its own output reference to match that of the main controller, for example, setting the PWM duty cycle to 40% and the target current to 80A. At this point, the outputs of the two controllers are fully aligned. Then, the system initiates a gradual adjustment process for the output ratio. This process uses different time lengths and adjustment strategies depending on the fault type. For input component faults, a smooth gradual adjustment strategy is adopted. Within a preset gradual adjustment time of 30ms, the output ratio of the slave controller is linearly increased from 50% to 100% in fixed steps, such as adjusting by 3.33% every 1ms, while the output ratio of the main controller is linearly decreased from 50% to 0%. At each adjustment step, the system updates the output gain factor of the slave controller to the current ratio divided by 100%, and updates the output gain factor of the master controller to the remaining ratio divided by 100%. For example, at 10ms, the slave controller gain is 83.3%, and the master controller gain is 16.7%. The sum of their outputs still equals 100% of the total demand, and the total output perceived by the load remains constant. This crossfading adjustment method is similar to the crossfading in and out of audio signals, ensuring the smoothness of the switching process. If the computing or output components fail, and the master controller has lost its reliable output capability, a rapid switch is required. The system completes the ratio adjustment within a very short control switching time, such as 5ms. The slave controller quickly increases the output to 100%, and the master controller quickly decreases to 0%. Although the switching speed is fast, the continuity of the total output is still guaranteed because the outputs are aligned before the switch.

[0056] In some embodiments, the output ratio can be adjusted in several ways: Optionally, the system employs a lookup-based gradual adjustment, pre-calculating and storing a ratio adjustment sequence from 0% to 100%. The sequence length is equal to the gradual adjustment duration divided by the control cycle. For example, a 30ms duration and a 0.1ms cycle correspond to 300 sequence points. The sequence values ​​are distributed linearly or as an S-curve. The slave controller reads the next ratio value from the sequence table in each control cycle and updates the output gain, while the master controller reads the corresponding complementary ratio value. This method allows for pre-optimization of the adjustment curve and high execution efficiency. Optionally, the system employs a real-time calculation-based gradual adjustment. The slave controller maintains a gradual timer to record the elapsed time since the start of the switch. The current ratio is calculated based on the elapsed time and the total gradual adjustment duration, using a linear interpolation formula: current ratio = 50% + elapsed time / total duration × 50%. The master controller ratio is 100% minus the slave controller ratio. This method is more flexible and allows for dynamic adjustment of the gradual adjustment duration. It is understood that other methods can also be used to achieve output adjustment, such as adaptive adjustment based on closed-loop control or dynamic adjustment based on load feedback, etc., which are not limited here.

[0057] In some embodiments, this step specifically includes:

[0058] The fault type information carried in the master-slave switching command is parsed. When the fault type information indicates that the input component of the master controller has failed but the computing component and output component of the master controller have not failed, the slave controller is controlled to take over the logic calculation task, obtain the current output value of the master controller, adjust the output value of the slave controller to align with the current output value, and linearly adjust the output ratio of the slave controller from the first preset ratio to the second preset ratio according to the preset step size within a preset gradual change time. At the same time, the output ratio of the master controller is linearly adjusted from the first preset ratio to zero. When the fault type information indicates that the computing component or output component of the master controller has failed, the slave controller is controlled to take over the logic calculation task. Within the control switching time, the output ratio of the slave controller is controlled to increase from the first preset ratio to the second preset ratio, and the output ratio of the master controller is controlled to decrease to zero. This control switching time is less than a preset time threshold.

[0059] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 This is another flowchart illustrating the synchronization and switching method of the parallel redundant control system in this application.

[0060] S201. Control the main controller and the slave controller to work in parallel. The main controller and the slave controller respectively output the first preset ratio of the current load demand.

[0061] Refer to step S101, which will not be repeated here.

[0062] S202. During the application layer control cycle, the torque command and system logic status of the master controller are sent to the slave controller through the communication link.

[0063] The application layer control cycle refers to the execution cycle of the upper-layer control tasks of the system, typically the control cycle of the motor speed closed loop or torque closed loop, with a duration of about 2ms, much longer than the 0.1ms current control cycle of the lower layer. It is used for slower outer-loop control and state management. The communication link refers to the data transmission channel between the master and slave controllers. Common implementation methods include CAN bus, SPI, and Ethernet. This application prefers CAN bus due to its strong anti-interference capabilities and mature industrial application foundation. The torque command refers to the target torque value calculated by the master controller based on the requirements of the host computer or local algorithms. It is the core command of the control system and determines the magnitude of the motor's output torque. The system logic state includes the current operating state identifier of the system, such as initialization state, standby state, start-up state, running state, deceleration state, fault state, and stop state. The state machine's transition logic controls the system's behavior mode.

