Restart recovery system and method for an apu controller

Abstract

The application provides a restart recovery system and method of an APU controller, the restart recovery system comprising a digital signal processor, a field programmable gate array, a non-volatile random access memory, a sensor, and an actuator; the recovery method comprising the following steps: a data initialization and recovery module reads running context data stored in a random storage unit; a CRC check value is identified, a CRC check is performed, the data initialization and recovery module sets a hot start identifier in the running context data of the random storage unit to 1, and a hot restart recovery is performed; the data initialization and recovery module clears the running context data of the random storage unit, and a cold restart recovery is performed. The restart recovery system and method of the APU controller can solve the two core problems of "output jump caused by peripheral register reset" and "loss of dynamic state during operation" in the prior art in the field of civil aviation technology.

Description

Technical Field

[0001] This invention relates to the field of civil aviation technology, and in particular to a restart and recovery system and method for an APU controller. Background Technology

[0002] The Auxiliary Power Unit (APU) is a crucial auxiliary energy system for aircraft and large equipment, and the reliability of its controller directly impacts flight safety and mission execution. The APU controller typically uses a digital signal processor (DSP) as its core control unit, responsible for critical functions such as state machine management, fuel control, ignition timing, and engine speed regulation. In actual operation, the controller may experience a watchdog reset due to software malfunctions or electromagnetic interference, or a system power outage due to power fluctuations, leading to a system restart.

[0003] Currently, there is limited research in China on APU controller hot restart recovery technology.

[0004] Chinese patent CN202211217468.X, "System and Control Method for DSP Reset Process Based on FPGA," discloses a technical solution for controlling the DSP reset process using an FPGA. This solution connects the FPGA's first I / O pin to the DSP's reset pin and its second I / O pin to the DSP's GPIO pin, enabling control over the DSP's initial reset and mid-process crash reset. The patent proposes that the FPGA can send data to the DSP after reset, allowing the DSP to recover its pre-crash operating state. However, this technical solution primarily addresses two reset triggering issues: DSP power-on failure and mid-process crash. It does not address how to resolve the output jump caused by clearing peripheral registers during the reset process, nor does it disclose the automatic retention mechanism of key runtime state variables during reset, or the differentiated recovery strategy based on runtime phase distinctions.

[0005] Chinese patent CN120086044A, entitled "System and Method for Automatically Recording the Reasons for Abnormal Restart of Central Processing Unit and Saving Logs and Data," proposes a system consisting of a reset trigger module, a reset reason recording module, a data and log recording module, and a reset execution module. This system can record the reset reason and save important data to memory or non-volatile memory via a delayed reset before the central processing unit restarts. While this technology achieves data protection before restarting, its essence is "recording" rather than "restoring." After the system restarts, a complete initialization is still required, and it cannot restore the operating state before the fault (such as the current state of the state machine, the fuel servo valve drive current, etc.). Furthermore, this solution does not address the output jump problem caused by peripheral register resets, making it unsuitable for APU control systems with stringent requirements for output continuity.

[0006] Chinese patent CN114416413A, "Serial Port Saving System and Method for Operating System Crashes," saves serial port logs by statically allocating a fixed-address log buffer in a random access memory (RAM) and using a warm boot (watchdog reset) to prevent data loss in the buffer. This solution is the first to recognize the data retention characteristic of RAM after reset, but its application is limited to log recording and does not extend this characteristic to critical operating state variables of the control system (such as state machines and output commands). Furthermore, this solution only addresses log buffer retention, failing to handle output interruptions caused by peripheral register resets and lacking differentiated recovery strategies for the APU's startup / steady-state phases.

[0007] Chinese patent CN118113522A, "A Method for Distinguishing Between Cold and Hot Start of a Digital Signal Processor Chip," utilizes the characteristic that data in the internal random access memory (RAM) of a digital signal processor is lost upon power-off but not upon reset. Combined with watchdog register flags, it achieves accurate discrimination between power-on cold start, external watchdog hot reset, and internal watchdog hot reset. This method reveals the hardware characteristic of data retention in the RAM after a digital signal processor reset, but it is limited to startup type identification and does not further utilize this characteristic to achieve automatic recovery of the runtime state, nor does it address the retention mechanism for peripheral outputs. The discrimination result is provided for reference by upper-level software, but the software still needs to perform complete initialization, thus failing to achieve a "disruptive" hot start.

[0008] Chinese patent CN201410213231.X, "Recovery Method and System for Control Software Errors in Aero-engines," discloses a recovery method that triggers a reset command by determining whether the control software has an error, and identifies the reset category after reset to skip the self-test operation accordingly. This reduces the duration of short-term engine instability to some extent. However, this solution only shortens the recovery time by skipping some initialization steps after reset. Its recovery starting point is still the initial state after reset, and it cannot restore the control state before the fault (such as the current stage of the state machine, the fuel servo valve drive current value, etc.), nor can it solve the output jump problem.

[0009] In summary, although existing publicly available DSP reset recovery technologies have made progress in reset control and startup type identification, none of them involve a three-in-one hot restart recovery scheme of "output disturbance-free retention + automatic runtime state retention + differentiated recovery during operation", which is difficult to meet the actual requirements of aviation APU controllers for high reliability and continuous operation capability. Summary of the Invention

[0010] To address the problems in the prior art, this invention provides a restart and recovery system and method for APU controllers, which can solve two core problems in the prior art of civil aviation technology: "output jump caused by peripheral register reset" and "loss of dynamic state during operation".

[0011] To achieve the above objectives, the APU controller's restart and recovery system includes: The digital signal processor (DSP) houses a running context data module, a data initialization and recovery module, an input processing module, a closed-loop control calculation module, a state machine module, an output processing module, a data backup module, and a watchdog feeding module. It is responsible for the state management and control algorithm calculation of the APU controller's restart and recovery system, as well as the state management, control algorithm calculation, and fault diagnosis of the entire APU system. The field-programmable gate array (FPGA) has a watchdog module, a data processing module, an input module, and an output module. It communicates with the digital signal processor (DSP) to latch the DSP's control instructions, monitor the DSP's operating status, and continuously drive the actuators. Non-volatile random access memory, which communicates with the digital signal processor and is used to periodically back up the data of the digital signal processor; The sensor, connected to the field-programmable gate array (FPGA), is used to acquire external data and store the acquired external data into the FPGA. The actuator is connected to the field-programmable gate array (FPGA) and is continuously driven by the FPGA to complete the corresponding execution action; When the digital signal processor is working normally, it writes the data of the current cycle to the non-volatile random access memory in each running cycle. When the APU controller performs a hot start or the digital signal processor experiences a power failure and restart, the digital signal processor reads the most recent valid backup data from the non-volatile random access memory and restores it.

[0012] In a preferred embodiment, the digital signal processor includes a central processing unit and a random access memory unit containing a .ebss storage area; The central processing unit (CPU) is used for logic calculations. It acquires external data collected by sensors from the field-programmable gate array (FPGA) via a communication bus and writes control commands to the FPGA. It periodically backs up the runtime context data in the random access memory (RAM) containing the .ebss storage area via a data backup bus. It periodically writes a "feed the dog" signal to the FPGA via a "feed the dog" signal line. If the FPGA does not receive the "feed the dog" signal in time, it resets the CPU via a reset signal line. The .ebss storage area in the RAM is used to store runtime context data. This .ebss storage area is not initialized when the digital signal processor (DSP) is reset, and the data is automatically retained. When the digital signal processor is working normally, it writes the data of the current cycle to the .ebss storage area and non-volatile random access memory in each running cycle. When the APU controller performs a hot start or the digital signal processor is restarted after a power failure, the digital signal processor reads the most recent valid backup data from the .ebss storage area or non-volatile random access memory in the random access memory and restores it.

[0013] In a preferred embodiment, the field-programmable gate array includes I / O registers, a watchdog timer, an input acquisition driver, and an output execution driver. The I / O registers are used to store external data acquired by the input acquisition driver through the sensor for the digital signal processor to read, latch the control instructions written by the digital signal processor, and continuously drive the actuator through the output execution driver; The watchdog timer is used to monitor the "feed the dog" signal periodically sent by the digital signal processor and to issue a central processing unit reset signal when the "feed the dog" timeout occurs. The input acquisition driver is used to interact with the sensor; the output execution driver is used to interact with the actuator. This field-programmable gate array has a power supply independent of the digital signal processor.

[0014] In a preferred embodiment, the sensor includes a speed sensor and a temperature sensor, which are respectively connected to the input acquisition driver interface of the field-programmable gate array (FPGA). The FPGA continuously acquires external data and stores the acquired data in an I / O register, unaffected by the reset state of the digital signal processor. The actuator includes a starter fuel servo valve, a fuel solenoid valve, an igniter, and a starter. The starter fuel servo valve, fuel solenoid valve, igniter, and starter are respectively connected to the interface of the output execution drive of the field programmable gate array. The field programmable gate array continuously drives the actuator according to the output register value of the I / O register, and is not affected by the reset state of the digital signal processor.

