Ethercat master station redundant networking system and abnormal recovery method thereof

Abstract

The application provides an EtherCAT master station redundant networking system and an abnormality recovery method thereof, the system comprising an EtherCAT master station controller, a message transceiving circuit, an abnormality detection circuit and a state machine control circuit, the master station controller having a first Ethernet port and a second Ethernet port, and being connected to two ends of a slave station network to form a ring topology. In the redundant networking mode, functional messages are sent out through the first port and received through the second port, and heartbeat messages are sent out through the second port and received through the first port. The abnormality detection circuit identifies the abnormality type based on the link state signal and the heartbeat message receiving condition, and the state machine control circuit performs state jumping and switches the message forwarding path according to the abnormality type. The heartbeat message sending interval is 1 microsecond, and the abnormality detection and state switching are completed by hardware logic. The application realizes the abnormality detection and recovery of the redundant networking by hardware, the response speed reaches the microsecond level, and the reliability and real-time performance of the EtherCAT communication network are improved.

Description

Technical Field

[0001] This invention belongs to the field of industrial Ethernet communication technology, and in particular relates to a redundant networking system for an EtherCAT master controller and its automatic recovery method in the event of network anomalies. Background Technology

[0002] EtherCAT (Ethernet for Control Automation Technology) is a real-time Ethernet communication protocol widely used in industrial control systems. Its master station equipment plays a crucial role in communication scheduling and control in industrial control systems, and the communication reliability of the EtherCAT master station directly affects the stability of the entire industrial control system.

[0003] Traditional EtherCAT master stations typically employ a single-port communication architecture. The EtherCAT master connects to the slave network via only one Ethernet port, forming a linear or tree topology, relying solely on a single physical link for message transmission and reception. Damaged network cables, poor port connections, or failures of intermediate slave nodes can directly interrupt the entire bus communication, causing equipment downtime. This exhibits a serious single point of failure defect and cannot meet the 24 / 7 uninterrupted production requirements of industries such as metallurgy, lithium batteries, semiconductor equipment, and large-scale automated production lines. In this architecture, a link interruption or a slave node failure can paralyze the entire communication network, as the system lacks an effective redundancy mechanism to ensure communication continuity.

[0004] To improve communication reliability, some existing technical solutions support a dual-port communication architecture for the EtherCAT master station. This is achieved by connecting the master station's two ports to opposite ends of the slave station's network to form a ring topology, thus providing cable redundancy. However, these existing solutions largely rely on software for network anomaly detection and recovery. Specifically, when a network anomaly occurs, a software protocol stack running on the processor detects changes in network status through polling or interrupts, then software logic determines the anomaly type and executes corresponding recovery operations. This software-based anomaly detection and recovery mechanism has the following drawbacks: First, the response speed is slow. Software-level anomaly detection relies on the operating system's scheduling and interrupt response. From the occurrence of an anomaly to detection and the execution of recovery actions, it usually takes milliseconds or even longer, which is difficult to meet the stringent requirements of microsecond-level real-time performance in the field of industrial automation.

[0005] Second, it has poor reliability. The software implementation is easily affected by factors such as operating system load, task scheduling delay, and interrupt priority conflicts, which may lead to detection lag or recovery failure under extreme conditions.

[0006] Third, the software complexity is high. Implementing redundant logic and exception handling mechanisms in software increases the complexity and development difficulty of the protocol stack, as well as the operational burden on the software, which is detrimental to the long-term stable operation of the system.

[0007] Fourth, the anomaly localization is inaccurate. Existing solutions typically lack fine-grained differentiation of anomaly types, making it difficult to accurately determine whether the fault occurs at the master station port or the slave node, which brings difficulties to on-site maintenance and troubleshooting.