[0064] Specifically, in each application-layer control cycle, after completing the control calculations for the speed loop or torque loop, the main controller obtains the torque command value for the current cycle, for example, a target torque of 80 Nm. Simultaneously, the main controller determines the current system logic state based on the system state machine's transition logic, such as being in the running state. The main controller packages this critical control information into data packets. The packet format includes a packet ID to identify the message type, a data field containing the floating-point value of the torque command and an enumerated value of the system state, a timestamp recording the packet generation time, and a checksum to verify data integrity. After packaging, the main controller sends the packet to the CAN bus via the CAN controller. The slave controller configures a CAN receive filter to only receive packets with specific IDs from the main controller. When the CAN controller receives a packet, it triggers a receive interrupt. The slave controller reads the packet data in the interrupt service routine, first verifying the packet's checksum to confirm that the data has not been corrupted during transmission, then parsing the data field to extract the torque command value and system state value. The torque command is updated to the target variable of its own control algorithm, and the system state is updated to the current state variable of the state machine. In some embodiments, application layer control command synchronization can be achieved in several ways: Optionally, the system adopts a periodic broadcast method based on the CAN bus. The master controller sends a synchronization message at a fixed time in each application layer control cycle, such as 0.5ms after the start of the cycle. The message adopts the standard CAN frame format, with a data length of 8 bytes. The first 4 bytes store the IEEE754 floating-point number of the torque command, the 5th byte stores the enumeration value of the system status, the 6th and 7th bytes store the lower 16 bits of the timestamp, and the 8th byte stores the checksum. The CAN bus baud rate is configured to 1Mbps, and the single frame transmission time is about 0.13ms. The slave controller completes parsing and variable update within 0.2ms after receiving the message, and the entire synchronization delay is controlled within 1ms. Optionally, the system adopts a high-speed synchronization method based on shared memory. The master and slave controllers exchange data through a shared memory area implemented by dual-port RAM or FPGA. The master controller writes the torque command and system status to a specific address in the shared memory in each application layer cycle, and the slave controller reads data from the shared memory in the same cycle. The entire read and write process ensures data consistency through a hardware arbitration mechanism, and the synchronization delay can be reduced to the microsecond level. This method is suitable for application scenarios with extremely high requirements for synchronization delay. It is understandable that other methods can be used to achieve application layer synchronization, such as real-time synchronization based on the EtherCAT protocol or deterministic communication based on a time-triggered architecture, etc., which are not limited here.

[0065] S203. Receive torque commands and system logic status from the controller, and execute the same control logic as the main controller based on the torque commands and system logic status.

[0066] In this context, "receiving" refers to the slave controller acquiring data packets sent by the master controller through the communication interface and completing data parsing and verification. "Executing the same control logic" means the slave controller runs a control algorithm program completely identical to the master controller's, including the same control strategy, calculation formulas, and parameter configurations, ensuring the same control output under identical input conditions. "Based on torque command and system logic state" means the slave controller uses the received torque command as the control target and the system logic state as the state machine input to drive the execution of the control logic.

[0067] Specifically, after receiving and parsing the synchronization message from the master controller, the slave controller obtains the torque command value and system logic state value for the current period. The slave controller uses the torque command value as the setpoint for the torque closed-loop controller and executes the control algorithm calculation. This control algorithm is identical to that of the master controller, including the same PID parameters, feedforward compensation strategy, saturation limiting logic, etc. The slave controller reads its own sensor feedback signals, such as phase current collected by the current sensor and rotor angle obtained by the position sensor. Based on these feedback signals and the torque command, it calculates the control output, such as the voltage commands for the d-axis and q-axis. Simultaneously, the slave controller updates its own state machine's current state according to the received system logic state and executes the corresponding behavioral logic. For example, when the system state is running, the slave controller enables normal control output; when the system state switches to deceleration, the slave controller executes torque ramp-down logic to gradually reduce the output torque. Since the slave controller and master controller use the same program and parameters, after receiving the same torque command and status information, the control logic executed by both is completely consistent, and the resulting control outputs should theoretically be the same.

[0068] In some embodiments, the slave controller can ensure that it executes the same control logic as the master controller in several ways: Optionally, the system adopts a unified firmware burning method, with the master and slave controllers using identical hardware platforms and software programs. During the production phase, the same firmware image is burned into the Flash memory of both controllers. After the program starts, it determines its role as a master or slave controller based on the level state of the hardware DIP switch or configuration pin. Except for the role identifier and communication address, the control algorithms, parameter tables, and state machine logic of the two are completely identical. This method ensures program consistency from the source and simplifies software maintenance. Optionally, the system adopts a dynamic parameter synchronization mechanism. Based on the unified firmware, the master controller is allowed to adjust certain control parameters such as PID gain and filter coefficients during operation. When the master controller modifies the parameters, it sends the new parameter values ​​to the slave controller through a dedicated parameter synchronization message. After receiving the message, the slave controller updates its parameter table, ensuring that the control parameters of the two controllers are always consistent. This method provides flexibility for runtime parameter tuning while maintaining program consistency. It is understood that other methods can also be used to ensure control logic consistency, such as parameter management based on configuration files or firmware synchronization based on version control, etc., which are not limited here.

[0069] S204. Within a preset control cycle, at the trigger time of each preset control cycle, control the master controller and slave controller to flip the level state of their respective synchronization signal pins.

[0070] Refer to step S103, which will not be repeated here.