[0015] In a preferred embodiment, the digital signal processor includes a central processing unit and a random access memory unit containing a .ebss storage area; the field-programmable gate array includes I / O registers, a watchdog timer, an input acquisition driver, and an output execution driver; the sensors include a speed sensor and a temperature sensor; and the actuators include a starter fuel servo valve, a fuel solenoid valve, an igniter, and a starter. The central processing unit (CPU) is used for logical calculations. It acquires external data collected by speed and temperature sensors from the I / O registers of the field-programmable gate array (FPGA) via a data communication bus, and writes control commands for the starter fuel servo valve current and fuel solenoid valve status to the FPGA's I / O registers. It also periodically backs up the runtime context data in the .ebss storage area of ​​the random access memory (RAM) unit via a data backup bus. Furthermore, it periodically writes a "feed" signal to the watchdog timer of the FPGA via a "feed" signal line. If the watchdog timer does not receive a "feed" signal in time, it resets the CPU via a reset signal line. The .ebss storage area in the RAM unit stores runtime context data; this area is not initialized when the digital signal processor (DSP) is reset, and the data is automatically retained. The I / O registers are used to store external data acquired by the input acquisition driver through the sensor for the digital signal processor (DSP) to read, latch the control instructions written by the DSP, and continuously drive the actuator through the output execution driver. The watchdog timer is used to monitor the "feed the watchdog" signal periodically sent by the DSP and to issue a central processing unit (CPU) reset signal when the "feed the watchdog" times out. The input acquisition driver is used to interact with the sensor; the output execution driver is used to interact with the actuator. This field-programmable gate array (FPGA) has a power supply independent of the DSP, and the I / O registers, input acquisition driver, and output execution driver remain unchanged during DSP reset. The speed sensor and temperature sensor are respectively connected to the input acquisition driver interface of the field-programmable gate array (FPGA); the FPGA continuously acquires external data through the speed sensor and temperature sensor and stores the acquired data in the I / O register, unaffected by the reset state of the digital signal processor. The starter fuel servo valve, fuel solenoid valve, igniter, and starter are connected to the interface of the output execution drive of the field programmable gate array (FPGA); the FPGA continuously drives the actuator according to the output register value of the I / O register, unaffected by the reset state of the digital signal processor. The non-volatile random access memory (NRAM) is connected to the digital signal processor (DSP) via a data backup bus, and periodically backs up the runtime context data in the .ebss storage area of ​​the random access memory. When the DSP is working normally, it writes the current cycle's data to the NRAM in each runtime cycle. When the APU controller performs a hot start or the DSP experiences a power failure and restart, the DSP reads the most recent valid backup data from the NRAM and restores it.

[0016] In the preferred technical solution, the central processing unit periodically backs up the running context data in the .ebss storage area of ​​the random access memory (RAM) to the non-volatile random access memory via a data backup bus. This data includes running phase identifier, start-up sub-phase identifier, starter enable status, fuel servo valve drive current, fuel solenoid valve status, ignition actuator status, speed percentage, hot start identifier, speed control error, speed acceleration control error, and checksum.

[0017] Another object of the present invention is to provide a restart and recovery method for an APU controller. The restart and recovery system includes a digital signal processor (DSP), a field-programmable gate array (FPGA), a non-volatile random access memory (NRAM), sensors, and actuators. The DSP hosts a runtime context data module, a data initialization and recovery module, an input processing module, a closed-loop control calculation module, a state machine module, an output processing module, a data backup module, and a watchdog timer feeding module. The FPGA hosts a watchdog timer module, a data processing module, an input module, and an output module. The restart and recovery method includes the following steps: Step S1: When the digital signal processor of the APU controller is reset, the data initialization and recovery module reads the running context data stored in the random access memory. Step S2: CRC check value recognition. The data initialization and recovery module recognizes the CRC check value in the running context data read from the random access unit. If the CRC check value is non-zero, proceed to step S3; if the CRC check value is zero, proceed to step S4. Step S3: CRC check. The data initialization and recovery module recalculates the CRC check value based on the running context data read from the random access memory unit. If the recalculated CRC check value matches the CRC check value read from the random access memory unit, the CRC check is successful, and step S8 is executed; if the recalculated CRC check value does not match the read CRC check value, the CRC check fails, and step S4 is executed. Step S4: The data initialization and recovery module reads the backed-up runtime context data from the non-volatile random access memory; Step S5: CRC check value identification. The data initialization and recovery module identifies the CRC check value in the runtime context data read from the non-volatile random access memory. If the CRC check value is identified as non-zero, proceed to step S6; if the CRC check value is identified as zero, proceed to step S9. Step S6: CRC check. The data initialization and recovery module recalculates the CRC check value based on the runtime context data read from the non-volatile random access memory. If the recalculated CRC check value matches the CRC check value read from the non-volatile random access memory, the CRC check is successful, and step S7 is executed. If the recalculated CRC check value does not match the CRC check value read from the non-volatile random access memory, the CRC check fails, and step S9 is executed. Step S7: The data initialization and recovery module writes the runtime context data in the non-volatile random access memory into the random access memory unit; Step S8: The data initialization and recovery module sets the hot-start flag in the runtime context data of the random access memory unit to 1 to perform a hot restart recovery; Step S9: The data initialization and recovery module clears the running context data of the random access memory unit and performs a cold restart recovery.

[0018] In the preferred technical solution, the specific process of hot reboot recovery in step S8 is as follows: Step S81: The watchdog feeding module of the digital signal processor sends a feeding signal to the watchdog module of the field programmable gate array; the input processing module of the digital signal processor obtains the current actual speed collected by the field programmable gate array from the speed sensor and calculates the current speed percentage. Step S82: The state machine module of the digital signal processor reads the running stage identifier from the running context data in the random access memory unit; Step S83: If the operating phase is identified as the start-up phase, the closed-loop control module calculates the current fuel servo valve drive current according to the start-up phase recovery strategy, and sends the control command for the current fuel servo valve drive current to the field programmable gate array via the output processing module to control the actuator; if the operating phase is identified as the steady-state phase, the closed-loop control module calculates the current fuel servo valve drive current according to the steady-state phase recovery strategy, and sends the control command for the current fuel servo valve drive current to the field programmable gate array via the output processing module to control the actuator; if the operating phase is identified as other phases, the output processing module directly sets the fuel servo valve drive current, starter enable state, fuel solenoid valve state, and ignition exciter state to 0, and the field programmable gate array does not control the actuator. Step S84: The output processing module sets the warm start flag in the running context data module to 0, the running context data module writes the context data updated in this cycle to the .ebss storage area of ​​the random access memory, and the data backup module writes the context data updated in this cycle to the non-volatile random access memory for backup.

[0019] In the preferred technical solution, the specific process by which the closed-loop control module calculates the current fuel servo valve drive current based on the start-up recovery strategy in step S83 is as follows: Step 8301: The closed-loop control module reads the start sub-stage identifier from the .ebss storage area in the random access memory unit; Step 8302: If the starting sub-stage is identified as the ignition stage, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. At the same time, the closed-loop control module directly uses the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit as the current fuel servo valve drive current. Step 8303: If the starting sub-stage is identified as the acceleration stage, the closed-loop control module calculates the speed disturbance amplitude based on the speed percentage stored in the .ebss storage area of ​​the random access unit and the current speed percentage calculated by the input processing module. Step 8304: If the calculated speed disturbance amplitude is less than or equal to the first speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module substitutes the current speed percentage calculated by the input processing module into the preset table of speed percentage and speed acceleration in the closed-loop control module, and calculates the current target speed acceleration through linear interpolation and extrapolation. The closed-loop control module substitutes the calculated speed disturbance amplitude into the preset table of speed disturbance amplitude and hot start interruption time coefficient in the closed-loop control module, and calculates the target speed acceleration through linear interpolation and extrapolation. The current hot-start interruption time coefficient is calculated. The closed-loop control module calculates the current actual speed acceleration using the current speed percentage calculated by the input processing module, the speed percentage stored in the .ebss memory area of ​​the random access memory, the current hot-start interruption time coefficient, and the sampling time. The closed-loop control module subtracts the current actual speed acceleration from the current target speed acceleration to obtain the current speed acceleration control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed acceleration control error, the speed acceleration control error stored in the .ebss memory area of ​​the random access memory, and the fuel servo valve drive current stored in the .ebss memory area of ​​the random access memory. The calculation formula is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T *KIACC* errSpeedAcc(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPACC is the proportional coefficient, KIACC is the integral coefficient, errSpeedAcc(k) is the current speed acceleration control error, errSpeedAcc(k - 1) is the speed acceleration control error stored in the .ebss storage area of ​​the random access unit, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit. If the calculated speed disturbance amplitude is greater than the first speed disturbance amplitude threshold preset in the closed-loop control module, but less than or equal to the second speed disturbance amplitude threshold preset in the closed-loop control module; the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module substitutes the calculated speed disturbance amplitude into the correspondence table between speed disturbance amplitude and hot start interruption time coefficient preset in the closed-loop control module, and calculates the current hot start interruption time coefficient through linear interpolation and extrapolation. The closed-loop control module calculates the current actual speed acceleration using the current speed percentage calculated by the input processing module, the speed percentage stored in the .ebss storage area of ​​the random access memory unit, the current hot start interruption time coefficient, and the sampling time. The closed-loop control module subtracts the current actual speed acceleration from the current target speed acceleration to obtain the current speed acceleration control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed acceleration control error and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T *KIACC* errSpeedAcc(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPACC is the proportional coefficient, KIACC is the integral coefficient, errSpeedAcc(k) is the current speed acceleration control error, errSpeedAcc(k - 1) is also the current speed acceleration control error, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit; Otherwise, the output processing module directly sets the fuel servo valve drive current, starter enable status, fuel solenoid valve status, and ignition exciter status to 0, and updates the running stage identifier to the parking stage. The field programmable gate array does not provide control output to the actuator.

