Upgrade test method of multi-control device, multi-control device and storage medium

Abstract

The application discloses a multi-control device upgrading test method, a multi-control device and a storage medium, and relates to the technical field of device upgrading. The application completes linkage test after upgrading through the cooperative work of double control units, adjusts torque output according to real-time load and carries out action detection, automatically restores the original configuration of each control unit when the test fails, effectively solves the problems of missing verification after upgrading of the multi-control device, insufficient working condition adaptation, and inability to autonomously back off in an abnormal situation, greatly improves the upgrading safety and operation stability of the multi-control device, and reduces manual operation and maintenance intervention.

Description

Technical Field

[0001] This application belongs to the field of equipment upgrade technology, specifically relating to an upgrade test method for multi-control devices, multi-control devices, and storage media. Background Technology

[0002] Multi-control equipment refers to equipment that includes multiple control units, and equipment upgrades are controlled by the main control unit in the multi-control equipment.

[0003] After firmware upgrades, multi-control devices typically undergo a simple power-on self-test or a basic function check initiated by the main control unit before directly controlling the upgraded devices to operate. This overall verification mechanism is incomplete, making it difficult to effectively verify the operational status of the upgraded devices. Furthermore, the device operating parameters cannot adapt to changes in actual working conditions, and in the event of upgrade anomalies, each control unit struggles to autonomously restore its configuration, requiring manual troubleshooting. This results in insufficient device upgrade stability, high maintenance costs, and negatively impacts the normal use of the upgraded multi-control devices. Summary of the Invention

[0004] The purpose of this application is to provide an upgrade testing method, a multi-control device, and a storage medium for multi-control devices, which can solve the technical problems of difficulty in effectively verifying multi-control devices after upgrade, inability to automatically roll back from anomalies, and poor upgrade reliability.

[0005] To solve the above-mentioned technical problems, this application provides the following technical solution: In a first aspect, embodiments of this application provide an upgrade testing method, wherein the multi-control device includes a first control unit and a second control unit; the upgrade testing method is applied to the first control unit, and the upgrade testing method includes: calculating an original output torque according to an action test instruction; wherein the action test instruction is an instruction sent by the second control unit after the upgrade of the first control unit and / or the second control unit is completed; determining an output torque according to the original output torque and a torque threshold; wherein the torque threshold is a parameter calculated based on the real-time load of the multi-control device; performing an action test on the multi-control device based on the output torque, and sending the obtained test result to the second control unit; if the test result indicates that the action test has failed, restoring the local configuration data of the first control unit to the first backup configuration data before the upgrade.

[0006] In one optional approach, calculating the original output torque based on the action test command includes: determining the target operating state of the multi-control device to perform the target action according to the target action corresponding to the action test command; and calculating the original output torque required for the multi-control device to complete the target action based on the target operating state and the current operating state of the multi-control device.

[0007] In one alternative approach, determining the output torque based on the original output torque and a torque threshold includes: comparing the original output torque with a torque threshold; if the original output torque is greater than or equal to the torque threshold, then using the torque threshold as the output torque; if the original output torque is less than the torque threshold, then using the original output torque as the output torque.

[0008] In one optional approach, the upgrade testing method further includes: determining the real-time load of the multi-control device when performing the target action according to the target action corresponding to the action test instruction; and calculating the torque threshold according to the real-time load and a preset basic safety threshold.

[0009] Secondly, this application provides another upgrade testing method, wherein the multi-control device includes a first control unit and a second control unit; the upgrade testing method is applied to the second control unit, and the upgrade testing method includes: after the first control unit and / or the second control unit is upgraded, sending an action test command to the first control unit; wherein the action test command is used to instruct the first control unit to calculate the original output torque, determine the output torque according to the original output torque and a torque threshold, and perform an action test on the multi-control device based on the output torque to obtain a test result; receiving the test result returned by the first control unit in response to the action test command; if the test result indicates that the action test has failed, restoring the local configuration data of the second control unit to the second backup configuration data before the upgrade.

[0010] In one optional approach, restoring the local configuration data of the second control unit to the second backup configuration data before the upgrade includes: obtaining the second backup configuration data pre-stored by the second control unit before the upgrade; wherein the second backup configuration data is snapshot data stored in shared storage by the second control unit when the multi-control device is in a safe posture; and restoring the local configuration data of the second control unit to the second backup configuration data.

[0011] In one optional approach, the upgrade testing method further includes: generating an upgrade transaction identifier based on the upgrade instruction and sending a security control instruction to the first control unit; wherein the security control instruction is used to instruct the first control unit to control the multi-control device to operate in the safe posture; when the multi-control device is in the safe posture, capturing snapshot data of the second control unit, and binding the captured snapshot data with the upgrade transaction identifier, storing it as the second backup configuration data in the shared storage.