[0071] S205. Monitor the synchronization signal pins of the master controller and slave controller during the underlying control cycle. The duration of this underlying control cycle is shorter than the duration of the application layer control cycle.

[0072] The underlying control cycle refers to the fastest real-time control task cycle of the system, typically the current loop control cycle, with a duration of 0.1ms. This is the control level with the highest real-time requirements in motor drive or power conversion systems, directly affecting the system's dynamic response and stability. The monitoring synchronization signal pin refers to the real-time reading of the synchronization signal level between the master and slave controllers via GPIO input, recording level changes to evaluate the timing alignment of the two controllers. A duration shorter than the application layer control cycle indicates that the underlying control cycle (0.1ms) is significantly shorter than the application layer control cycle (2ms), with a frequency ratio of 20:1. This multi-level control architecture is a typical characteristic of modern high-performance motion control systems; the inner loop's fast response ensures system stability, while the outer loop's slow adjustment achieves precise tracking.

[0073] Specifically, during system operation, the low-level control task is executed at a high frequency with a period of 0.1ms. This task is triggered by a timer interrupt and is the highest priority real-time task in the system. In the interrupt service routine of each low-level control cycle, in addition to executing the current loop control algorithm, it also includes synchronization signal monitoring logic. The slave controller first performs a synchronization signal acquisition operation at the interrupt entry point, reading the current level value of the master controller's synchronization pin through the GPIO input register. This operation has a very short execution time, typically only requiring 1-2 CPU clock cycles. Simultaneously, the slave controller reads the current level value of its own synchronization pin. Since the slave controller has already performed a level toggle operation at the interrupt entry point, what is read now is the toggled level state. The slave controller maintains a synchronization monitoring data structure, including the master controller's synchronization pin historical level sequence, the slave controller's synchronization pin historical level sequence, and a synchronization status statistics counter. In each low-level cycle, the slave controller adds the acquired master-slave synchronization pin level values ​​to the historical sequence, with a sequence length equal to a preset statistical window size, such as 100 cycles. By continuously monitoring the level changes of the synchronization signal pins, the system can detect the execution synchronization of the master and slave controllers with a time resolution of 0.1ms.

[0074] In some embodiments, monitoring of the underlying synchronization signal can be achieved in several ways: Optionally, the system employs a software polling method, where the controller inserts GPIO read code at a fixed location in the underlying interrupt service routine. Each time an interrupt is executed, the master-slave synchronization pin level is read and stored. To reduce jitter in program execution time, the GPIO read operation is placed at the very beginning of the interrupt service routine, ensuring consistency of the acquisition time. The CPU time occupied by the synchronization monitoring logic is approximately 5 microseconds, having minimal impact on the 0.1ms cycle control task. Optionally, the system employs a hardware capture method, utilizing the controller's advanced timer capture function. The master controller's synchronization pin is connected to the slave controller's timer capture input channel. The capture unit is configured to automatically record the timer count value when the pin level changes. The slave controller obtains the transition time of the master controller's synchronization signal by reading the capture register, compares it with its own interrupt trigger time, and calculates the time difference. This hardware capture method can achieve measurement accuracy at the timer clock cycle level; for a 100MHz clock frequency, the time resolution is 10ns. It is understood that other methods can also be used to achieve synchronization monitoring, such as using a dedicated synchronization detection chip or FPGA-based high-precision timestamp recording, etc., which are not limited here.

[0075] S206. By acquiring the level state of the synchronization signal pin of the master controller in each low-level control cycle from the slave controller, the acquired level state is compared with the level state of the synchronization signal pin of the slave controller, and the number of times the level states are consistent and inconsistent is recorded.

[0076] The acquisition of level status refers to the digital level value of the master controller's synchronization pin read by the slave controller via GPIO input. This value is a Boolean variable, with a high level corresponding to logic 1 and a low level corresponding to logic 0. Level status comparison involves logically comparing the acquired master controller synchronization pin level value with the current level value of the slave controller's own synchronization pin to determine if they are equal. Consistent level status indicates that the master and slave controller synchronization pins have the same level value (both high or both low), meaning the two controllers are synchronized at the interrupt trigger time of that cycle. Inconsistent level status indicates that the master and slave controller synchronization pins have different level values ​​(one high and the other low), indicating a phase deviation at the interrupt trigger time of the two controllers. Record count refers to the slave controller maintaining two counters: one to accumulate the number of cycles with consistent level status, and the other to accumulate the number of cycles with inconsistent level status, used for subsequent synchronization rate calculations.

[0077] Specifically, when the slave controller executes the synchronization monitoring logic in the interrupt service routine of each low-level control cycle, it first reads the level value of the master controller's synchronization pin through the GPIO input register, assuming the read result is high (logic 1). Then, the slave controller reads the current level value of its own synchronization pin; since a level toggle operation has already been performed at the interrupt entry point, the current level is assumed to be high (logic 1). Next, the slave controller executes level comparison logic, performing an XOR operation between the master controller's synchronization pin level value and its own synchronization pin level value. If the XOR result is 0, it indicates that the two are the same, and the cycle is considered synchronized, incrementing the synchronization counter by 1; if the XOR result is 1, it indicates that the two are different, and the cycle is considered out of sync, incrementing the out-of-sync counter by 1. This logic-based comparison method is extremely efficient, requiring only one CPU clock cycle to complete. The slave controller continuously executes this comparison and recording process, accumulating the number of synchronizations and out-of-syncs within a preset statistical window, such as the last 100 low-level control cycles. For example, within a statistical window of 100 cycles, if the voltage level is consistent for 95 cycles and inconsistent for 5 cycles, then the synchronization counter value is 95 and the asynchronous counter value is 5.