[0020] In the preferred technical solution, the specific process by which the closed-loop control module calculates the current fuel servo valve drive current based on the steady-state recovery strategy in step S83 is as follows: Step S8311: The closed-loop control module calculates the speed disturbance amplitude based on the speed percentage stored in the .ebss storage area of ​​the random access unit and the current speed percentage calculated by the input processing module; Step S8312: If the calculated speed disturbance amplitude is less than or equal to the third speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module subtracts the current speed percentage calculated by the input processing module from the target speed percentage preset in the closed-loop control module to obtain the current speed control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed control error, the speed control error stored in the .ebss storage area of ​​the random access memory unit, and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN*errSpeed(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPN is the proportional coefficient, KIN is the integral coefficient, errSpeed(k) is the current speed control error, errSpeed(k - 1) is the speed control error stored in the .ebss storage area of ​​the random access unit, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit. If the calculated speed disturbance amplitude is greater than the third speed disturbance amplitude threshold preset in the closed-loop control module, but less than or equal to the fourth speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module subtracts the current speed percentage calculated by the input processing module from the target speed percentage preset in the closed-loop control module to obtain the current speed control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed control error and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN*errSpeed(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPN is the proportional coefficient, KIN is the integral coefficient, errSpeed(k) is the current speed control error, errSpeedA(k - 1) is also the current speed control error, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit; Otherwise, the output processing module directly sets the fuel servo valve drive current, starter enable status, fuel solenoid valve status, and ignition exciter status to 0, and updates the running stage identifier to the parking stage. The field programmable gate array does not provide control output to the actuator.

[0021] Compared with the prior art, the beneficial effects of the APU controller restart and recovery system and method of the present invention are: 1. A hardware architecture that decouples output and computation separates the digital signal processor (DSP) from the field-programmable gate array (FPGA), with the FPGA serving as an output holding unit independent of DSP reset. When the DSP is reset by the watchdog timer, the FPGA's output register remains unchanged, and the actuator output has zero jump, achieving a truly "disturbance-free" hot start.

[0022] The runtime state is automatically preserved based on the .ebss segment. By utilizing the segment allocation feature of the DSP compiler, the runtime context data of the APU controller is allocated to the .ebss segment, which is not initialized at startup. This enables the variable values ​​to be automatically preserved after hardware reset without the need for additional save / restore software overhead.

[0023] 2. Achieve disturbance-free hot start and eliminate output jumps. Through the FPGA output hold mechanism, the actuator output remains in its pre-fault state during DSP reset, preventing output jumps to zero. Compared to existing technologies, this avoids problems such as fuel interruption, solenoid valve malfunction, and actuator mechanical shock, thus improving system reliability.

[0024] The graded recovery avoids speed overshoot and improves recovery safety. By using graded recovery based on the magnitude of speed disturbance, seamless recovery is achieved for small disturbances, a smooth transition is achieved for medium disturbances using "feedforward + integrator zeroing", and a safe reset is performed for large disturbances, avoiding the risk of speed overshoot or engine stall caused by sudden changes in fuel.

[0025] The hierarchical recovery strategy based on the speed disturbance amplitude calculates the speed disturbance amplitude ΔN during the hot restart during the steady state and acceleration phases. Based on the comparison between the speed disturbance amplitude ΔN and the preset threshold, the controller's historical state is initialized in different ways to achieve hierarchical processing from "seamless recovery" to "soft restart recovery" and then to "safe reset".

[0026] A transitionless initialization mechanism using an incremental PI controller is employed. During moderate disturbance recovery, the output of the previous cycle remains unchanged, while the historical error is initialized to the current error. This ensures that the proportional term change is zero in the first control cycle, and the integral term operates normally according to the current error, achieving a smooth transition in fuel output. During this process, the proportional term only temporarily exits for one cycle, and the system is still driven by the integral term, ensuring convergence. Furthermore, by appropriately setting the speed disturbance threshold and the corresponding hot-start interruption time coefficient, the application range of moderate disturbance recovery is limited to the disturbance range that the integrator can safely handle.

[0027] 3. Safe and reliable recovery during the start-up phase. By distinguishing between the ignition and acceleration phases, maintaining a constant fuel flow during the ignition phase, and performing graded acceleration closed-loop recovery during the acceleration phase, stalling or overspeeding caused by incorrect recovery during the start-up process is avoided, achieving a start-up recovery success rate of over 99%.

[0028] The start-up recovery strategy is based on ignition state differentiation. Start-up sub-stage identifiers (ignition stage / acceleration stage) are stored in .ebss. After a hot start, different recovery logic is executed according to the identifier: the ignition stage restores a fixed fuel flow, and the acceleration stage performs graded acceleration closed-loop recovery to avoid incorrectly starting closed-loop control when ignition fails.

[0029] When calculating the rotational speed acceleration during the acceleration phase, the introduction of a hot start interruption time coefficient solves the problem of acceleration calculation distortion caused by the inconsistency of sampling time before and after hot restart recovery. This is a key step for the incremental PI controller to correctly resume operation.

[0030] 4. Improve system fault tolerance. The three-level recovery architecture ensures a reliable recovery path under different failure scenarios, and the data checksum rollback mechanism prevents system anomalies caused by data corruption. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the hardware composition of the APU controller restart and recovery system in Embodiment 1 of the present invention.

[0032] Figure 2 This is a flowchart illustrating the APU controller restart and recovery method in Embodiment 1 of the present invention.

[0033] Figure 3This is a flowchart illustrating the hot restart recovery method for the APU controller in Embodiment 1 of the present invention.

[0034] Figure 4 This is a schematic diagram of the graded recovery decision-making process during the startup phase in Embodiment 1 of the present invention.

[0035] Figure 5 This is a schematic diagram of the graded recovery decision-making process in the steady-state stage in Embodiment 1 of the present invention.

[0036] Figure 6 This is a schematic diagram of the architecture of the APU controller restart and recovery system in Embodiment 2 of the present invention.

[0037] Figure 7 This is a flowchart illustrating the APU controller restart and recovery method in Embodiment 2 of the present invention.

[0038] Figure 8 This is a schematic diagram of the graded recovery decision-making process in the steady-state stage in Embodiment 2 of the present invention.

[0039] Figure 9 This is a schematic diagram of the graded recovery decision-making process during the startup phase in Embodiment 2 of the present invention. Detailed Implementation

[0040] The relevant terms used in this invention are explained as follows: CPU: Central Processing Unit; APU: Auxiliary Power Unit; DSP: Digital Signal Processor; RAM: Random Access Memory; FPGA: Field-Programmable Gate Array; NVRAM: Non-Volatile Random Access Memory; CRC check: Cyclic Redundancy Check.

[0041] The APU system comprises four main parts: the core engine body, the power generation system, the control system, and the accessory system. Among these, the control system is closely related to this invention. The control system includes the APU controller, various analog signal sensors (speed sensors, temperature sensors, pressure sensors, etc.), and various actuators (starter, fuel solenoid valve, fuel servo valve, ignition actuator, anti-surge valve, etc.).

[0042] Extensive systematic analysis of APU controller hot restart and recovery issues revealed the following main shortcomings of existing controller hot restart and recovery technologies: Defect 1: Dynamic state is lost during runtime, and it is impossible to immediately restore the operating condition to the state before the failure.

[0043] Utilizing the characteristic that data in the DSP's internal RAM is lost upon power failure but not upon reset, it is typically only used to store data logs for troubleshooting or to determine cold / hot start categories. It does not store the system's dynamic state before the fault (such as the current state of the state machine, fuel servo valve drive current value, rotor speed, etc.). When the APU resets during steady-state operation (e.g., 100% speed), it can only restore the system to its initial standby state, unable to directly return to the operating state before the fault. This leads to control interruption, fuel supply interruption, and may cause the engine to stall or restart, severely impacting the system's continuous operation capability.

[0044] Defect 2: During the reset process, the peripheral register is cleared, causing the output to jump and triggering an actuator shock.