[0012] In an optional embodiment, the upgrade testing method further includes: sending a synchronization signal to the first control unit; wherein the synchronization signal is used to instruct the first control unit to obtain the upgrade transaction identifier from the shared storage, and bind the snapshot data captured by the first control unit in the safe posture with the upgrade transaction identifier, and store it as a first backup configuration data in the shared storage.

[0013] Thirdly, embodiments of this application provide a multi-control device, which includes a processor; a memory and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the upgrade testing method as described in the first aspect.

[0014] Fourthly, embodiments of this application provide a storage medium storing a program or instructions, which, when executed by a processor, implement the upgrade testing method as described in the first aspect.

[0015] This application completes the linkage test after the upgrade by cooperating with two control units. It adjusts the torque output according to the real-time load and performs motion detection. When the test fails, it automatically restores the original configuration of each control unit. This effectively solves the problems of missing verification, insufficient working condition adaptation and inability to automatically roll back from anomalies after the upgrade of multi-control equipment. It greatly improves the safety and operational stability of multi-control equipment upgrades and reduces manual operation and maintenance intervention.

[0016] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0018] Figure 1 This is a flowchart illustrating an exemplary embodiment of the present application of an upgrade testing method for a multi-control device.

[0019] Figure 2 This is a flowchart illustrating an exemplary embodiment of the present application of another method for upgrading and testing multi-control devices.

[0020] Figure 3 Based on Figure 2The exemplary embodiment shown illustrates a flowchart of another upgrade testing method for multi-control devices.

[0021] Figure 4 This is a flowchart illustrating a second backup configuration data storage method as shown in an exemplary embodiment of this application.

[0022] Figure 5 This is a schematic diagram illustrating the application scenario of the upgrade testing method for multi-control devices proposed in this application. Detailed Implementation

[0023] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0024] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0025] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0026] In this application, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0027] After firmware upgrades, multi-control devices typically undergo a simple power-on self-test or a basic function check initiated by the main control unit before directly controlling the upgraded devices to operate. This overall verification mechanism is incomplete, making it difficult to effectively verify the operational status of the upgraded devices. Furthermore, the device operating parameters cannot adapt to changes in actual working conditions, and in the event of upgrade anomalies, each control unit struggles to autonomously restore its configuration, requiring manual troubleshooting. This results in insufficient device upgrade stability, high maintenance costs, and negatively impacts the normal use of the upgraded multi-control devices.

[0028] To address this issue, one aspect of this application provides an upgrade testing method for multi-control devices, thereby resolving the technical problems of difficulty in effectively verifying upgraded multi-control devices, inability to automatically roll back from anomalies, and poor upgrade reliability. The first control unit and the second control unit in this application can be understood as different control units belonging to the same multi-control device. They can be understood as SOC (System on Chip) or other control components, and this application does not impose any limitations on this.

[0029] Please refer to details. Figure 1 , Figure 1 This is a flowchart illustrating an exemplary embodiment of an upgrade testing method for a multi-control device. The multi-control device includes a first control unit and a second control unit; the upgrade testing method is applied to the first control unit, i.e., the first control unit acts as the executing entity. Figure 1 The upgrade test method shown includes at least S110 to S140, which are described in detail below: S110 calculates the original output torque based on the action test command; wherein, the action test command is the command sent by the second control unit after the upgrade of the first control unit and / or the second control unit is completed.

[0030] The motion test command is a control signal issued by the second control unit to the first control unit after confirming that it or the first control unit has completed its upgrade, to trigger linkage verification. This command contains information about the target motion sequence to be executed, such as joint motion trajectories, velocity curves, and specific posture adjustment commands. In some embodiments, the first and second control units perform pre-checks, such as hardware self-tests and version and protocol consistency checks. Only if all pre-checks pass will the second control unit send the motion test command to conduct in-loop security trial operation, i.e., motion testing for multi-control devices in this embodiment.

[0031] The initial output torque is the theoretically calculated initial torque requirement value of the multi-controlled device to drive it to perform the target action, based on internal control algorithms (such as position loop, velocity loop, and current loop algorithms). This initial output torque is calculated by the first control unit by reading current sensor feedback data (such as encoder angle and motor current) and combining it with a preset dynamic model and control parameters. Its function is to serve as the reference input for subsequent torque limiting processing, reflecting the theoretical driving force required for the device to complete the specified action under conditions without safety restrictions. For example, if the target action is for a robotic arm joint to lift a load with a specific acceleration, the first control unit will calculate the theoretically required torque of 50 N·m as the initial output torque based on the load mass, gravitational component, and inertial force.

[0032] The following is an example of how to calculate the original output torque based on the action test command: Based on the target action corresponding to the action test command, determine the target operating state of the multi-control device to perform the target action; based on the target operating state and the current operating state of the multi-control device, calculate the original output torque required for the multi-control device to complete the target action.

[0033] The target action is a motion task carried in the motion test command to verify the effectiveness of the control logic after the upgrade of the first control unit, such as joint zeroing, specific trajectory tracking, or posture adjustment.