[0078] S207. Calculate the synchronization rate based on the ratio of the number of times the level states are consistent within a preset number of control cycles to the total number of cycles.

[0079] The preset quantity refers to the length of the statistical window used to calculate the synchronization rate, measured in control cycles, typically set to 100 or 1000. This parameter requires a trade-off between statistical accuracy and response speed; a larger window results in more stable statistical results but a slower response, while a smaller window provides a faster response but is more susceptible to occasional events. The number of times the level states are consistent refers to the number of cycles within the statistical window where the synchronization pin levels of the master and slave controllers are consistent, i.e., the value of the synchronization counter. The total number of cycles equals the preset quantity, i.e., the length of the statistical window. The ratio is the decimal value obtained by dividing the number of synchronizations by the total number of cycles, ranging from 0 to 1. The synchronization rate is the percentage obtained by multiplying the ratio by 100%, ranging from 0% to 100%. This indicator directly reflects the degree of synchronization between the master and slave controllers; the closer the value is to 100%, the better the synchronization.

[0080] Specifically, after the controller completes the synchronization status statistics for a preset number of underlying control cycles, it executes the synchronization rate calculation process. Assuming the statistical window length is 100 cycles, the controller reads the synchronization counter value, say 92, indicating that the master-slave synchronization pin levels are consistent in 92 of these 100 cycles. The controller performs a division operation, calculating the ratio as 92 divided by 100, which equals 0.92. Multiplying this by 100 yields a synchronization rate of 92%. This calculation can be expressed by the formula: Synchronization Rate = Number of Synchronizations / Total Number of Cycles × 100%. The calculated synchronization rate value is stored in the slave controller's synchronization monitoring data structure and updated once per underlying cycle. When using a sliding window approach, the synchronization rate changes in real time, quickly reflecting dynamic changes in synchronization. The system compares the synchronization rate with a preset synchronization threshold, for example, 80%. When the synchronization rate is higher than 80%, the system is considered to have good synchronization, maintaining the current operating state; when the synchronization rate is lower than 80%, synchronization is considered degraded, requiring the triggering of a synchronization recovery process or fault handling.

[0081] In some embodiments, the calculation and application of synchronization rate can be optimized in several ways: Optionally, the system adopts a multi-level synchronization rate index. In addition to the real-time synchronization rate based on a 100-cycle short window, it also calculates the long-term synchronization rate based on a 1000-cycle long window. The short window synchronization rate is used to quickly detect synchronization abrupt changes, while the long window synchronization rate is used to evaluate the long-term stability of the system. The two indices are used together. When the short window synchronization rate is lower than 80% but the long window synchronization rate is still higher than 90%, it is judged as a short-term interference, and lightweight synchronization compensation is performed. When the long window synchronization rate is also lower than 80%, it is judged as a continuous synchronization degradation, and a complete synchronization recovery process is performed. Optionally, the system introduces a synchronization rate change index, which not only focuses on the absolute value of the synchronization rate but also monitors the rate of decrease of the synchronization rate and calculates the difference in synchronization rate between two adjacent statistical periods. When the synchronization rate drops rapidly in a short period of time, such as from 95% to 70% within 1 second, even if the current synchronization rate has not yet fallen below the threshold, the system actively initiates preventive synchronization recovery to avoid further deterioration of synchronization. This predictive maintenance strategy improves the system's proactive protection capabilities. It is understandable that other methods can be used to apply the synchronization rate metric, such as adaptive control gain adjustment based on synchronization rate or performance optimization based on synchronization rate, etc., which are not limited here.

[0082] S208. Determine whether the synchronization rate is lower than the preset synchronization threshold.

[0083] The judgment process involves comparing the calculated synchronization rate with a preset synchronization threshold to arrive at a Boolean result. The preset synchronization threshold is a lower limit for the synchronization rate determined during system design. When the actual synchronization rate falls below this value, the synchronization of the master and slave controllers is considered unacceptable, requiring corrective measures. This threshold is typically determined based on the reliability requirements of the application scenario. For high-reliability applications such as aerospace, the threshold might be set to 95%, while for general industrial applications, it might be set to 80%. A value below this threshold indicates that the actual synchronization rate is less than the threshold, triggering the subsequent synchronization recovery process.