[0045] When a DSP chip undergoes a hardware reset, its on-chip peripheral registers (such as PWM output, GPIO status, and SPI communication interface) are automatically cleared or reset to their default values. Even if the software quickly reconfigures the peripherals after a reset, there is still an "output vacuum period" of several milliseconds to tens of milliseconds between the reset and the software rewriting, during which the actuator output may fluctuate. For APU control systems, the instantaneous zeroing of the fuel servo valve drive current can lead to fuel interruption, and the accidental closure of the fuel solenoid valve may cause engine stalling, impacting the mechanical actuator and potentially damaging the equipment in severe cases.

[0046] Defect 3: Failure to differentiate between different operating phases, and inappropriate recovery strategy during startup.

[0047] The entire operation of an APU controller includes different phases such as power-on, standby, start-up (which includes sub-phases such as ignition and speed acceleration), steady-state operation, cooling, and shutdown. Existing recovery methods do not differentiate between these phases, employing a uniform recovery strategy. For example, during start-up, directly restoring the fuel servo valve drive current value before the fault may lead to detonation or engine stalling due to incomplete ignition or speed mismatch; directly restoring the igniter state may disrupt the normal ignition timing. This "one-size-fits-all" recovery method poses certain safety hazards.

[0048] This invention first identifies two core pain points in existing technologies: "output jump caused by peripheral register reset" and "loss of dynamic state during runtime." To address the output jump problem, this invention proposes separating the output execution function from the digital signal processor (DSP) and assigning it to an independent hardware unit. This hardware unit maintains the output unchanged during DSP reset. To address the loss of dynamic state, this invention utilizes the segment allocation characteristics of the DSP compiler to allocate critical runtime variables to a data segment (.ebss) that is not initialized upon reset, thus achieving automatic variable retention.

[0049] Based on this, a differentiated recovery strategy based on the identification of the operation phase is designed for the special working mode of the APU controller. The recovery logic is deeply bound to the actual working phase of the APU (such as the start-up phase, steady-state operation phase, etc.), and the recovery is graded according to the degree of speed disturbance during the hot restart to ensure recovery.

[0050] Reference Figures 1 to 4 The restart and recovery system and method for the APU controller of the present invention will be further described.

[0051] Example 1

[0052] like Figures 1 to 5 As shown, the APU controller restart and recovery system in this embodiment includes: The digital signal processor (DSP) houses a running context data module, a data initialization and recovery module, an input processing module, a closed-loop control calculation module, a state machine module, an output processing module, a data backup module, and a watchdog feeding module. It is responsible for the state management and control algorithm calculation of the APU controller's restart and recovery system, as well as the state management, control algorithm calculation, and fault diagnosis of the entire APU system. The field-programmable gate array (FPGA) has a watchdog module, a data processing module, an input module, and an output module. It communicates with the digital signal processor (DSP) to latch the DSP's control instructions, monitor the DSP's operating status, and continuously drive the actuators. Non-volatile random access memory, which communicates with the digital signal processor and is used to periodically back up the data of the digital signal processor; The sensor, connected to the field-programmable gate array (FPGA), is used to acquire external data and store the acquired external data into the FPGA. The actuator is connected to the field-programmable gate array (FPGA) and is continuously driven by the FPGA to complete the corresponding execution action; When the digital signal processor is working normally, it writes the data of the current cycle to the non-volatile random access memory in each running cycle. When the APU controller performs a hot start or the digital signal processor experiences a power failure and restart, the digital signal processor reads the most recent valid backup data from the non-volatile random access memory and restores it.

[0053] Furthermore, the digital signal processor includes a central processing unit and a random access memory unit containing a .ebss storage area; The central processing unit (CPU) is used for logic calculations. It acquires external data collected by sensors from the field-programmable gate array (FPGA) via a communication bus and writes control commands to the FPGA. It periodically backs up the runtime context data in the random access memory (RAM) containing the .ebss storage area via a data backup bus. It periodically writes a "feed the dog" signal to the FPGA via a "feed the dog" signal line. If the FPGA does not receive the "feed the dog" signal in time, it resets the CPU via a reset signal line. The .ebss storage area in the RAM is used to store runtime context data. This .ebss storage area is not initialized when the digital signal processor (DSP) is reset, and the data is automatically retained. When the digital signal processor is working normally, it writes the data of the current cycle to the .ebss storage area and non-volatile random access memory in each running cycle. When the APU controller performs a hot start or the digital signal processor is restarted after a power failure, the digital signal processor reads the most recent valid backup data from the .ebss storage area or non-volatile random access memory in the random access memory and restores it.

[0054] Furthermore, the field-programmable gate array includes I / O registers, a watchdog timer, an input acquisition driver, and an output execution driver; The I / O registers are used to store external data acquired by the input acquisition driver through the sensor for the digital signal processor to read, latch the control instructions written by the digital signal processor, and continuously drive the actuator through the output execution driver; The watchdog timer is used to monitor the "feed the dog" signal periodically sent by the digital signal processor and to issue a central processing unit reset signal when the "feed the dog" timeout occurs. The input acquisition driver is used to interact with the sensor for data exchange; the output execution driver is used to interact with the actuator for data exchange. This field-programmable gate array has a power supply independent of the digital signal processor.

[0055] Furthermore, the sensors include a speed sensor and a temperature sensor, which are respectively connected to the input acquisition driver interface of the field-programmable gate array (FPGA); the FPGA continuously acquires external data and stores the acquired data in the I / O register, unaffected by the reset state of the digital signal processor. The actuator includes a starter fuel servo valve, a fuel solenoid valve, an igniter, and a starter. The starter fuel servo valve, fuel solenoid valve, igniter, and starter are respectively connected to the interface of the output execution drive of the field programmable gate array. The field programmable gate array continuously drives the actuator according to the output register value of the I / O register, and is not affected by the reset state of the digital signal processor.

[0056] Furthermore, the digital signal processor includes a central processing unit and a random access memory unit containing a .ebss storage area; the field-programmable gate array includes I / O registers, a watchdog timer, an input acquisition driver, and an output execution driver; the sensors include a speed sensor and a temperature sensor; the actuators include a starter fuel servo valve, a fuel solenoid valve, an igniter, and a starter. The central processing unit (CPU) is used for logic calculations. It acquires external data collected by speed and temperature sensors from the I / O registers of the field-programmable gate array (FPGA) via the SPI data communication bus, and writes control commands for the starter fuel servo valve current and fuel solenoid valve status to the FPGA's I / O registers. It also periodically backs up the runtime context data in the .ebss storage area of ​​the random access memory (RAM) to the non-volatile random access memory (RAM) via the RS485 data backup bus. Furthermore, it periodically writes a "feed" signal to the watchdog timer of the FPGA via a "feed" signal line. If the watchdog timer does not receive a "feed" signal in time, it resets the CPU via a reset signal line. The .ebss storage area in the RAM is used to store runtime context data; this area is not initialized when the digital signal processor (DSP) is reset, and the data is automatically retained. The I / O registers are used to store external data acquired by the input acquisition driver through the sensor for the digital signal processor (DSP) to read, latch the control instructions written by the DSP, and continuously drive the actuator through the output execution driver. The watchdog timer is used to monitor the "feed the watchdog" signal periodically sent by the DSP and to issue a central processing unit (CPU) reset signal when the "feed the watchdog" times out. The input acquisition driver is used to interact with the sensor; the output execution driver is used to interact with the actuator. This field-programmable gate array (FPGA) has a power supply independent of the DSP, and the I / O registers, input acquisition driver, and output execution driver remain unchanged during DSP reset. The speed sensor and temperature sensor are respectively connected to the input acquisition driver interface of the field-programmable gate array (FPGA); the FPGA continuously acquires external data through the speed sensor and temperature sensor and stores the acquired data in the I / O register, unaffected by the reset state of the digital signal processor. The starter fuel servo valve, fuel solenoid valve, igniter, and starter are connected to the interface of the output execution drive of the field programmable gate array (FPGA); the FPGA continuously drives the actuator according to the output register value of the I / O register, unaffected by the reset state of the digital signal processor. The non-volatile random access memory (NRAM) is connected to the digital signal processor (DSP) via an RS485 bus, periodically backing up the runtime context data in the .ebss storage area of ​​the NRAM. When the DSP is operating normally, it writes the current cycle's data to the NRAM each runtime cycle. When the APU controller performs a hot start or the DSP experiences a power failure restart, the DSP reads the most recent valid backup data from the NRAM and restores it. The central processing unit (CPU) periodically backs up the runtime context data in the .ebss storage area of ​​the NRAM via the RS485 data backup bus, including runtime phase identifiers, starter sub-phase identifiers, starter enable status, fuel servo valve drive current, fuel solenoid valve status, ignition actuator status, rotor speed, and checksum.