[0008] Therefore, there is an urgent need in this field for a technical solution that can realize the redundant networking communication function of EtherCAT master station through hardware circuits, so as to achieve rapid detection, accurate location and automatic recovery of communication network anomalies, while reducing the dependence on software and improving the real-time performance, reliability and maintainability of the system. Summary of the Invention

[0009] The purpose of this invention is to provide an EtherCAT master station redundant networking system and its anomaly recovery method, solving the problems of slow response speed, poor reliability, high software complexity, and inaccurate anomaly location caused by the reliance on software implementation for anomaly detection and recovery in existing EtherCAT master station redundant networking schemes. The aim is to achieve redundant networking communication functions through hardware circuitry, possessing the functions of anomaly detection, communication topology update, and communication recovery of the communication network, without affecting the normal transmission and reception of EtherCAT messages during this process.

[0010] This invention is implemented as follows: an EtherCAT master station redundant networking system, the EtherCAT master station redundant networking system comprising... The EtherCAT master controller includes a first Ethernet port and a second Ethernet port. The first Ethernet port and the second Ethernet port are respectively used to connect the two ends of the EtherCAT slave network to form a ring network topology. The ring communication link is constructed through the physical connection of the two network ports, which provides a physical layer redundancy basis for EtherCAT communication. When the link in one direction is interrupted, the message can reach the slave from the other direction, thereby avoiding the paralysis of the entire network due to a single physical disconnection. The message transceiver circuit is configured to, in redundant networking mode, send functional messages through the first Ethernet port and receive the functional messages through the second Ethernet port, and send heartbeat messages through the second Ethernet port and receive the heartbeat messages through the first Ethernet port; this enables the separate transmission and cross-reception of functional messages and heartbeat messages between the two network ports, so that functional messages and heartbeat messages form independent bidirectional detection channels—functional messages are used to carry control commands and process data, and heartbeat messages are used to continuously detect network connectivity. The two paths are opposite, thereby ensuring that any link anomaly in either direction can be detected in a timely manner, while ensuring that the normal transmission and reception of functional messages are not affected by the transmission of heartbeat messages; The anomaly detection circuit is configured to detect network anomaly types based on the link status signals of the first Ethernet port, the link status signals of the second Ethernet port, and the reception status of the heartbeat messages. By monitoring the physical layer link status (Link signal) and the reception status of the data link layer heartbeat messages in real time through hardware circuitry, the anomaly type can be accurately identified within microseconds without software intervention, providing a reliable trigger signal for the rapid transition of the subsequent state machine and avoiding detection delays caused by software polling or interruption responses. The state machine control circuit is configured to switch between multiple redundant states based on the detection results of the anomaly detection circuit, and control the message transceiver circuit to switch message forwarding paths based on the current state. The redundant network state switching logic is solidified through the hardware state machine, and topology reconstruction and message path switching are automatically performed according to the anomaly type. Communication recovery can be completed without CPU intervention, ensuring the determinism and high speed of state switching. At the same time, the current network state code is provided to the software through the state register, enabling the software to perceive network state changes as needed and adjust parameters such as the synchronization clock.

[0011] A further technical solution of the present invention is that the abnormality types include a first Ethernet port disconnection abnormality, a second Ethernet port disconnection abnormality, and a slave node abnormality; When the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port is valid, it is determined that the slave node is abnormal. Through the dual verification of the heartbeat message receiving location and the link signal, the abnormality of the slave node and the abnormality of the master port can be accurately distinguished. If Port1 receives the heartbeat message but Port0 link is valid, it means that the abnormality occurs in the intermediate node of the network rather than the master port, thereby avoiding the intermediate node failure being mistakenly judged as the master port failure, and providing accurate fault location basis for on-site maintenance personnel. When the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port fails, it is determined that the first Ethernet port is disconnected abnormally; when Port1 receives the heartbeat message and the link of Port0 fails, it indicates that the function message can no longer be sent from Port0, and the communication path must be switched to Port1 immediately to prevent the control command from being interrupted and to ensure that the system can still maintain communication after the physical disconnection of Port0. When the link status of the second Ethernet port fails, it is determined that the second Ethernet port is offline and abnormal. The failure of the Port1 link means that heartbeat messages cannot be sent and function messages cannot be received from Port1. At this time, communication can be restored simply by switching the receiving path of function messages back to Port0, without performing complex topology reconstruction, which simplifies the recovery process and reduces recovery time.