[0034] The target operating state is the set of physical state parameters that the multi-control device should reach after executing a target action. It includes the target position, target velocity, and target acceleration. The target operating state is determined by parsing the semantic information in the action test command and combining it with the kinematic constraint model of the multi-control device. The purpose of the target operating state is to serve as the baseline endpoint for torque calculation, defining the expected completion form of the test action. For example, when the action test command instructs the robotic arm of the multi-control device to perform the target action of moving from its current position to a gripping point above the worktable, the first control unit parses the spatial coordinates of the gripping point and the required end effector posture. Then, combining this with the current joint angle constraints, it plans the target joint angle θ at the point of reaching the gripping point. target The target angular velocity and target angular acceleration are both zero. By modeling the state of the target's action in this way, abstract test commands can be transformed into specific physical quantities, providing accurate input boundaries for subsequent torque calculations.

[0035] The current operating state refers to the operating state of the first control unit at the instant it receives the motion test command, including the current joint position, real-time speed, real-time acceleration, and inertial parameters of each link.

[0036] The initial output torque refers to the theoretically required driving torque value for smoothly transitioning a multi-controlled device from its current operating state to a target operating state under ideal conditions. The initial output torque is calculated by substituting the state difference between the target operating state and the current operating state into the dynamic model of the multi-controlled device. Its function is to provide the initial torque required to complete the target action, simulating the load response under real-world operating conditions. For example, the difference between the target operating state and the current operating state (i.e., position error, velocity error, and acceleration error) is used as input, combined with the mass matrix, Coriolis force term, centrifugal force term, and gravity term of the multi-controlled device, to calculate the theoretical driving torque required for each joint. For instance, if the current angle of a joint is 30°, the target angle is 90°, and the action is required to be completed within 1 second with uniform acceleration, the first control unit will calculate the theoretical torque value of 15 N·m required to overcome inertia based on the rotational inertia and angular acceleration requirements. This 15 N·m is the initial output torque of that joint. The raw output torque calculated in this way can accurately reflect the energy change required to switch from the current state to the target state, so that the subsequent testing process not only verifies the execution logic of the control command, but also implicitly verifies the dynamic response characteristics of the multi-control device.

[0037] S120 determines the output torque based on the original output torque and the torque threshold; whereby the torque threshold is a parameter calculated based on the real-time load of the multi-control device.

[0038] The torque threshold is a dynamically changing safety boundary value used to limit the maximum torque that the first control unit ultimately outputs to the actuator, preventing damage to the mechanical equipment due to excessive torque output caused by algorithm anomalies after the upgrade. This torque threshold is a parameter calculated based on the real-time load of the multi-control equipment at the current moment. The real-time load reflects the physical weight, external resistance, and its own gravity distribution currently borne by the multi-control equipment.

[0039] The output torque is the torque output by the actuators of the multi-control equipment controlled by the first control unit.

[0040] The following is an example of how to determine the output torque based on the original output torque and the torque threshold: The original output torque is compared with the torque threshold; if the original output torque is greater than or equal to the torque threshold, the torque threshold is used as the output torque; if the original output torque is less than the torque threshold, the original output torque is used as the output torque.

[0041] For example, if the original output torque is 20 N·m and the torque threshold is 10 N·m, then 10 N·m (torque threshold) is used as the output torque. This situation indicates that the theoretical requirement is within the safety boundary, that is, the torque output is safe. Therefore, no artificial reduction is made, and the original calculated value is directly transmitted, ensuring that the multi-control device can obtain sufficient dynamic response excitation in the low-risk range, thereby truly reflecting the performance after the upgrade.

[0042] If the original output torque is 20 N·m and the torque threshold is 30 N·m, then 20 N·m (the original output torque) is used as the output torque, thus avoiding impact on the mechanical structure. In this scenario, forced limiting effectively avoids overcurrent, overheating, or mechanical structure damage caused by abnormal control parameters after the upgrade or excessive test excitation, ensuring the safety of multi-control equipment under unknown operating conditions.

[0043] S130 performs motion tests on the multi-control device based on the output torque and sends the test results to the second control unit.

[0044] Here, the first control unit uses a safety-limited output torque to drive the multi-control device to execute a preset action test sequence to verify the control performance and stability of the upgraded multi-control device. The first control unit converts the determined output torque into specific motor drive current, controlling the various joints or actuators of the multi-control device to move according to the action test instructions. During execution, the first control unit collects key performance indicators in real time, including but not limited to position tracking error, response bandwidth, vibration amplitude, and system stability margin, and summarizes and analyzes these indicators to form test results. The test results characterize the actual operating performance of the current upgraded version on the multi-control device, such as whether there are abnormal phenomena such as overshoot, oscillation, or inability to reach the target position. These test results are then sent to the second control unit via a communication interface (such as CAN bus, Ethernet, or shared memory) as the basis for the second control unit to determine whether the upgrade was successful. This significantly improves the realism of the upgrade verification, enabling the testing process to cover real physical environments and load conditions, rather than merely remaining at the software level as a simulation.