[0057] The working principle of the APU controller's restart and recovery system in this embodiment is as follows: When the digital signal processor (DSP) is working normally, the runtime context data module in the DSP writes the runtime context data generated by each module in each runtime cycle to the .ebss storage area of ​​the random access memory (RAM), and writes the data of the current cycle to the non-volatile random access memory (NRAM) through the data backup module. For example... Figure 2 As shown, when a power outage and restart occur, follow these steps to begin: Step S1: When the digital signal processor of the APU controller is reset, the data initialization and recovery module reads the running context data stored in the random access memory unit; Step S2: CRC check value recognition. The data initialization and recovery module recognizes the CRC check value in the running context data read from the random access unit. If the CRC check value is non-zero, proceed to step S3; if the CRC check value is zero, proceed to step S4. Step S3: CRC check. The data initialization and recovery module recalculates the CRC check value based on the running context data read from the random access memory unit. If the recalculated CRC check value matches the CRC check value read from the random access memory unit, the CRC check is successful, and step S8 is executed; if the recalculated CRC check value does not match the read CRC check value, the CRC check fails, and step S4 is executed. Step S4: The data initialization and recovery module reads the backed-up runtime context data from the non-volatile random access memory; Step S5: CRC check value identification. The data initialization and recovery module identifies the CRC check value in the runtime context data read from the non-volatile random access memory. If the CRC check value is identified as non-zero, proceed to step S6; if the CRC check value is identified as zero, proceed to step S9. Step S6: CRC check. The data initialization and recovery module recalculates the CRC check value based on the runtime context data read from the non-volatile random access memory. If the recalculated CRC check value matches the CRC check value read from the non-volatile random access memory, the CRC check is successful, and step S7 is executed. If the recalculated CRC check value does not match the CRC check value read from the non-volatile random access memory, the CRC check fails, and step S9 is executed. Step S7: The data initialization and recovery module writes the runtime context data in the non-volatile random access memory into the random access memory unit; Step S8: The data initialization and recovery module sets the hot-start flag in the runtime context data of the random access memory unit to 1 to perform a hot restart recovery; Step S9: The data initialization and recovery module clears the running context data of the random access memory unit and performs a cold restart recovery.

[0058] like Figure 3 As shown, the specific process of hot reboot recovery in step S8 is as follows: Step S81: The input processing module of the digital signal processor acquires the current actual rotational speed collected by the field programmable gate array from the speed sensor and calculates the current rotational speed percentage; the watchdog feeding module of the digital signal processor sends a feeding signal to the watchdog module of the field programmable gate array. Step S82: The state machine module of the digital signal processor reads the running stage identifier from the running context data in the random access memory unit; Step S83: If the operating phase is identified as the start-up phase, the closed-loop control module calculates the current fuel servo valve drive current according to the start-up phase recovery strategy, and sends the control command for the current fuel servo valve drive current to the field programmable gate array via the output processing module to control the actuator; if the operating phase is identified as the steady-state phase, the closed-loop control module calculates the current fuel servo valve drive current according to the steady-state phase recovery strategy, and sends the control command for the current fuel servo valve drive current to the field programmable gate array via the output processing module to control the actuator; if the operating phase is identified as other phases, the output processing module directly sets the starter enable state, fuel solenoid valve state, ignition exciter state, and fuel servo valve drive current to 0, and the field programmable gate array does not control the actuator. Step S84: The output processing module sets the warm start flag in the running context data module to 0, the running context data module writes the context data updated in this cycle to the .ebss storage area of ​​the random access memory, and the data backup module writes the context data updated in this cycle to the non-volatile random access memory for backup.

[0059] like Figure 4 As shown, the specific process by which the closed-loop control module calculates the current fuel servo valve drive current based on the start-up recovery strategy in step S83 is as follows: Step 8301: The closed-loop control module reads the start-up sub-stage identifier from the .ebss storage area in the random access memory unit; Step 8302: If the starting sub-stage is identified as the ignition stage, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. At the same time, the closed-loop control module directly uses the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit as the current fuel servo valve drive current. Step 8303: If the starting sub-stage is identified as the acceleration stage, the closed-loop control module calculates the speed disturbance amplitude based on the speed percentage stored in the .ebss storage area of ​​the random access unit and the current speed percentage calculated by the input processing module. Step 8304: If the calculated speed disturbance amplitude is less than or equal to the first speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module substitutes the current speed percentage calculated by the input processing module into the preset table of speed percentage and speed acceleration in the closed-loop control module, and calculates the current target speed acceleration through linear interpolation and extrapolation. The closed-loop control module substitutes the calculated speed disturbance amplitude into the preset table of speed disturbance amplitude and hot start interruption time coefficient in the closed-loop control module, and calculates the target speed acceleration through linear interpolation and extrapolation. The current hot-start interruption time coefficient is calculated. The closed-loop control module calculates the current actual speed acceleration using the current speed percentage calculated by the input processing module, the speed percentage stored in the .ebss memory area of ​​the random access memory, the current hot-start interruption time coefficient, and the sampling time. The closed-loop control module subtracts the current actual speed acceleration from the current target speed acceleration to obtain the current speed acceleration control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed acceleration control error, the speed acceleration control error stored in the .ebss memory area of ​​the random access memory, and the fuel servo valve drive current stored in the .ebss memory area of ​​the random access memory. The calculation formula is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T *KIACC* errSpeedAcc(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPACC is the proportional coefficient, KIACC is the integral coefficient, errSpeedAcc(k) is the current speed acceleration control error, errSpeedAcc(k - 1) is the speed acceleration control error stored in the .ebss storage area of ​​the random access unit, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit. If the calculated speed disturbance amplitude is greater than the first speed disturbance amplitude threshold preset in the closed-loop control module, but less than or equal to the second speed disturbance amplitude threshold preset in the closed-loop control module; the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module substitutes the calculated speed disturbance amplitude into the correspondence table between speed disturbance amplitude and hot start interruption time coefficient preset in the closed-loop control module, and calculates the current hot start interruption time coefficient through linear interpolation and extrapolation. The closed-loop control module calculates the current actual speed acceleration using the current speed percentage calculated by the input processing module, the speed percentage stored in the .ebss storage area of ​​the random access memory unit, the current hot start interruption time coefficient, and the sampling time. The closed-loop control module subtracts the current actual speed acceleration from the current target speed acceleration to obtain the current speed acceleration control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed acceleration control error and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T *KIACC* errSpeedAcc(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPACC is the proportional coefficient, KIACC is the integral coefficient, errSpeedAcc(k) is the current speed acceleration control error, errSpeedAcc(k - 1) is also the current speed acceleration control error, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit; Otherwise, the output processing module directly sets the starter enable state, fuel solenoid valve state, ignition actuator state, and fuel servo valve drive current to 0, and updates the running stage identifier to the parking stage. The field programmable gate array does not provide control output to the actuator.

[0060] like Figure 5 As shown, the specific process by which the closed-loop control module calculates the current fuel servo valve drive current based on the steady-state recovery strategy in step S83 is as follows: Step S8311: The closed-loop control module calculates the speed disturbance amplitude based on the speed percentage stored in the .ebss storage area of ​​the random access unit and the current speed percentage calculated by the input processing module; Step S8312: If the calculated speed disturbance amplitude is less than or equal to the third speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module subtracts the current speed percentage calculated by the input processing module from the target speed percentage preset in the closed-loop control module to obtain the current speed control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed control error, the speed control error stored in the .ebss storage area of ​​the random access memory unit, and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN*errSpeed(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPN is the proportional coefficient, KIN is the integral coefficient, errSpeed(k) is the current speed control error, errSpeed(k - 1) is the speed control error stored in the .ebss storage area of ​​the random access unit, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit. If the calculated speed disturbance amplitude is greater than the third speed disturbance amplitude threshold preset in the closed-loop control module, but less than or equal to the fourth speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module subtracts the current speed percentage calculated by the input processing module from the target speed percentage preset in the closed-loop control module to obtain the current speed control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed control error and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN*errSpeed(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPN is the proportional coefficient, KIN is the integral coefficient, errSpeed(k) is the current speed control error, errSpeed(k - 1) is also the current speed control error, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit; Otherwise, the output processing module directly sets the starter enable state, fuel solenoid valve state, ignition actuator state, and fuel servo valve drive current to 0, and updates the running stage identifier to the parking stage. The field programmable gate array does not provide control output to the actuator.