[0012] A further technical solution of the present invention is: the state machine control circuit is configured to control the state machine to have at least the following states: non-redundant networking state, redundant networking state, first port abnormal state, second port abnormal state, and slave node abnormal state; by mapping different abnormal scenarios to independent hardware states, each state corresponds to a set of preset message forwarding path configurations, so that the message transceiver circuit can complete the path switching within a single clock cycle after the state transition, and each state provides a corresponding state code to the software, which facilitates the software to synchronously update the distributed clock parameters.

[0013] A further technical solution of the present invention is that the state machine also has an emergency processing state; When the anomaly detection circuit detects an anomaly in the slave node or a disconnection anomaly in the first Ethernet port, the state machine control circuit controls the state machine to first jump to the emergency processing state. In the emergency processing state, the message transceiver circuit resends synchronization messages. Then, the state machine control circuit controls the state machine to jump to the corresponding anomaly state according to the link status of the first Ethernet port. When anomaly 1 or anomaly 2 is detected, the network topology is about to change, and the slave may lose synchronization messages due to path switching. By setting the emergency processing state as a transition state, synchronization messages are resent first before topology reconstruction, ensuring that the slave does not report errors or stop due to synchronization loss during topology switching, achieving a seamless transition when anomalies occur, and ensuring the stable operation of the control system.

[0014] A further technical solution of the present invention is as follows: When the first port is in an abnormal state, if the first Ethernet port is reconnected, the state machine jumps to the abnormal state of the slave node; when Port0 recovers from the disconnected state, since there may still be slave node failures (original abnormal 1) in the network, the system first enters the abnormal state of the slave node to troubleshoot intermediate node failures, so as to avoid missing the confirmation of intermediate node status due to directly jumping back to the redundant networking state, and ensure that the network is fully restored before entering the full redundancy working mode; If the second Ethernet port reconnects when the second port is in an abnormal state, the state machine will jump to the abnormal state of the slave node. After Port1 recovers, the intermediate node status must be confirmed first. The same processing logic as that used for Port0 recovery is adopted to ensure the consistency of the recovery mechanisms at both ends and reduce the complexity of the state machine design. If all slave nodes recover to normal under abnormal conditions, the state machine will switch to the redundant network state. When all slave nodes reconnect to the network, the system will automatically restore to the complete ring redundant topology, restore the bidirectional cross-transmission of function messages and heartbeat messages, and realize fully automatic network self-healing.