[0045] In some embodiments, the test result directly represents whether the action test was successful or not. The first control unit sends the test result to the second control unit, which can quickly know whether the action test was successful or not without analysis, thereby saving the data parsing resources inside the second control unit.

[0046] If the test result characterization action test fails, S140 restores the local configuration data of the first control unit to the first backup configuration data before the upgrade.

[0047] Action test failure occurs when key test indicators exceed the preset acceptable range, or when error flags such as emergency stop or communication timeout are triggered during the test. If the action test fails, it indicates that the upgraded multi-control equipment may have safety hazards during actual operation.

[0048] The first backup configuration data is a complete backup of the key operating parameters of the first control unit before the upgrade operation begins. This data includes servo control parameters such as PID parameters, filter coefficients, zero-point offset, and extreme positions. The first control unit can store the first backup configuration data in shared storage to alleviate the local storage pressure on the first control unit.

[0049] In the event of a failed action test, the first control unit automatically triggers a rollback mechanism. It reads the first backup configuration data from local non-volatile storage or shared storage and overwrites it into the current configuration register or parameter storage area. This instantly restores the software state and operating parameters of the first control unit to their stable state before the upgrade. For example, if the upgraded version causes high-frequency jitter in joint movement, resulting in a test failure, the first control unit will immediately load the smoothing filter parameters and gain settings saved before the upgrade to eliminate the jitter. This process requires no manual intervention, achieving software state reversibility, significantly improving the self-healing capability of the first control unit, reducing the need for manual maintenance, and ensuring that multi-control devices can quickly recover to a usable state even in the event of an upgrade anomaly.

[0050] This application embodiment completes the linkage test after the upgrade through the collaborative cooperation of two control units. Torque output is adjusted according to real-time load, and motion detection is performed. In case of test failure, the original configuration of each control unit is automatically restored. This effectively solves the problems of missing verification, insufficient operating condition adaptation, and inability to autonomously roll back from anomalies after upgrading multi-control equipment, significantly improving the safety and operational stability of multi-control equipment upgrades and reducing manual maintenance intervention. Specifically, by introducing a torque-limited safety trial operation mechanism, the upgrade effect is verified in a real control loop, ensuring both the validity of the test and physical safety. Simultaneously, the first backup data is used to achieve complete state recovery in case of upgrade failure. After the first control unit is rolled back, its software image and all key operating parameters are completely consistent with those before the upgrade, allowing for immediate and seamless restoration of original functions. This significantly improves the safety and operational stability of the multi-control equipment upgrade process.

[0051] In another exemplary embodiment of this application, the calculation method of the torque threshold is described in detail below: Based on the target action corresponding to the action test command, determine the real-time load when the multi-control device executes the target action; calculate the torque threshold based on the real-time load and the preset basic safety threshold.

[0052] Real-time load is the sum of external resistance, gravitational components, and inertial forces experienced by each joint or drive unit of a multi-controlled device during the execution of a specific target action. Real-time load is estimated through a dynamic model within the first control unit or directly acquired by torque sensors installed at the joints. For example, when the target action is for the robotic arm to raise its upper arm by 30°, the first control unit calculates a gravitational reverse torque of 12 N·m based on the arm's center of mass position and current angle, and simultaneously calculates an inertial torque of 3 N·m based on acceleration planning. The sum of these two values ​​determines the real-time load to be 15 N·m. This pre-prediction or direct sensing mechanism based on the target action allows for accurate acquisition of the actual load under current operating conditions, providing accurate input data for calculating safety thresholds.

[0053] The basic safety threshold is the maximum safe torque that a multi-control device is allowed to output. This value is usually set based on the peak torque of the motor, the rated torque of the reducer, and the structural strength limit.

[0054] The torque threshold is a parameter obtained by dynamically adjusting the basic safety threshold based on the real-time load. Its function is to define the maximum allowable output torque for the test action under the current operating conditions, preventing the output torque from exceeding the hardware tolerance limits of the multi-control device. For example, if the preset basic safety threshold is 20 N·m and the real-time load is 12 N·m, a safety margin coefficient of 0.8 can be set, resulting in a calculated torque threshold of 20 - (12 × 0.8) = 10.4 N·m; or, simply using the difference method, setting a minimum safety margin of 5 N·m, the torque threshold would be 20 - 12 = 8 N·m (which must be greater than the minimum safety margin). This dynamic calculation method allows the torque threshold to adaptively adjust with changes in the real-time load, providing a dynamic safety boundary for torque-based action testing and effectively avoiding the problems of overly conservative testing or overload risks caused by fixed thresholds.