[0084] Specifically, the controller executes synchronization rate judgment logic immediately after each synchronization rate update. This judgment logic first checks whether the system is currently in the normal operation phase. Synchronization rate judgment is only activated during the normal operation phase to avoid misjudgments during the startup phase or other special phases. After confirming that the system is in the normal operation phase, the controller reads the preset synchronization threshold from the configuration parameters, assuming the threshold is 80%. Then, it compares the currently calculated synchronization rate value with the threshold. For example, if the current synchronization rate is 75%, and 75% is less than 80%, the judgment result is true, indicating that the synchronization rate is below the threshold. To avoid frequent triggering of synchronization recovery due to instantaneous synchronization rate fluctuations, the system adds a continuous requirement for the judgment condition. Only when the synchronization rate is below the threshold for multiple consecutive statistical periods, such as three consecutive statistical periods, is the synchronization rate ultimately determined to be substandard. Assuming each statistical period is 100 underlying periods, or 10ms, and three consecutive periods are 30ms, if the synchronization rate remains below 80% within these 30ms, the system confirms that the synchronization has indeed deteriorated, the judgment result is true, and the conditions for triggering the synchronization recovery process are met. If the synchronization rate rises above the threshold in any of the three statistical periods, the persistence counter is reset. If the result is false, the system maintains its current working state and does not trigger synchronization recovery.

[0085] In some embodiments, the synchronization rate judgment logic can be optimized in several ways: Optionally, the system adopts a dual-threshold judgment strategy, setting a low threshold such as 75% and a high threshold such as 85%. When the synchronization rate falls below the low threshold, synchronization recovery is immediately triggered. When the synchronization rate is between the low and high thresholds, an early warning state is entered, increasing the monitoring frequency. When the synchronization rate is above the high threshold, it is judged as a normal state. This dual-threshold strategy is similar to the hysteresis characteristic of a relay, avoiding frequent state reversals near the threshold boundaries. Optionally, the system introduces an adaptive threshold mechanism, dynamically adjusting the threshold based on the system's historical synchronization performance. When the system operates stably for a long time and the synchronization rate remains above 95%, the system automatically raises the threshold to 90% to increase the sensitivity of monitoring. When the system experiences synchronization problems or a harsh working environment, the system automatically lowers the threshold to 70% to increase the tolerance of judgment. Through this adaptive mechanism, the system can intelligently adjust the monitoring strategy according to the actual operating conditions. It is understood that other methods can also be used to implement synchronization rate judgment, such as forward-looking judgment based on trend prediction or comprehensive judgment based on multi-indicator fusion, etc., which are not limited here.

[0086] S209. When the synchronization rate is lower than the preset synchronization threshold, the synchronization recovery process is triggered, and the time alignment between the slave controller and the master controller is restored by adjusting the interrupt triggering timing of the slave controller.

[0087] Triggering refers to the system initiating a corresponding processing flow based on the judgment result. This flow is achieved through event flags, state machine transitions, or interrupt activation. Synchronization recovery refers to a series of operations aimed at re-establishing time synchronization between the master and slave controllers, including steps such as phase deviation measurement, trigger timing adjustment, and synchronization effect verification. Adjusting the interrupt trigger timing involves modifying the configuration parameters of the slave controller's timer, changing the trigger time of the timer interrupt to align it with the interrupt trigger time of the master controller. Time alignment means that the trigger times of the timer interrupts of the master and slave controllers coincide or have minimal deviation on the time axis, typically requiring a time deviation of less than 1 microsecond to ensure that the two controllers remain synchronized at the beginning of each control cycle.

[0088] Specifically, when the system determines that the synchronization rate is below a preset threshold and the continuity condition is met, the state machine of the slave controller transitions from the normal operation state to the synchronization recovery state, in which the synchronization recovery process is initiated. The first step of the synchronization recovery process is to measure the phase deviation between the master and slave controllers. The slave controller uses the input capture function of the timer to capture the level transition moment of the master controller's synchronization signal pin and records the timer count value at the transition moment, denoted as T_master. At the same time, the slave controller records the timer count value at its own interrupt trigger moment, denoted as T_slave. The time difference between the two is calculated as Delta_T = T_master - T_slave, which is the phase deviation between the master and slave controllers. For example, assuming the timer clock frequency is 100MHz and the count difference is 500, the phase deviation is 5 microseconds. The second step is to adjust the interrupt trigger timing of the slave controller. The slave controller modifies the value of the timer's auto-reload register or the comparison match register based on the measured phase deviation, so that the next interrupt trigger moment is advanced or delayed by the corresponding amount of time. The specific adjustment method is as follows: If Delta_T is positive, it indicates that the interrupt of the slave controller lags behind the master controller, and the timer period of the slave controller needs to be shortened by Delta_T, that is, the reload value is reduced by the count value corresponding to Delta_T; if Delta_T is negative, it indicates that the interrupt of the slave controller leads the master controller, and the timer period of the slave controller needs to be extended, that is, the reload value is increased. In order to avoid the control performance fluctuation caused by a single large adjustment, a gradual strategy is adopted for adjustment, adjusting only a certain proportion of the actual deviation each time, such as 50%, and gradually converging to the aligned state after multiple iterations. The third step is to verify the synchronization recovery effect. After the adjustment is performed, the slave controller continues to monitor the synchronization rate. If the synchronization rate recovers to more than 85% within 5 statistical cycles (50ms), the synchronization recovery is determined to be successful, and the state machine transitions back to the normal operating state; if the synchronization rate fails to recover, the system repeats the phase measurement and adjustment steps, performing a maximum of 3 iterations. If it still cannot be recovered after 3 iterations, the system determines that there is a hardware fault or serious interference, triggering the fault handling process.