[0015] A further technical solution of the present invention is as follows: In the redundant networking state: the function message is sent through the first Ethernet port, forwarded by the EtherCAT slave station, and received by the second Ethernet port; the heartbeat message is sent through the second Ethernet port, forwarded by the EtherCAT slave station, and received by the first Ethernet port; by transmitting the function message and the heartbeat message simultaneously in opposite directions, the communication paths are made independent—the forward path is used for control data transmission, and the reverse path is used for connectivity detection. No matter where a link fails in the network, the hardware can detect the anomaly through one of the paths, while the other path can still maintain partial communication, thus buying time for recovery. In the abnormal state of the first port: the function message is sent and received by the second Ethernet port, and the message transceiver circuit stops sending the heartbeat message; when Port0 is physically disconnected, the transmission and reception of function messages are switched to Port1. At this time, the Ethernet port of Port1 simultaneously undertakes the transmission and reception of function messages, forming a port self-transmission and self-reception working mode, ensuring that control commands can continue to be transmitted to all slave stations in the Port1 subnet; the heartbeat message is stopped because Port1 has entered full-function communication mode and no longer needs additional probe messages to occupy bandwidth; In the abnormal state of the second port: the function message is sent through the first Ethernet port and received by the first Ethernet port, and the message transceiver circuit stops sending the heartbeat message; when Port1 is physically disconnected, the transmission and reception of function messages are switched to Port0, forming a self-transmission and self-reception working mode of Port0, ensuring that control commands can continue to be transmitted to all slave stations in the Port0 subnet, and at the same time, heartbeat messages are stopped to avoid invalid transmission; In the abnormal state of the slave node: the function message is sent through the first Ethernet port, forwarded through the first sub-network and received by the first Ethernet port, then sent through the second Ethernet port, forwarded through the second sub-network and received by the second Ethernet port, and the message transceiver circuit stops sending the heartbeat message; when the intermediate slave node goes offline, causing the network to split into two sub-networks, the function message is transmitted sequentially in the two sub-networks respectively - first sent by Port0, traversing the first sub-network and received by Port0, then sent by Port1, traversing the second sub-network and received by Port1, so as to realize the sequential coverage of the two split sub-networks by a single function message, ensuring that all online slaves can receive control commands; the heartbeat message is stopped because the dual sequential transmission of the function message also serves as a network detection function.

[0016] A further technical solution of the present invention is: the heartbeat message is sent at a frequency of 1 microsecond; the heartbeat message is continuously sent at a high frequency of microseconds to ensure that network anomalies can be captured by the hardware detection circuit within 1 microsecond. Compared with the millisecond-level detection cycle of traditional software polling, the anomaly detection delay is reduced by three orders of magnitude, which fully meets the application scenarios with extremely high real-time requirements such as high-speed motion control. The anomaly detection circuit and the state machine control circuit are integrated into the FPGA chip; by utilizing the hardware parallel processing capability and deterministic latency characteristics of the FPGA, the pure hardware logic execution of anomaly detection and state transition is realized, avoiding pipeline delay, interrupt response delay and operating system scheduling uncertainty in the CPU software execution path, and ensuring that the end-to-end delay from the occurrence of an anomaly to the completion of the path switch is constant and predictable. The EtherCAT master controller also has a status register, which is used to provide the current network status code to external software. By exposing the current network status to the software through the read-only register, the software can obtain network topology information and anomaly types as needed, which is used for auxiliary functions such as distributed clock synchronization update and network node delay recalculation. At the same time, it maintains the software's ability to perceive the network status, which is convenient for human-machine interface display and fault log recording.

[0017] Another objective of this invention is to provide an anomaly recovery method for redundant EtherCAT master networks, applied to an EtherCAT master controller including a first Ethernet port and a second Ethernet port, the anomaly recovery method comprising: In redundant networking mode, function messages are sent through the first Ethernet port and received by the second Ethernet port, and heartbeat messages are sent through the second Ethernet port and received by the first Ethernet port. A communication framework is established in which function messages and heartbeat messages are transmitted separately and in opposite directions, so that the control data transmitted in the forward direction and the detection signals transmitted in the reverse direction are independent of each other and mutually verified, laying the transmission foundation for achieving fault detection without blind spots in the entire network. The link status of the first Ethernet port and the second Ethernet port is monitored in real time, and the reception of the heartbeat message is monitored. The health status of the physical layer and the data link layer is continuously monitored in parallel through hardware circuits. The link status reflects the integrity of the physical connection, and the heartbeat message reception reflects the smoothness of the data forwarding path. The combination of the two can distinguish between different types of anomalies such as physical disconnection, node failure, and data congestion. When a network anomaly is detected, the anomaly type is identified based on the link status and the heartbeat message reception status. The complex network anomaly classification decision is completed in parallel in hardware through combinational logic circuits by using dual determination logic based on the heartbeat message reception location and the link signal status. This achieves single-cycle identification of the anomaly type and provides a delay-free trigger signal for subsequent state transitions. Based on the identified anomaly type, the control state machine jumps to the corresponding anomaly state and switches the message forwarding path according to the anomaly state to restore communication. By directly mapping the anomaly type to the message forwarding path configuration through the hardware state machine, the message transceiver circuit can respond immediately after the state jump, ensuring that the entire process from anomaly identification to communication recovery is completed within microseconds, minimizing the communication interruption window.