[0055] One aspect of this application provides an alternative upgrade testing method for multi-control devices, addressing the technical problems of difficulty in effectively verifying upgraded multi-control devices, inability to automatically roll back from anomalies, and poor upgrade reliability. Please refer to [link / reference] for details. Figure 2 , Figure 2 This is a flowchart illustrating an exemplary embodiment of an upgrade testing method for a multi-control device according to this application. The multi-control device includes a first control unit and a second control unit; the upgrade testing method is applied to the second control unit, i.e., the second control unit acts as the executing entity. Figure 2 The upgrade test method shown includes at least S210 to S230, which are described in detail below: S210 After the upgrade of the first control unit and / or the second control unit is completed, an action test command is sent to the first control unit; wherein, the action test command is used to instruct the first control unit to calculate the original output torque, determine the output torque based on the original output torque and the torque threshold, and perform an action test on the multi-control device based on the output torque to obtain the test result.

[0056] The second control unit, as the master control unit of a multi-control device (such as an application SOC), is responsible for the overall management of upper-level task scheduling and upgrade processes, while the first control unit, usually as a slave control unit (such as a control SOC), is responsible for the underlying servo drive and real-time motion control.

[0057] The first and second control units can execute corresponding upgrade modes according to their respective upgrade requirements. For example, dynamic reload mode: suitable for updating only applications in the second control unit and / or non-real-time function libraries in the first control unit. Both control units switch to the new firmware in runtime with almost no downtime. Another example is coordinated ordered restart: suitable for updating core components such as the real-time kernel or drivers of the first control unit. Both control units restart synchronously, and the bootloader loads the new firmware from the spare partition according to the upgrade transaction identifier.

[0058] The motion test command is a trigger signal generated by the second control unit after confirming that the firmware update of the dual control units is complete. Essentially, it is a control package containing a preset test sequence. The command activates the pre-set in-loop safety verification logic within the first control unit, instructing it to enter a torque-limited mode. For example, upon receiving the motion test command, the first control unit calculates the theoretically required original output torque based on the target motion trajectory defined in the command and the current physical state of the device. The first control unit then calls a torque threshold dynamically calculated based on the real-time load, compares and truncates the original output torque with this threshold, determines an output torque that meets the test requirements but does not exceed safety limits, and drives the motor to perform the motion test under this limited torque, thereby generating test results characterizing the device's operational stability. For instance, when the upgrade involves a joint drive algorithm, the motion test command sent by the second control unit may include a sinusoidal joint swing sequence. The first control unit calculates and outputs torque within the safety threshold limit, monitors position tracking errors in real time to generate test results, and returns the test results to the second control unit. This instruction mechanism, initiated proactively by the second control unit, ensures the unified start of the testing process after the dual control units are upgraded and synchronized, thus avoiding misjudgments caused by timing discrepancies.

[0059] S220 receives the test result returned by the first control unit in response to the action test command.

[0060] The test results are comprehensive evaluation data of the operating status of the multi-control equipment after the first control unit completes the above-mentioned torque-limited action test. They are used to characterize the success or failure of the multi-control equipment action test.

[0061] S230 If the test result indicates that the action test has failed, the local configuration data of the second control unit will be restored to the second backup configuration data before the upgrade.

[0062] The second backup configuration data is a complete backup of the key operating parameters of the second control unit before the upgrade operation begins. This data includes critical application configurations of the second control unit, such as the vision calibration matrix, tool coordinate system parameters, process path planning parameters, and user-defined settings. The second control unit can store the second backup configuration data in shared storage to alleviate the local storage pressure on the second control unit.

[0063] If the test result indicates that the action test has failed, the second control unit will immediately trigger the rollback mechanism. For example, the second control unit reads the second backup configuration data from the non-volatile storage area or shared storage and overwrites it into the current running configuration area, thereby instantly restoring the software environment and running parameters to the stable state before the upgrade.

[0064] Figure 2 In the corresponding embodiment, the second control unit actively sends action test commands, achieving centralized management of the test process and ensuring test sequence consistency. It receives test results and determines whether to roll back; and it restores the local configuration data of the second control unit in case of test failure, achieving complete restoration of the application layer state. Simultaneously, through the collaborative cooperation of the second and first control units, when the second control unit performs a local configuration rollback, the first control unit also performs its local first backup configuration data restoration based on the same failure judgment. Together, they form a complete system-level rollback mechanism. This not only solves the problems of missing verification and insufficient operating condition adaptation after multi-control device upgrades, but also effectively avoids the risk of multi-control device downtime due to upgrade anomalies, significantly improving the security and operational stability of multi-control device upgrades.

[0065] In another exemplary embodiment of this application, it is described in detail how to restore the local configuration data of the second control unit to the second backup configuration data before the upgrade. Please refer to [link to relevant documentation] for details. Figure 3 , Figure 3 Based on Figure 2 The exemplary embodiment shown illustrates a flowchart of another upgrade testing method for a multi-control device. This upgrade testing method, as in... Figure 2 The S230 shown includes at least S310 to S320, which are described in detail below: S310 obtains the second backup configuration data pre-stored by the second control unit before the upgrade; wherein, the second backup configuration data is the snapshot data stored in the shared storage by the second control unit when the multi-control device is in a safe posture.