[0061] Example 2

[0062] like Figure 6 As shown: (I) System Architecture A reboot and recovery system for an APU controller includes an APU controller and peripheral components, wherein the APU controller contains the following modules: Digital Signal Processor (DSP): The DSP hardware module is the core hardware carrier for implementing the hot restart recovery method described in this invention, including software modules such as the runtime context data module, data initialization and recovery module, input processing module, closed-loop control calculation module, state machine module, output processing module, data backup module, and watchdog feeding module. (1) The runtime context data storage module periodically writes the runtime context data generated by each software module into the .ebss area of ​​the internal RAM and updates the CRC check code every time member data is written; (2) The data initialization and recovery module is used to read the runtime context data in the .ebss area of ​​the internal RAM or the runtime context data backed up in the NVRAM after the DSP is reset, and performs CRC check on the read runtime context data, and initializes the runtime context data and other data according to the check result; (3) The input processing module is used to obtain external sensor data collected from the FPGA and update the sensor parameters (speed percentage) in the runtime context data storage module; (4) The closed-loop control calculation module obtains the necessary parameters such as speed percentage from the .ebss area of ​​RAM, and uses the incremental PI algorithm to calculate the fuel servo valve drive current when performing closed-loop control of speed in the start-up acceleration sub-stage and steady-state stage, and updates the closed-loop control parameters (speed control error, speed acceleration control error) in the runtime context data storage module. (5) The state machine module is used to manage the APU system operation phases and switch between the various APU system operation phases such as power-on, standby, start-up, steady state, and shutdown. The start-up phase is further divided into the start-up ignition sub-phase and the start-up acceleration sub-phase. At the same time, the state parameters (operation phase identifier, start-up sub-phase identifier) ​​in the operation context data storage module are updated. (6) The output processing module is used to calculate the actuator control instructions to be output, including the starter enable state, fuel solenoid valve state, and ignition exciter state. These data are then transmitted to the FPGA for control output. At the same time, the actuator control parameters (starter enable state, fuel solenoid valve state, ignition exciter state, and fuel servo valve drive current) in the operation context data storage module are updated. (7) The data backup module is used to write the current cycle operation context data into NVRAM for backup. (8) The watchdog feeding module is used to periodically send a watchdog signal to the FPGA so that the FPGA can continuously monitor the working status of the DSP and reset the DSP after it runs away. Field Programmable Gate Array (FPGA): The FPGA hardware module is the core hardware carrier for maintaining output without jumps in the hot restart recovery method described in this invention, including a watchdog module, a data processing module, an input module, and an output module. (1) The watchdog module is used to monitor the "feed the watchdog" signal periodically sent by the DSP and to issue a DSP reset signal when the "feed the watchdog" timeout occurs; (2) The data processing module is used to store the external data collected by the input module through the sensor for the DSP to read, and to latch the control instructions written by the DSP, and to continuously drive the actuator through the output execution drive; (3) The input module is used to collect sensor data (speed sensor, temperature sensor) and perform signal conditioning; (4) The output module is used to output the control instructions received in the data processing module to the actuator (starter, fuel solenoid valve, fuel servo valve, ignition exciter). The field programmable gate array has a power supply independent of the digital signal processor, and the data processing module, input module, and output module remain unchanged during the digital signal processor reset.

[0063] Non-volatile random access memory (NVRAM): This hardware module is connected to the digital signal processor via an RS485 bus, receives the running context data periodically sent by the DSP data backup module, and provides the DSP with the most recent valid backup data when the DSP is reset, and performs data recovery judgment.

[0064] The peripheral components mainly include sensors and actuators, as detailed below: Sensors, including speed sensors and temperature sensors, are used. The speed sensors and temperature sensors are connected to the input acquisition driver interface of the field-programmable gate array (FPGA). The FPGA continuously acquires external data through the speed sensors and temperature sensors and stores the acquired data in I / O registers, unaffected by the reset state of the digital signal processor.

[0065] The actuators include a starter fuel servo valve, a fuel solenoid valve, an igniter, and a starter motor. The starter fuel servo valve, fuel solenoid valve, igniter, and starter motor are each connected to the interface of the output actuator of a field-programmable gate array (FPGA). The FPGA continuously drives the actuators according to the output register values ​​of the I / O registers, unaffected by the reset state of the digital signal processor.

[0066] (ii) Runtime context data structure (stored in the .ebss segment, backed up in NVRAM) The runtime context data structure used in a hot restart recovery method for an APU controller includes the following fields: 1. Warm Start Flag: Indicates that the system has entered the warm start state. 0 indicates exiting the warm start state, and 1 indicates entering the warm start state.

[0067] 2. Operation phase identifier: Identifies the current operation phase, including power-on phase, standby phase, start-up phase, steady state phase, and shutdown phase.

[0068] 3. Starting sub-stage identification: The starting stage is subdivided into the ignition sub-stage and the speed acceleration sub-stage.

[0069] 4. Speed ​​control error errSpeed: The difference between the current actual speed and the target speed.

[0070] 5. Rotational speed acceleration control error errSpeedAcc: The difference between the current actual collected rotational speed acceleration and the target rotational speed acceleration.

[0071] 6. Rotational Speed ​​Percentage IN: The percentage value calculated by dividing the currently collected APU rotor rotational speed frequency value by the rotational speed frequency value under rated power.

[0072] 7. Fuel servo valve drive current FuelCmd: Current fuel servo valve drive current.

[0073] 8. Fuel Valve State: The on / off state of the fuel solenoid valve. 0 means the valve is closed, and 1 means the valve is open.

[0074] 9. IgniteState: Ignite exciter on / off state, 0 for no ignition, 1 for ignition.

[0075] 10. Starter Enabled Status: Starter enable status, 0 means disabled, 1 means enabled.

[0076] 11. CRC checksum crcValue: The value obtained by calculating the above data according to the CRC checksum algorithm, used to determine the availability of this context data structure.

[0077] (III) FPGA and DSP collaborative hot restart recovery mechanism like Figure 7 As shown, when the DSP is reset, the specific execution steps of the system are as follows: Step S101: DSP reset.

[0078] Step S102: The DSP data initialization and recovery module reads the runtime context data in the .ebss segment of RAM and performs CRC data verification; Step S103: If the CRC check value is not 0, proceed to step S104; if the CRC check value is 0, proceed to step S106. Step S104: If the CRC check is successful, proceed to step S105; if it fails, proceed to step S106. Step S105: Set the warm start flag in .ebss to 1, and perform system initialization and data initialization according to the warm start procedure, that is, the data in ebss will not be cleared; Step S106: Read the backup data from NVRAM; Step S107: If the CRC check value is not 0, proceed to step S112; if the CRC check value is 0, proceed to step S110. Step S108: If the CRC check is successful, proceed to step S109; if it fails, proceed to step S110. Step S109: Write the backed-up runtime context data in NVRAM to .ebss for use in subsequent hot reboots to restore the system state; Step S110: Perform system initialization and data initialization according to the cold start procedure, that is, clear the data in ebss; Step S111: The DSP input processing module acquires the sensor data collected by the FPGA and calculates the rotational speed percentage; Step S112: The DSP state machine module reads the warm start identifier and running stage identifier from the running context data in the .ebss storage area; Step S113: If the warm start flag is 1, it means that the system state recovery strategy needs to be executed, and step S114 is executed; if the warm start flag is not 1, it means that the system has completed initialization by cold start and there is no need to execute the system state recovery strategy, and step S119 is executed. Step S114: If the running phase is identified as a steady state phase, then execute S115; otherwise, execute S116. Step S115: The DSP closed-loop control module restores the control parameters according to the steady-state recovery process. See details. Figure 3 ; Step S116: If the running phase is identified as the startup phase, then execute S117; otherwise, execute S118. Step S117: The DSP closed-loop control module restores the control parameters according to the startup phase recovery procedure. See details. Figure 9 ; Step S118: The DSP state machine module uses the run phase identifier in the .ebss run context data as the current run phase; Step S119: The DSP state machine module performs state management according to the normal working mode; Step S120: The DSP closed-loop control module calculates the closed-loop control output command according to the normal operating mode; Step S121: The DSP output processing module sets the hot start flag to 0 and sends the calculated control command to the FPGA for control output; Step S122: The DSP runs the context data storage module to write the context data updated in this cycle into the .ebss area, which will serve as the source of .ebss data for each module in the next cycle. Step S123: The DSP data backup module writes the context data updated in this cycle into NVRAM for backup; Step S123: The DSP watchdog feeding module sends a feeding signal to the FPGA.

[0079] (iv) Three-level recovery strategy for hot start based on operating status Figure 8 The diagram shown is a flowchart of a graded recovery decision-making process for the steady-state stage provided in an embodiment of the present invention, which includes the following steps: • Step S201: Read the saved speed percentage INsaved, previous cycle fuel servo valve drive current OFuelCmdsaved, and previous cycle speed error errSpeedsaved from .ebss. • Step S202: Obtain the current actual rotational speed percentage INcurrent, which was read from the FPGA and calculated in the previous step; Step S203: Calculate the rotational speed disturbance amplitude ΔN = |INsaved − INcurrent|; • Step S204: Determine whether ΔN ≤ εN1 is true. If true, proceed to step S205; if false, proceed to step S206. • Step S205 (Level 1 Recovery): Set OFuelCmd(k−1) = OFuelCmdsaved, errSpeed(k−1) = errSpeedsaved, and execute step S209; • Step S206: Determine whether εN1<ΔN ≤εN2 is true. If true, proceed to step S207; if false, proceed to step S208. • Step S207 (Secondary Recovery): Set OFuelCmd(k−1) = OFuelCmdsaved, errSpeed(k−1) = INtarget - INcurrent, and execute step S209; • Step S208 (Level 3 Recovery): Exit fuel closed-loop control, set fuel servo valve drive current OFuelCmd(k) to 0, set fuel solenoid valve status to 0, set running status to stop status, and return; Step S209: Calculate the current speed control error errSpeed(k) = INtarget − INcurrent; Step S210: Calculate the incremental PI output fuel servo valve drive current OFuelCmd according to formula (1) and return.