[0018] A further technical solution of the present invention is that the abnormality types include a first Ethernet port disconnection abnormality, a second Ethernet port disconnection abnormality, and a slave node abnormality; When the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port is valid, it is identified as an abnormal slave node. Through dual verification of the heartbeat message receiving location and the Link signal, the abnormality of the slave node and the abnormality of the master port are accurately distinguished, avoiding the misjudgment of the intermediate node failure as the master port failure, and providing accurate fault location for on-site maintenance. When the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port fails, it is identified as the first Ethernet port being disconnected abnormally; when Port1 receives the heartbeat message and the link of Port0 fails, it indicates that the function message can no longer be sent from Port0, and the communication path must be switched to Port1 immediately to prevent the control command from being interrupted. When the link status of the second Ethernet port fails, it is identified as an abnormal disconnection of the second Ethernet port; the failure of the Port1 link means that the function message cannot be received from Port1. At this time, communication can be restored simply by switching the receiving path of the function message back to Port0, which simplifies the recovery process.

[0019] A further technical solution of the present invention is that the state machine has at least a non-redundant networking state, a redundant networking state, a first port abnormal state, a second port abnormal state, and a slave node abnormal state; the state machine also has an emergency processing state. When the abnormality of the slave node or the disconnection of the first Ethernet port is detected, the state machine is controlled to first jump to the emergency processing state. In the emergency processing state, a synchronization message is resent. Then, the state machine is controlled to jump to the corresponding abnormal state according to the link status of the first Ethernet port. Before topology reconstruction, the synchronization message is resent first to ensure that the slave station does not report errors or stop due to synchronization loss during topology switching, so as to achieve a seamless transition when an abnormality occurs. If the first Ethernet port reconnects when the first port is in an abnormal state, the state machine is controlled to jump to the abnormal state of the slave node. After Port0 recovers, it first enters the abnormal state of the intermediate node for confirmation, so as to avoid missing the confirmation of the intermediate node status due to directly jumping back to the redundant networking state. If the second Ethernet port reconnects during the abnormal state of the second port, the state machine is controlled to jump to the abnormal state of the slave node; after Port1 recovers, the state of the intermediate node must also be confirmed first to ensure the consistency of the recovery mechanisms at both ends; If all slave nodes recover to normal under abnormal conditions, the state machine is controlled to jump to the redundant network state; after all slave nodes reconnect, the network automatically recovers to the complete ring redundant topology, realizing fully automatic network self-healing. In the redundant networking state, the function message is sent through the first Ethernet port, forwarded by the EtherCAT slave station, and received by the second Ethernet port; the heartbeat message is sent through the second Ethernet port, forwarded by the EtherCAT slave station, and received by the first Ethernet port; bidirectional independent detection of function and control is achieved through parallel transmission in opposite directions. In the abnormal state of the first port, the function message is sent through and received by the second Ethernet port, and the heartbeat message is stopped; after Port0 is disconnected, Port1 is switched to full-function communication mode to ensure that control commands continue to be transmitted; In the abnormal state of the second port, the function message is sent through the first Ethernet port and received by the first Ethernet port, and the heartbeat message is stopped; after Port1 is disconnected, Port0 is switched to full-function communication mode to ensure that control commands continue to be transmitted; In the abnormal state of the slave node, the function message is sent through the first Ethernet port, forwarded through the first sub-network and received by the first Ethernet port, then sent through the second Ethernet port, forwarded through the second sub-network and received by the second Ethernet port, and the sending of the heartbeat message is stopped; after the network splits, the function message traverses the two sub-networks in sequence to ensure that all online slaves can receive the control command; The heartbeat message is sent at a 1-microsecond interval, enabling microsecond-level anomaly detection and response to meet the requirements of high real-time applications.