[0066] The second backup configuration data is snapshot data generated through copy-on-write (e.g., copy-on-write) technology, and its generation is strictly limited to the moment when the multi-controller device is in a safe posture.

[0067] Shared storage is a storage area shared by the first control unit and the second control unit. It can be an independent storage area in the multi-control device or an independent storage area connected to the multi-control device.

[0068] A safe posture is defined as a state where all joints of a multi-control device have moved to a preset static retracted position (e.g., all joints are at zero), and the entire multi-control device is in a physically stable state with no collision risk and minimal torque load. For example, upon receiving an upgrade command, the second control unit pauses new task scheduling and waits for the current task of the multi-control device to complete smoothly. The second control unit then instructs the first control unit (control SOC) to control the multi-control device to operate in a safe posture. Based on the current pose of the multi-control device, the environmental map, and joint kinematics and dynamic constraints, the first control unit uses a trajectory optimization algorithm to plan a smooth, collision-free motion trajectory, controlling each joint of the multi-control device to smoothly and accurately reach the preset static posture (e.g., the retracted posture with all joints at zero).

[0069] Before the upgrade begins and the multi-control equipment is in a safe position, the second control unit captures its own application configuration (such as vision calibration matrix, tool coordinate system, process parameters, etc.), packages the application configuration data into a snapshot, and stores it in shared storage. To ensure data consistency, this snapshot data is usually bound to a globally unique upgrade transaction identifier (TxID), which is used to identify the uniqueness of this upgrade transaction.

[0070] S320 restores the local configuration data of the second control unit to the second backup configuration data.

[0071] The second control unit uses the second backup configuration data to perform a full-overwrite restoration of the current operating parameters in its local storage. The restoration process includes parsing the structure of the snapshot data packet, verifying data integrity (e.g., through CRC checksums or hash comparisons), and then writing each parsed parameter item by item into the non-volatile storage and volatile runtime memory of the second control unit to replace any potentially erroneous or incompatible new configurations after the upgrade. During the restoration process, the second control unit pauses new task scheduling to ensure that no logical conflicts arise due to the mixing of old and new parameters during data restoration.

[0072] Figure 3 In the corresponding embodiment, the second control unit restores its local configuration to the snapshot state before the upgrade, instantly reverting the software environment and parameter settings of the second control unit to the exact state before the upgrade. This not only eliminates configuration errors caused by upgrade failures but also ensures that the equipment can be promptly put back into operation with the safe state and process parameters before the upgrade after rollback, without the need for manual recalibration or manual parameter input. This significantly improves the self-healing capability and operational efficiency of multi-control equipment in abnormal upgrade scenarios.

[0073] In another exemplary embodiment of this application, how to store the second backup configuration data to shared storage is described in detail; please refer to [link to relevant documentation]. Figure 4 , Figure 4 This is a flowchart illustrating a second backup configuration data storage method according to an exemplary embodiment of this application. This storage method includes at least steps S410 to S420, which are described in detail below: S410 generates an upgrade transaction identifier based on the upgrade command and sends a safety control command to the first control unit; wherein, the safety control command is used to instruct the first control unit to control the multi-control device to operate in a safe posture.

[0074] An upgrade transaction identifier (TxID) is a globally unique number used to identify an upgrade operation. It is a string generated by the second control unit through a hash operation combining a random number generation algorithm or a timestamp with the multi-controller device ID (Identity document, account). Its purpose is to establish a link between the upgrade event and all subsequent operations (such as snapshot storage and rollback triggering), preventing data confusion between different upgrade batches.

[0075] The safety control command is a control signal generated by the second control unit upon receiving the upgrade command. It instructs the first control unit to immediately suspend the current task scheduling and initiate a safety posture planning program. For example, the safety posture planner within the first control unit calculates a smooth, collision-free motion trajectory based on the current pose information of the multi-control device, environmental map data, and joint kinematics and dynamic constraints using a trajectory optimization algorithm. This allows the planner to control each joint of the multi-control device to smoothly and accurately reach a preset safe static posture (e.g., a retracted posture with each joint at zero). By generating a transaction identifier and forcing entry into a safe posture, the mechanism ensures that subsequent system state captures are obtained under conditions of physical environmental stability and no dynamic load fluctuations, thereby significantly improving the reliability and consistency of backup data.

[0076] When the multi-control device is in a safe posture, the S420 captures snapshot data of the second control unit, binds the captured snapshot data with the upgrade transaction identifier, and stores it as a second backup configuration data in the shared storage.