[0089] S210. Control the main controller to detect the fault status of the slave controller, and control the slave controller to detect the fault status of the input components, computing components and output components of the main controller.

[0090] In this context, a fault state refers to a state where the controller or its components are not operating normally, including complete failure and functional degradation. Input components include hardware modules responsible for acquiring external signals and data, such as sensor interface circuits, analog-to-digital converters, and communication interfaces. Computational components include hardware modules responsible for executing control algorithms and logical operations, such as microprocessor cores, memory, and clock circuits. Output components include hardware modules responsible for generating and outputting control signals, such as PWM generators, drive circuits, and power switches. Detection refers to determining whether the target component is functioning correctly by running diagnostic programs, monitoring key signals, and comparing expected and actual values.

[0091] Specifically, during normal system operation, the master and slave controllers continuously execute mutual fault detection tasks. These tasks run periodically in a low-priority background program, without affecting the execution of real-time control tasks. The master controller detects the fault status of the slave controller primarily by monitoring its heartbeat signals and communication responses. Each application-layer cycle, the slave controller sends a heartbeat message containing self-test results to the master controller. The master controller receives and parses the heartbeat message, checking if the message reception frequency is normal, the data format is correct, and if the self-test results indicate a fault. If no valid heartbeat message is received for several consecutive cycles (e.g., 5 cycles, or 10ms), or if the self-test results in the heartbeat message indicate a fault, the master controller determines that the slave controller has failed. The slave controller detects the fault status of the master controller using a more detailed layered detection method, dividing the master controller into three parts: input components, computational components, and output components, which are detected separately. For the input components, the slave controller compares the sensor data sent by the master controller with the sensor data it collects itself. If the deviation exceeds a reasonable range, it determines that the master controller's sensor or sampling circuit is faulty. For the computing components, the slave controller executes the same control algorithm as the master controller and compares the calculation results. If, under the same input conditions, the calculation results of the master controller and the slave controller are significantly different, it is determined that the processor or memory of the master controller is faulty. For the output components, the slave controller monitors the actual output signal of the master controller, collects the current value driven by the master controller through a current sensor, and compares it with the output command value reported by the master controller. If the actual output deviates too much from the command value, it is determined that the PWM generator or drive circuit of the master controller is faulty.

[0092] In some embodiments, fault detection can be achieved in several ways: Optionally, the system employs a model-based fault detection method, establishing a mathematical model of the main controller's input and output behavior from the controller, including sensor response models, control algorithm models, actuator dynamic models, etc. During operation, the slave controller predicts the main controller's output under the current input conditions based on the model, compares the predicted value with the actual output of the main controller, calculates the residual, and determines that a fault exists when the residual exceeds a statistical threshold. The fault type is identified based on the residual's pattern characteristics; for example, sensor faults typically manifest as input deviations, while actuator faults manifest as output saturation or delays. Optionally, the system employs a fault detection method based on redundant signals, configuring dual or triple redundancy on key sensors of the main controller, such as current sensors. The main controller simultaneously acquires multiple sensor signals, obtains the final feedback value through majority voting or weighted averaging, and the slave controller monitors the consistency of multiple signals. If a certain signal deviates too much from other signals, the sensor in that signal is determined to be faulty. Through redundancy configuration and cross-validation, the accuracy and timeliness of fault detection are significantly improved. It is understandable that other methods can also be used to achieve fault detection, such as fault detection based on spectrum analysis of signal processing or fault detection based on pattern recognition of artificial intelligence, etc., which are not limited here.

[0093] S211. Exchange detection results between the master controller and the slave controller via a communication link.

[0094] In this context, exchanging detection results refers to the master and slave controllers sending their respective fault detection results to each other via a communication link, achieving bidirectional sharing of detection information. The detection results include information such as fault status flags, fault type codes, fault component identifiers, and detection timestamps, and are typically encapsulated in dedicated fault messages for transmission.

[0095] Specifically, after completing their respective fault detection tasks, the master and slave controllers package the detection results into a fault diagnosis message and send it to each other via the CAN bus or other communication links. The format of the fault diagnosis message includes: a message ID to identify the fault diagnosis message type, a sender ID to identify the message source, a fault flag indicating whether a fault was detected, a fault type field encoding the specific type of fault (e.g., input component fault, computation component fault, output component fault), a fault component field indicating the specific component that failed (e.g., sensor 1, PWM channel 2), a timestamp recording the fault detection time, a confidence field indicating the reliability of the fault determination, and a checksum to verify message integrity. The master controller sends the fault detection results from the slave controller to the slave controller, and the slave controller sends the fault detection results from the master controller to the master controller. After receiving each other's diagnostic messages, both controllers parse the message content, extract fault information, and compare it with their own detection results.