[0020] Compared with the prior art, the present invention has the following advantages: With a dual-port redundant networking structure, even if a node or link in the network fails, the system can automatically identify the type of abnormality and quickly switch the communication path, effectively avoiding the risk of a single point of failure causing the entire network to be paralyzed, greatly enhancing the stability and continuity of the industrial control system, and significantly improving communication reliability. By leveraging hardware logic modules (anomaly detection circuit and state machine control circuit), anomaly detection, state transition, and network topology reconstruction are achieved. The entire process requires no or minimal software intervention, with a response speed reaching the microsecond level. This meets the stringent real-time requirements of the industrial automation field, ensuring the timely transmission and execution of critical control commands and enhancing real-time response capabilities.

[0021] Complex redundant logic and exception handling mechanisms are handled by hardware, while software only needs to read network status and exception information from registers and perform simple processing as needed. This greatly reduces the complexity of software development, shortens the system development cycle, reduces the software's operational burden, improves the overall system efficiency, and simplifies software design and development.

[0022] It defines various network anomaly types in detail (first Ethernet port disconnection anomaly, second Ethernet port disconnection anomaly, slave node anomaly), and combines heartbeat message mechanism and Link signal detection to accurately determine the location and cause of the fault. This provides on-site maintenance personnel with clear fault diagnosis criteria, helps to quickly repair faults, reduce downtime, improve production efficiency, and accurately locate network faults.

[0023] After a network anomaly, the system can automatically complete a series of recovery operations, such as topology reconstruction and synchronization message retransmission, restoring normal communication without manual intervention. This not only reduces the workload of manual inspection and maintenance but also lowers production costs caused by downtime maintenance, realizing intelligent and autonomous management of industrial networks and reducing maintenance costs through automatic recovery.

[0024] This redundant networking architecture is designed based on the standard EtherCAT protocol, is fully compatible with existing EtherCAT slave devices, and can be seamlessly integrated into existing industrial networks. Furthermore, its modular design allows for flexible expansion of the network scale according to actual needs, adapting to industrial application scenarios of varying complexity, and possesses broad market potential. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the overall structure of the EtherCAT master station redundant networking system provided in this embodiment of the invention.

[0026] Figure 2 This is a schematic diagram of the transmission path of function messages and heartbeat messages in the redundant networking mode provided in the embodiments of the present invention.

[0027] Figure 3 This is a schematic diagram of the network topology when the slave node is abnormal (abnormality 1) according to an embodiment of the present invention.

[0028] Figure 4 This is a network topology diagram of the first Ethernet port disconnection anomaly (anomaly 2) provided in an embodiment of the present invention.

[0029] Figure 5 This is a network topology diagram of the second Ethernet port disconnection anomaly (anomaly 3) provided in an embodiment of the present invention.

[0030] Figure 6 This is a schematic diagram of the state transition of the state machine provided in an embodiment of the present invention. Detailed Implementation

[0031] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0032] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0033] System overall structure: like Figure 1 As shown, the EtherCAT master station redundant networking system provided by this invention includes an EtherCAT master station controller, which integrates a first Ethernet port (hereinafter referred to as Port0) and a second Ethernet port (hereinafter referred to as Port1). Port0 and Port1 are used to connect the two ends of the EtherCAT slave network, thereby forming a ring network topology together with multiple EtherCAT slave stations (slave station 1, slave station 2, ..., slave station N). A ring communication link is constructed through the physical connection of the two network ports, providing a physical layer redundancy basis for EtherCAT communication. When a link in one direction is interrupted, messages can reach the slave station from the other direction, thus avoiding the paralysis of the entire network due to a single point of physical disconnection.