[0077] For example, when the multi-control device is in a safe posture, the second control unit captures its own snapshot data, uses the generated upgrade transaction identifier as an index key or metadata header, packages and encapsulates it with the snapshot data to obtain second backup configuration data, and writes the second backup configuration data to shared storage. In some embodiments, if the second control unit has sufficient storage space, the second backup configuration data can also be stored locally, meaning that the second backup configuration data is stored in both local and shared storage. Similarly, the aforementioned first backup configuration data can be stored simultaneously in the first control unit's local and shared storage.

[0078] By binding the storage method, if an upgrade fails and a rollback is required, the corresponding historical version configuration data can be quickly retrieved and matched based on the current transaction identifier, thus achieving accurate tracing of upgrade events and precise recovery of the status.

[0079] In some embodiments, a dedicated hardware signal line, such as GPIO (General-Purpose Input / Output), is provided between the first control unit and the second control unit. This dedicated hardware signal line enables atomic transaction synchronization, as detailed below: The second control unit sends a synchronization signal to the first control unit; wherein the synchronization signal is used to instruct the first control unit to obtain the upgrade transaction identifier from the shared storage, and bind the snapshot data captured by the first control unit in the safe posture with the upgrade transaction identifier, and store it as the first backup configuration data in the shared storage.

[0080] The synchronization signal is an atomic synchronization instruction triggered by the second control unit to the first control unit via a dedicated hardware communication link. Its function is to establish a microsecond-level time alignment mechanism between the two control units, ensuring that both perform snapshot operations within the same transaction context. This synchronization signal is obtained by sending a high-priority interrupt pulse through a dedicated hardware signal line (such as GPIO) connecting the two control units. Its generation is strictly limited to after the multi-controller device has reached a safe posture. For example, when the second control unit writes the upgrade transaction identifier (TxID) and the pending upgrade flag (PENDING) to shared memory, it immediately pulls the hardware signal line low, generating a falling edge pulse. This pulse is captured by the interrupt controller of the first control unit as a synchronization signal. Because this interrupt is configured with the highest priority and other non-critical interrupts are masked in the interrupt service routine, the first control unit can immediately pause its current task and switch to the snapshot processing flow, thus avoiding latency jitter caused by software polling or ordinary communication protocols.

[0081] Upon receiving the synchronization signal, the first control unit retrieves the upgrade transaction identifier (TxID) and the pending upgrade flag (PENDING) from the shared storage and writes them to its local non-volatile storage. It also binds the snapshot data it captured in a safe posture with the upgrade transaction identifier (TxID) and stores it as the first backup configuration data in the shared storage. Almost simultaneously, the second control unit updates the flag status in the shared storage to COMMITTED.

[0082] Through this hardware interrupt-based synchronization mechanism and the binding method of unified transaction identifier, the backup data generated by the first control unit and the second control unit are strictly consistent in terms of timestamp and logical version. Even if a sudden power outage occurs during the process, both parties can identify the valid backup combination based on the same transaction identifier, thereby providing a data foundation for possible subsequent system-level rollback.

[0083] In another exemplary embodiment of this application, the application scenarios of the above-mentioned multiple upgrade testing methods are illustrated by way of example. Please refer to the following for details. Figure 5 , Figure 5 This is a schematic diagram illustrating an application scenario for the upgrade testing method of the multi-control device of this application. It includes a cloud platform 100 and a multi-control device 200, which can be connected wirelessly. This application does not limit the connection method between them. The multi-control device 200 includes a first control unit 201 and a second control unit 202. A dedicated hardware communication link is provided between the first control unit 201 and the second control unit 202 for atomic transaction synchronization.

[0084] The second control unit 202 receives an upgrade command from the cloud 100, pauses new task scheduling, and waits for the current task of the multi-control device 200 to complete smoothly. The second control unit 202 instructs the first control unit 201 to control the multi-control device 200 to operate in a safe posture. Specifically, based on the current pose of the multi-control device 200, the environmental map, and joint kinematics and dynamic constraints, the first control unit 201 plans a smooth, collision-free motion trajectory through a trajectory optimization algorithm, controlling each joint of the multi-control device 200 to smoothly and accurately reach the preset static posture (such as the contracted posture of each joint returning to zero).

[0085] When the multi-control device 200 is in a safe posture, the first control unit 201 and the second control unit 202 capture their respective snapshot data, and bind them with the upgrade transaction identifier to obtain the first backup configuration data and the second backup configuration data, which are then stored in the shared storage.

[0086] After the data backup is completed, the first control unit 201 and the second control unit 202 execute their respective upgrade plans. After the upgrade of the first control unit 201 and / or the second control unit 202 is completed, the second control unit 202 sends an action test command to the first control unit 201. The action test command instructs the first control unit 201 to calculate the original output torque, determine the output torque based on the original output torque and a torque threshold, and perform an action test on the multi-control device 200 based on the output torque to obtain the test result. If the test result indicates that the action test has failed, the first control unit 201 restores its local configuration data to the first backup configuration data before the upgrade.