[0096] S212. When the detection results of the master controller and the slave controller are consistent and both determine that the master controller has failed, a master-slave switching instruction is generated.

[0097] In this context, consistent detection results indicate that the fault detection logic of both the master controller and the slave controller reaches the same conclusion: both determine that the master controller is faulty. This means that the master controller detects its own fault through self-testing, and the slave controller also detects the fault through monitoring; the two independent detection results corroborate each other. Generating a master-slave switchover command refers to the system creating and sending a control command to initiate the master-slave switchover process based on the fault diagnosis results. This command includes information such as the switchover reason, fault type, and priority.

[0098] Specifically, after exchanging fault detection results, the master and slave controllers each execute their own switching decision logic. This logic first compares the local detection results with those sent by the other controller to check for consistency. The master controller checks its own self-test results with the detection results sent by the slave controller. If both indicate a fault in the master controller, the master controller sets the consistency flag to true. The slave controller performs the same comparison process, checking its own detection results against the master controller and the master controller's self-test results. If they match, the slave controller also sets its consistency flag to true. When both consistency flags are true, the conditions for generating a switching command are met. The switching command can be initiated by either the master or slave controller; this application preferably uses the slave controller, as it will become the new master controller. The slave controller generates the master-slave switching command, which includes: command type (master-slave switching), fault source (master controller), fault type (e.g., input component fault extracted from the detection results), switching mode (e.g., smooth transition or fast switching) determined by the fault type, priority set to highest priority, timestamp recording the command generation time, and sequence number for command tracking. The slave controller sends the switchover command to the master controller via the communication link, simultaneously triggering a state machine transition locally to enter the switchover preparation state. Upon receiving the switchover command, the master controller verifies its validity, including checking the sequence number, timestamp, and signature. After confirming the command's legitimacy, it also triggers a state machine transition to enter the switchover coordination state. Through this mechanism of dual confirmation and formal command transmission, the system ensures the reliability and traceability of master-slave switchover decisions, avoiding erroneous switchovers caused by unilateral misjudgments or communication errors, thus laying the foundation for a smooth subsequent switchover.

[0099] S213. In response to the master-slave switching command, control the slave controller to take over the logical calculation task.

[0100] A master-slave switchover command indicates that the system immediately initiates the processing flow upon detecting the switchover command. Taking over logical calculation tasks refers to the controller switching from cooperative mode to independent mode, fully assuming control decision-making responsibilities, including torque calculation, status management, and communication coordination.

[0101] After receiving the switching command from the controller, the controller verifies the command's validity and triggers the state machine to transition to the logic takeover state. The slave controller stops synchronizing with the master controller's commands and instead performs autonomous calculations, reads sensor feedback, executes the complete control algorithm, and independently manages the state machine. Because synchronization was maintained during the coordination phase, state variables remain consistent, resulting in a smooth transition without control jumps during takeover.

[0102] S214. Obtain the current output value of the main controller, adjust the output value of the slave controller to be aligned with the current output value, control the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio, and control the output ratio of the main controller to decrease from the first preset ratio to zero.

[0103] The current output value refers to the actual output quantity, such as the PWM duty cycle, at the moment of switching of the main controller. Output alignment refers to adjusting the output of the secondary controller to the same level as the main controller. Output ratio refers to the percentage of the total output of a single controller; the first preset ratio is usually 50%, and the second preset ratio is 100%.

[0104] The controller reads the output value of the main controller through the communication link and adjusts its own output to the target value to achieve alignment. Different strategies are adopted according to the fault type: when the input component fails, the ratio is linearly adjusted within 30ms, the slave controller increases from 50% to 100%, the main controller decreases from 50% to 0%, and the outputs of both are superimposed to keep the total output unchanged, achieving a smooth transition; when the calculation or output component fails, the ratio adjustment is quickly completed within 5ms, and the output of the faulty controller is shut down as soon as possible.

[0105] The synchronization and switching system in the embodiments of this invention is described below from the perspective of hardware processing. Please refer to [link / reference needed]. Figure 3 This is a schematic diagram of a physical device structure of the synchronization and switching system in the embodiments of this application.

[0106] It should be noted that, Figure 3 The structure of the synchronization and switching system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0107] like Figure 3As shown, the synchronization and switching system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 302 or programs loaded from storage section 308 into Random Access Memory (RAM) 303, such as performing the methods described in the above embodiments. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.

[0108] The following components are connected to I / O interface 305: input section 306 including audio input devices, push-button switches, etc.; output section 307 including a liquid crystal display (LCD) and audio output devices, indicator lights, etc.; storage section 308 including a hard disk, etc.; and communication section 309 including a network interface card such as a LAN (Local Area Network) card, modem, etc. Communication section 309 performs communication processing via a network such as the Internet. Drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0109] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the various functions defined in the present invention.

[0110] It should be noted that specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0111] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, program segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those shown in the drawings.

[0112] Specifically, the synchronization and switching system of this embodiment includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, it implements the synchronization and switching method of the parallel redundant control system provided in the above embodiment.