[0034] The EtherCAT master controller integrates message transmission and reception circuits, anomaly detection circuits, and state machine control circuits. Preferably, these circuits are integrated into an FPGA (Field-Programmable Gate Array) chip to achieve fast hardware-level response. The EtherCAT master controller also has a status register to provide the current network status code to external software for on-demand reading and processing.

[0035] The EtherCAT master circuit can operate in two modes: Non-redundant networking mode: In this mode, only Port0 is used for communication, and Port1 is closed. Functional messages are sent and received via Port0. This mode is generally used for synchronizing distributed clocks of slave stations.

[0036] Redundant networking mode: In this mode, both Port0 and Port1 are used for communication. Functional messages are sent by Port0 and received by Port1; heartbeat messages are sent by Port1 and received by Port0.

[0037] Message transmission mechanism: like Figure 2As shown, in redundant networking mode, the EtherCAT master controller achieves parallel transmission of dual messages through message transceiver circuits: Functional messages: These are sent by the transmitter (TX) of Port0, forwarded sequentially through EtherCAT slave 1, slave 2, ..., slave N, and finally received by the receiver (RX) of Port1. Functional messages carry the main control commands and process data.

[0038] Heartbeat messages: Sent by the sender (TX) of Port1, forwarded by the EtherCAT slave station in the opposite direction (reverse) to the function message, and finally received by the receiver (RX) of Port0. The preferred interval for sending heartbeat messages is 1 microsecond, used to continuously detect whether the communication network is functioning properly. By transmitting function messages and heartbeat messages simultaneously in opposite directions, the communication paths are made independent—the forward path is used for control data transmission, and the reverse path is used for connectivity detection. Regardless of where a link fails in the network, the hardware can detect the anomaly through one of the paths, while the other path can still maintain partial communication, buying time for recovery.

[0039] In non-redundant networking mode, only Port0 participates in communication. Functional messages are sent through Port0, forwarded by EtherCAT slave stations, and received by Port0. No heartbeat messages are sent.

[0040] Exception type definition: The actual causes of EtherCAT network anomalies can be varied, but from the perspective of the EtherCAT master station, network anomalies can be categorized into the following three types: Anomaly 1 – Slave Node Anomaly: This is caused by a slave node in the EtherCAT network going offline or a network cable failure between slave nodes. After Anomaly 1 occurs, under the EtherCAT slave's message forwarding mechanism, function messages will be sent from Port0 and received at Port0; while heartbeat messages will be sent from Port1 and received at Port1.

[0041] Anomaly 2—Port0 Disconnection: This is caused by a fault in the slave node connected to the EtherCAT master Port0 or a fault in the network cable between them. After Anomaly 2 occurs, the link signal of the EtherCAT master Port0 fails, and function messages will be lost; however, heartbeat messages will be sent from and received at Port1.

[0042] Anomaly 3—Port1 Disconnection: Caused by a fault in the slave node connected to the EtherCAT master Port1 or a fault in the network cable between them. After Anomaly 3 occurs, the link signal of the EtherCAT master Port1 fails, function messages are sent from and received on Port0, while heartbeat messages are lost.

[0043] Anomaly detection mechanism: The anomaly detection circuit monitors the link status signals of Port0 and Port1 in real time, as well as the reception of heartbeat messages, and identifies the anomaly type based on the following judgment logic: 1) When Port1 receives a heartbeat message and the link status of Port0 is valid, it is determined to be an anomaly 1 (slave node anomaly). By verifying the heartbeat message reception location and the link signal, the anomaly of the slave node and the master port can be accurately distinguished. If Port1 receives a heartbeat message but the link status of Port0 is valid, it means that the anomaly occurs in the intermediate node of the network rather than the master port, thus avoiding misjudging the failure of the intermediate node as the failure of the master port, and providing accurate fault location basis for on-site maintenance personnel.