[0087] The second control unit 202 receives the test result returned by the first control unit 201 in response to the action test command; if the test result indicates that the action test has failed, the second control unit 202 restores the local configuration data of the second control unit 202 to the second backup configuration data before the upgrade.

[0088] This application completes the linkage test after the upgrade by cooperating with two control units. It adjusts the torque output according to the real-time load and performs motion detection. When the test fails, it automatically restores the original configuration of each control unit. This effectively solves the problems of missing verification, insufficient working condition adaptation and inability to automatically roll back from anomalies after the upgrade of multi-control equipment. It greatly improves the safety and operational stability of multi-control equipment upgrades and reduces manual operation and maintenance intervention.

[0089] Another aspect of this application provides a multi-control device, including: a processor; a memory and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement any of the above-described upgrade test methods.

[0090] Another aspect of this application provides a storage medium storing a program or instructions that, when executed by a processor, implement any of the upgrade test methods described above. This storage medium may be included in the multi-control device described in the above embodiments, or it may exist independently and not be assembled into the multi-control device.

[0091] The above description is merely a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application. Therefore, the scope of protection of this application should be determined by the scope of protection claimed in the claims.

Claims

1. A method for upgrading and testing multi-control equipment, characterized in that, The multi-control device includes a first control unit and a second control unit; The upgrade testing method is applied to the first control unit, and the upgrade testing method includes: The original output torque is calculated based on the action test command; wherein, the action test command is the command sent by the second control unit after the first control unit and / or the second control unit has been upgraded; The output torque is determined based on the original output torque and the torque threshold; wherein the torque threshold is a parameter calculated based on the real-time load of the multi-control device; The multi-control device is tested for motion based on the output torque, and the test results are sent to the second control unit. If the test result indicates that the action test has failed, the local configuration data of the first control unit will be restored to the first backup configuration data before the upgrade.

2. The upgrade testing method according to claim 1, characterized in that, The original output torque is calculated based on the action test command, including: Based on the target action corresponding to the action test instruction, determine the target operating state of the multi-control device executing the target action; Based on the target operating state and the current operating state of the multi-control device, the original output torque required for the multi-control device to complete the target action is calculated.

3. The upgrade testing method according to claim 1, characterized in that, Determining the output torque based on the original output torque and torque threshold includes: The original output torque is compared with the torque threshold. If the original output torque is greater than or equal to the torque threshold, then the torque threshold is used as the output torque; If the original output torque is less than the torque threshold, then the original output torque is taken as the output torque.

4. The upgrade testing method according to claim 1, characterized in that, The upgrade testing method also includes: Based on the target action corresponding to the action test instruction, determine the real-time load of the multi-control device when it executes the target action; The torque threshold is calculated based on the real-time load and the preset basic safety threshold.

5. A method for upgrading and testing multi-control equipment, characterized in that, The multi-control device includes a first control unit and a second control unit; The upgrade testing method is applied to the second control unit, and the upgrade testing method includes: After the first control unit and / or the second control unit are upgraded, an action test command is sent to the first control unit; wherein, the action test command is used to instruct the first control unit to calculate the original output torque, determine the output torque based on the original output torque and the torque threshold, and perform an action test on the multi-control device based on the output torque to obtain the test result; Receive the test result returned by the first control unit in response to the action test command; If the test result indicates that the action test has failed, the local configuration data of the second control unit will be restored to the second backup configuration data before the upgrade.

6. The upgrade testing method according to claim 5, characterized in that, Restore the local configuration data of the second control unit to the second backup configuration data before the upgrade, including: Obtain the second backup configuration data pre-stored by the second control unit before the upgrade; wherein, the second backup configuration data is snapshot data stored in shared storage by the second control unit when the multi-control device is in a safe posture; Restore the local configuration data of the second control unit to the second backup configuration data.

7. The upgrade testing method according to claim 6, characterized in that, The upgrade testing method also includes: An upgrade transaction identifier is generated based on the upgrade instruction, and a security control instruction is sent to the first control unit; wherein, the security control instruction is used to instruct the first control unit to control the multi-control device to operate to the safe posture; When the multi-control device is in the safe posture, a snapshot of the second control unit is captured, and the captured snapshot data is bound with the upgrade transaction identifier and stored as the second backup configuration data in the shared storage.

8. The upgrade testing method according to claim 7, characterized in that, The upgrade testing method also includes: A synchronization signal is sent to the first control unit; wherein the synchronization signal is used to instruct the first control unit to obtain the upgrade transaction identifier from the shared storage, and bind the snapshot data captured by the first control unit in the safe posture with the upgrade transaction identifier, and store it as the first backup configuration data in the shared storage.

9. A multi-control device, characterized in that, include: processor; A memory and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the upgrade test method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium stores a program or instructions, which, when executed by a processor, implement the upgrade test method as described in any one of claims 1 to 8.

Images