[0080] In the above steps, in this embodiment 2, εN1 and εN2 are both preset thresholds in the closed-loop control module, with εN1 set to 1% and εN2 set to 5%.

[0081] The formula (1) mentioned in step S210 is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN*errSpeed(k) + OFuelCmd(k - 1) Formula (1) Where KPN and KIN are the proportional coefficient and integral coefficient, respectively; errSpeed ​​is the difference between the target speed and the actual speed; OFuelCmd is the output current of the fuel servo valve; k represents the parameter of the current cycle; k-1 represents the parameter of the previous cycle; and T is the sampling time.

[0082] Figure 9 The diagram shown is a flowchart of the graded recovery decision-making process during the startup phase provided by an embodiment of the present invention, which includes the following steps: Step S301: Read the start sub-stage identifier from .ebss; Step S302: Determine whether the starting sub-stage identifier is the ignition stage; if yes, proceed to step S303; if no, proceed to step S304. Step S303 (Ignition Sub-stage Recovery): The fuel servo valve drive current is set to the saved fuel servo valve drive current OFuelCmdsaved, the state of the fuel solenoid valve and ignition actuator is maintained, and the process returns. Step S304: Determine that the current phase is the acceleration phase, and read the saved speed percentage INsaved, the fuel servo valve drive current OFuelCmdsaved from .ebss, and the speed acceleration control error errSpeedAccsaved from the previous cycle. Step S305: Obtain the current actual rotational speed percentage INcurrent read from the FPGA in the previous step; Step S306: Calculate the rotational speed disturbance amplitude ΔN = |INsaved − INcurrent|; Step S307: Determine whether ΔN ≤ εacc1 is true; if true, proceed to step S308; if false, proceed to step S309. Step S308 (Accelerating Sub-stage Level 1 Recovery): Set OFuelCmd(k−1) = OFuelCmdsaved, errSpeedAcc(k−1) = errSpeedAccsaved, and execute step S312; Step S309: Determine whether εacc1 < ΔN < ≤ εacc2 is true; if true, proceed to step S310; if false, proceed to step S311. Step S310 (Accelerating the secondary recovery of the sub-stage): Set OFuelCmd(k−1) = OFuelCmdsaved, set errSpeedAcc(k−1) = NAcctarget − NAccactual, and execute step S312; Step S311 (Acceleration Sub-stage Level 3 Recovery): Exit fuel closed-loop control, set fuel servo valve drive current OFuelCmd(k) to 0, set fuel solenoid valve status to 0, set running status to stop status, and return; Step S312: Calculate the actual acceleration NAccactual according to formula (2), and calculate the current target acceleration NAcctarget according to formula (3); Step S313: Calculate the current acceleration error errSpeedAcc(k) = NAcctarget −NAccactual; Step S314: Calculate the incremental PI output fuel servo valve drive current OFuelCmd according to formula (4) and return.

[0083] In the above steps, εacc1 and εacc2 are both preset thresholds in the closed-loop control module. In this embodiment, εacc1 can be 2% and εacc2 can be 8%. In the figure, each judgment node is represented by a diamond, the execution node is represented by a rectangle, and the flow direction is indicated by an arrow.

[0084] Formula (2) mentioned is as follows: NAccactual = (INcurrent − INsaved ) / (n * T) Formula (3) is as follows: NAcctarget = LookupAcc(INcurrent) Formula (4) is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T *KIACC* errSpeedAcc(k) + OFuelCmd(k - 1) In formula (2), NAccactual is the actual speed acceleration, INcurrent and INsaved are the current actual speed percentage and the speed percentage before hot start saved in .ebss, respectively, T is the sampling period, and n is the hot start interruption time coefficient (the value of n is the value calculated by interpolating or extrapolating the speed disturbance amplitude into a preset interpolation table of speed disturbance amplitude and hot start interruption time coefficient in the closed loop control module). In formula (3), LookupAcc means to look up a table, that is, to establish an interpolation table of speed and speed acceleration during the starting and acceleration process based on the actual situation of the control system, and to calculate the speed acceleration through linear interpolation and extrapolation. In formula (4), KPACC and KIACC are the proportional coefficient and integral coefficient, respectively; errSpeedAcc is the difference between the target speed acceleration and the actual speed acceleration; OFuelCmd is the output current of the fuel servo valve; k represents the parameter of the current cycle; k-1 represents the parameter of the previous cycle; and T is the sampling time.

[0085] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. It should be noted that any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A reboot and recovery system for an APU controller, characterized in that: It includes: The digital signal processor (DSP) houses a running context data module, a data initialization and recovery module, an input processing module, a closed-loop control calculation module, a state machine module, an output processing module, a data backup module, and a watchdog feeding module. It is responsible for the state management and control algorithm calculation of the APU controller's restart and recovery system, as well as the state management, control algorithm calculation, and fault diagnosis of the entire APU system. The field-programmable gate array (FPGA) has a watchdog module, a data processing module, an input module, and an output module. It communicates with the digital signal processor (DSP) to latch the DSP's control instructions, monitor the DSP's operating status, and continuously drive the actuators. Non-volatile random access memory, which communicates with the digital signal processor and is used to periodically back up the data of the digital signal processor; The sensor, connected to the field-programmable gate array (FPGA), is used to acquire external data and store the acquired external data into the FPGA. The actuator is connected to the field-programmable gate array (FPGA) and is continuously driven by the FPGA to complete the corresponding execution action; When the digital signal processor is working normally, it writes the data of the current cycle to the non-volatile random access memory in each running cycle; when the APU controller performs a hot start or the digital signal processor experiences a power failure restart, the digital signal processor reads the most recent valid backup data from the non-volatile random access memory and restores it. The digital signal processor includes a central processing unit and a random access memory unit containing a .ebss storage area; the field-programmable gate array includes I / O registers, a watchdog timer, an input acquisition driver, and an output execution driver; the sensors include a speed sensor and a temperature sensor; the actuators include a starter fuel servo valve, a fuel solenoid valve, an igniter, and a starter; The central processing unit (CPU) is used for logical calculations. It acquires external data collected by speed and temperature sensors from the I / O registers of the field-programmable gate array (FPGA) via a data communication bus, and writes control commands for the starter fuel servo valve current and fuel solenoid valve status to the FPGA's I / O registers. It also periodically backs up the runtime context data in the .ebss storage area of ​​the random access memory (RAM) via a data backup bus. Furthermore, it periodically writes a "feed" signal to the watchdog timer of the FPGA via a "feed" signal line. If the watchdog timer does not receive a "feed" signal in time, it resets the CPU via a reset signal line. The .ebss storage area in the RAM is used to store runtime context data; this area is not initialized when the digital signal processor (DSP) is reset, and the data is automatically retained. The I / O registers are used to store external data acquired by the input acquisition driver through the sensor for the digital signal processor (DSP) to read, latch the control instructions written by the DSP, and continuously drive the actuator through the output execution driver. The watchdog timer is used to monitor the "feed the watchdog" signal periodically sent by the DSP and to issue a central processing unit (CPU) reset signal when the "feed the watchdog" times out. The input acquisition driver is used to interact with the sensor; the output execution driver is used to interact with the actuator. This field-programmable gate array (FPGA) has a power supply independent of the DSP, and the I / O registers, input acquisition driver, and output execution driver remain unchanged during DSP reset. The speed sensor and temperature sensor are respectively connected to the input acquisition driver interface of the field-programmable gate array (FPGA); the FPGA continuously acquires external data through the speed sensor and temperature sensor and stores the acquired data in the I / O register, unaffected by the reset state of the digital signal processor. The starter fuel servo valve, fuel solenoid valve, igniter, and starter are connected to the interface of the output execution drive of the field programmable gate array (FPGA); the FPGA continuously drives the actuator according to the output register value of the I / O register, unaffected by the reset state of the digital signal processor. The non-volatile random access memory is connected to the digital signal processor via a data backup bus, and periodically backs up the runtime context data in the .ebss storage area of ​​the random access memory unit; When the digital signal processor is working normally, it writes the data of the current cycle to the non-volatile random access memory in each running cycle. When the APU controller performs a hot start or the digital signal processor experiences a power failure and restart, the digital signal processor reads the most recent valid backup data from the non-volatile random access memory and restores it.

2. The APU controller restart and recovery system according to claim 1, characterized in that: The central processing unit periodically backs up the running context data in the .ebss storage area of ​​the random access memory (RAM) to the non-volatile random access memory via the data backup bus. This data includes running phase identifier, start-up sub-phase identifier, starter enable status, fuel servo valve drive current, fuel solenoid valve status, ignition actuator status, speed percentage, hot start identifier, speed control error, speed acceleration control error, and checksum.