[0113] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the synchronization and switching system described in the above embodiments; or it may exist independently and not assembled into the synchronization and switching system. The storage medium carries one or more computer programs that, when executed by a processor of the synchronization and switching system, cause the synchronization and switching system to implement the synchronization and switching method of the parallel redundant control system provided in the above embodiments.

[0114] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0115] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0116] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A synchronization and switching method for a parallel redundant control system, characterized in that, The method, applied to synchronization and switching systems, includes: The master controller and slave controller operate in parallel, and the master controller and slave controller respectively output a first preset ratio of the current load demand; Synchronize the control commands of the master controller to the slave controller; Within a preset control cycle, at the trigger time of each preset control cycle, the master controller and the slave controller are controlled to toggle the level state of their respective synchronization signal pins. In response to a master-slave switch command, the slave controller is controlled to take over the logical computing tasks; Obtain the current output value of the main controller, adjust the output value of the slave controller to align with the current output value, control the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio, and control the output ratio of the main controller to decrease from the first preset ratio to zero.

2. The method according to claim 1, characterized in that, The step of synchronizing the control commands of the master controller to the slave controller specifically includes: During the application layer control cycle, the torque command and system logic status of the master controller are sent to the slave controller via a communication link; The slave controller receives the torque command and the system logic state, and executes the same control logic as the master controller based on the torque command and the system logic state.

3. The method according to claim 1, characterized in that, After the step of controlling the master controller and slave controller to toggle the level states of their respective synchronization signal pins at the trigger time of each preset control cycle, the method further includes: The slave controller acquires the level state of the synchronization signal pin of the master controller, compares the acquired level state with the level state of the synchronization signal pin of the slave controller, counts the number of times the level state is consistent within a preset number of control cycles, and calculates the synchronization rate based on the number of synchronizations. Determine whether the synchronization rate is lower than a preset synchronization threshold; When the synchronization rate is lower than the preset synchronization threshold, a synchronization recovery process is triggered, which restores the time alignment between the slave controller and the master controller by adjusting the interrupt triggering timing of the slave controller.

4. The method according to claim 3, characterized in that, The step of acquiring the level state of the synchronization signal pin of the master controller through the slave controller, comparing the acquired level state with the level state of the synchronization signal pin of the slave controller, counting the number of times the level state is consistent within a preset number of control cycles, and calculating the synchronization rate based on the number of synchronizations specifically includes: The synchronization signal pins of the master controller and the slave controller are monitored during the underlying control cycle, and the duration of the underlying control cycle is shorter than the duration of the application layer control cycle. The slave controller collects the level state of the synchronization signal pin of the master controller in each low-level control cycle, compares the collected level state with the level state of the synchronization signal pin of the slave controller, and records the number of times the level states are consistent and inconsistent. The synchronization rate is calculated based on the ratio of the number of times the level states are consistent within a preset number of control cycles to the total number of cycles.

5. The method according to claim 1, characterized in that, Before the steps of obtaining the current output value of the main controller, adjusting the output value of the slave controller to align with the current output value, controlling the output ratio of the slave controller to increase from the first preset ratio to the second preset ratio, and controlling the output ratio of the main controller to decrease from the first preset ratio to zero, the method further includes: The master controller is controlled to detect the fault status of the slave controller, and the slave controller is controlled to detect the fault status of the input components, computing components and output components of the master controller; The detection results are exchanged between the master controller and the slave controller via a communication link; When the detection results of the master controller and the slave controller are consistent and both determine that the master controller has failed, the master-slave switching instruction is generated.

6. The method according to claim 1, characterized in that, The steps of responding to a master-slave switchover command, controlling the slave controller to take over the logical calculation task, obtaining the current output value of the master controller, adjusting the output value of the slave controller to align with the current output value, controlling the output ratio of the slave controller to increase from a first preset ratio to a second preset ratio, and controlling the output ratio of the master controller to decrease from the first preset ratio to zero, specifically include: Parse the fault type information carried in the master-slave switchover command; When the fault type information indicates that the input component of the main controller has failed but the computing component and output component of the main controller have not failed, the slave controller is controlled to take over the logical computing task. Obtain the current output value of the main controller, adjust the output value of the slave controller to align with the current output value, and linearly adjust the output ratio of the slave controller from the first preset ratio to the second preset ratio within a preset gradual duration according to a preset step size, while simultaneously linearly adjusting the output ratio of the main controller from the first preset ratio to zero. When the fault type information indicates that the computing component or output component of the main controller has failed, the slave controller is controlled to take over the logical computing task. During the control switching time, the output ratio of the slave controller is controlled to increase from the first preset ratio to the second preset ratio, and the output ratio of the main controller is controlled to decrease to zero.

7. The method according to claim 6, characterized in that, The control switching duration is less than a preset time threshold.

8. A synchronization and switching system, characterized in that, The synchronization and switching system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code including computer instructions, and the one or more processors call the computer instructions to cause the synchronization and switching system to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on the synchronization and switching system, the synchronization and switching system performs the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, When the computer program product is run on a synchronization and switching system, the synchronization and switching system performs the method as described in any one of claims 1-7.

Images