3. The restart and recovery method for the APU controller restart and recovery system according to any one of claims 1 to 2, characterized in that: The restart and recovery system includes a digital signal processor (DSP), a field-programmable gate array (FPGA), a non-volatile random access memory (NRAM), sensors, and actuators. The DSP hosts a runtime context data module, a data initialization and recovery module, an input processing module, a closed-loop control calculation module, a state machine module, an output processing module, a data backup module, and a watchdog timer feeding module. The FPGA hosts a watchdog timer module, a data processing module, an input module, and an output module. The restart and recovery method includes the following steps: Step S1: When the digital signal processor of the APU controller is reset, the data initialization and recovery module reads the running context data stored in the random access memory. Step S2: CRC check value recognition. The data initialization and recovery module recognizes the CRC check value in the running context data read from the random access unit. If the CRC check value is non-zero, proceed to step S3; if the CRC check value is zero, proceed to step S4. Step S3: CRC check. The data initialization and recovery module recalculates the CRC check value based on the running context data read from the random access memory unit. If the recalculated CRC check value matches the CRC check value read from the random access memory unit, the CRC check is successful, and step S8 is executed; if the recalculated CRC check value does not match the read CRC check value, the CRC check fails, and step S4 is executed. Step S4: The data initialization and recovery module reads the backed-up runtime context data from the non-volatile random access memory; Step S5: CRC check value identification. The data initialization and recovery module identifies the CRC check value in the runtime context data read from the non-volatile random access memory. If the CRC check value is identified as non-zero, proceed to step S6; if the CRC check value is identified as zero, proceed to step S9. Step S6: CRC check. The data initialization and recovery module recalculates the CRC check value based on the runtime context data read from the non-volatile random access memory. If the recalculated CRC check value matches the CRC check value read from the non-volatile random access memory, the CRC check is successful, and step S7 is executed. If the recalculated CRC check value does not match the CRC check value read from the non-volatile random access memory, the CRC check fails, and step S9 is executed. Step S7: The data initialization and recovery module writes the runtime context data in the non-volatile random access memory into the random access memory unit; Step S8: The data initialization and recovery module sets the hot-start flag in the runtime context data of the random access memory unit to 1 to perform a hot restart recovery; Step S9: The data initialization and recovery module clears the running context data of the random access memory unit and performs a cold restart recovery.

4. The restart and recovery method according to claim 3, characterized in that: The specific process of hot reboot recovery in step S8 is as follows: Step S81: The watchdog feeding module of the digital signal processor sends a feeding signal to the watchdog module of the field programmable gate array; the input processing module of the digital signal processor obtains the current actual speed collected by the field programmable gate array from the speed sensor and calculates the current speed percentage. Step S82: The state machine module of the digital signal processor reads the running stage identifier from the running context data in the random access memory unit; Step S83: If the operation phase is identified as the start-up phase, the closed-loop control module calculates the current fuel servo valve drive current according to the start-up phase recovery strategy, and sends the control command of the current fuel servo valve drive current to the field programmable gate array via the output processing module to control the actuator output. If the operation phase is identified as a steady-state phase, the closed-loop control module calculates the current fuel servo valve drive current according to the steady-state phase recovery strategy, and sends the control command of the current fuel servo valve drive current to the field programmable gate array via the output processing module to control the actuator output. If the operation phase is identified as another phase, the output processing module will directly set the fuel servo valve drive current, starter enable status, fuel solenoid valve status, and ignition exciter status to 0, and the field programmable gate array will not control the actuator output. Step S84: The output processing module sets the warm start flag in the running context data module to 0, the running context data module writes the context data updated in this cycle to the .ebss storage area of ​​the random access memory, and the data backup module writes the context data updated in this cycle to the non-volatile random access memory for backup.

5. The restart and recovery method according to claim 4, characterized in that: The specific process by which the closed-loop control module calculates the current fuel servo valve drive current based on the start-up recovery strategy in step S83 is as follows: Step 8301: The closed-loop control module reads the start sub-stage identifier from the .ebss storage area in the random access memory unit; Step 8302: If the starting sub-stage is identified as the ignition stage, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. At the same time, the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit is directly used as the current fuel servo valve drive current. Step 8303: If the starting sub-stage is identified as the acceleration stage, the closed-loop control module calculates the speed disturbance amplitude based on the speed percentage stored in the .ebss storage area of ​​the random access unit and the current speed percentage calculated by the input processing module. Step 8304: If the calculated speed disturbance amplitude is less than or equal to the first speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module substitutes the current speed percentage calculated by the input processing module into the preset table of speed percentage and speed acceleration in the closed-loop control module, and calculates the current target speed acceleration through linear interpolation and extrapolation. The closed-loop control module substitutes the calculated speed disturbance amplitude into the preset table of speed disturbance amplitude and hot start interruption time coefficient in the closed-loop control module, and calculates the target speed acceleration through linear interpolation and extrapolation. The current hot-start interruption time coefficient is calculated. The closed-loop control module calculates the current actual speed acceleration using the current speed percentage calculated by the input processing module, the speed percentage stored in the .ebss memory area of ​​the random access memory, the current hot-start interruption time coefficient, and the sampling time. The closed-loop control module subtracts the current actual speed acceleration from the current target speed acceleration to obtain the current speed acceleration control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed acceleration control error, the speed acceleration control error stored in the .ebss memory area of ​​the random access memory, and the fuel servo valve drive current stored in the .ebss memory area of ​​the random access memory. The calculation formula is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T * KIACC*errSpeedAcc(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPACC is the proportional coefficient, KIACC is the integral coefficient, errSpeedAcc(k) is the current speed acceleration control error, errSpeedAcc(k - 1) is the speed acceleration control error stored in the .ebss storage area of ​​the random access unit, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit. If the calculated speed disturbance amplitude is greater than the first speed disturbance amplitude threshold preset in the closed-loop control module, but less than or equal to the second speed disturbance amplitude threshold preset in the closed-loop control module; the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module substitutes the calculated speed disturbance amplitude into the correspondence table between speed disturbance amplitude and hot start interruption time coefficient preset in the closed-loop control module, and calculates the current hot start interruption time coefficient through linear interpolation and extrapolation. The closed-loop control module calculates the current actual speed acceleration using the current speed percentage calculated by the input processing module, the speed percentage stored in the .ebss storage area of ​​the random access memory unit, the current hot start interruption time coefficient, and the sampling time. The closed-loop control module subtracts the current actual speed acceleration from the current target speed acceleration to obtain the current speed acceleration control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed acceleration control error and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPACC * (errSpeedAcc(k) - errSpeedAcc(k - 1) ) + T * KIACC*errSpeedAcc(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPACC is the proportional coefficient, KIACC is the integral coefficient, errSpeedAcc(k) is the current speed acceleration control error, errSpeedAcc(k - 1) is also the current speed acceleration control error, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit; Otherwise, the output processing module directly sets the starter enable state, fuel solenoid valve state, ignition exciter state, and fuel servo valve drive current to 0, and updates the running stage identifier to the parking stage. The field programmable gate array does not provide control output to the actuator.

6. The restart and recovery method according to claim 4, characterized in that: The specific process by which the closed-loop control module calculates the current fuel servo valve drive current based on the steady-state recovery strategy in step S83 is as follows: Step S8311: The closed-loop control module calculates the speed disturbance amplitude based on the speed percentage stored in the .ebss storage area of ​​the random access unit and the current speed percentage calculated by the input processing module; Step S8312: If the calculated speed disturbance amplitude is less than or equal to the third speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module subtracts the current speed percentage calculated by the input processing module from the target speed percentage preset in the closed-loop control module to obtain the current speed control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed control error, the speed control error stored in the .ebss storage area of ​​the random access memory unit, and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN* errSpeed(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPN is the proportional coefficient, KIN is the integral coefficient, errSpeed(k) is the current speed control error, errSpeed(k - 1) is the speed control error stored in the .ebss storage area of ​​the random access unit, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit. If the calculated speed disturbance amplitude is greater than the third speed disturbance amplitude threshold preset in the closed-loop control module, but less than or equal to the fourth speed disturbance amplitude threshold preset in the closed-loop control module, the closed-loop control module sends the starter enable state, fuel solenoid valve state, and ignition exciter state stored in the random access memory unit to the field programmable gate array via the output processing module. Simultaneously, the closed-loop control module subtracts the current speed percentage calculated by the input processing module from the target speed percentage preset in the closed-loop control module to obtain the current speed control error. The closed-loop control module then calculates the current fuel servo valve drive current based on the current speed control error and the fuel servo valve drive current stored in the .ebss storage area of ​​the random access memory unit. The calculation formula is as follows: OFuelCmd(k) = KPN * (errSpeed(k) - errSpeed(k - 1) ) + T * KIN* errSpeed(k) + OFuelCmd(k - 1) Where OFuelCmd(k) is the current fuel servo valve drive current, KPN is the proportional coefficient, KIN is the integral coefficient, errSpeed(k) is the current speed control error, errSpeedA(k - 1) is also the current speed control error, and OFuelCmd(k - 1) is the fuel servo valve drive current stored in the .ebss storage area of ​​the random access unit; Otherwise, the output processing module directly sets the starter enable status, fuel solenoid valve status, ignition exciter status, and fuel servo valve drive current to 0, and updates the running stage identifier to the parking stage. The field programmable gate array does not provide control output to the actuator.

Images