[0044] 2) When Port1 receives a heartbeat message and the link status of Port0 fails, it is determined to be an anomaly 2 (Port0 disconnection anomaly). When Port1 receives a heartbeat message and the link of Port0 fails, it indicates that the function message can no longer be sent from Port0. The communication path must be switched to Port1 immediately to prevent the control command from being interrupted and to ensure that the system can still maintain communication after the physical disconnection of Port0.

[0045] 3) When the link status of Port1 fails, it is judged as an exception 3 (Port1 disconnection exception). The failure of the Port1 link means that heartbeat messages cannot be sent and function messages cannot be received from Port1. At this time, communication can be restored simply by switching the receiving path of function messages back to Port0, without performing complex topology reconstruction, which simplifies the recovery process and reduces recovery time.

[0046] The detection logic described above is implemented entirely by hardware circuitry, requiring no software intervention, and the detection response time reaches the microsecond level.

[0047] Network topology after the anomaly occurs: After anomaly 1 occurs: The EtherCAT network topology is divided into two sub-networks—the primary network port Port0 sub-network and the secondary network port Port1 sub-network, as follows: Figure 3 As shown. The Port0 subnet contains slave stations 1 to i (slaves before the failed node), and the Port1 subnet contains slave stations j to N (slaves after the failed node).

[0048] After anomaly 2 occurs: the EtherCAT network topology only has the Port1 subnet remaining, such as... Figure 4 As shown, Port0 is completely disconnected from the network.

[0049] After anomaly 3 occurs: the EtherCAT network topology only has the Port0 subnet remaining, such as... Figure 5 As shown, Port1 is completely disconnected from the network.

[0050] State machine control: like Figure 6 As shown, the state machine control circuit internally implements a hardware state machine to control the transitions between different redundant states of the EtherCAT master controller. The state machine includes at least the following states: Non-redundant network configuration (NON_RED_OP); Redundant network status (RED_OP); The first port is in an abnormal state (RED_OP_XCPT_P0); The second port is in an abnormal state (RED_OP_XCPT_P1); Slave node abnormal state (RED_OP_XCPT); Emergency status (RED_OP_EMG).

[0051] By mapping different abnormal scenarios to independent hardware states, each state corresponds to a set of preset message forwarding path configurations, enabling the message transceiver circuit to complete path switching within a single clock cycle after a state transition. At the same time, each state provides a corresponding state code to the software, facilitating the software to synchronously update the distributed clock parameters.

[0052] The transition conditions and transition targets for each state are as follows: The core control logic of the state machine is as follows: 1) The master station controller is initially in a non-redundant networking state. The software can configure the master station to enter a redundant networking state through the configuration register.

[0053] 2) In redundant networking, if anomaly 3 (Port1 link failure) is detected, the status immediately jumps to the second port anomaly status (RED_OP_XCPT_P1). At this time, the hardware updates the network communication topology and updates the number of slave nodes in real time. After the update is completed, it enters the RED_OP_XCPT_P1_INFO state. The software recalculates the network node latency according to the updated network topology based on the status change.

[0054] 3) In redundant networking, if anomaly 1 or anomaly 2 is detected (heartbeat message received on Port1), the hardware first enters emergency handling state (RED_OP_EMG). Upon entering this state, the message transceiver circuit immediately resends synchronization messages to ensure that slave stations do not lose packets due to the anomaly. Its purpose is that when anomaly 1 or anomaly 2 is detected, the network topology is about to change, and slave stations may lose synchronization messages due to path switching. By setting the emergency handling state as a transitional state, synchronization messages are resent preferentially before topology reconstruction, ensuring that slave stations do not report errors or stop due to synchronization loss during topology switching, achieving a seamless transition when anomalies occur and ensuring the stable operation of the control system.

[0055] Subsequently, the anomaly type was further distinguished based on the link status of Port0: If the Port0 link is valid, the error is exception 1 (slave node exception), and the status transitions to the slave node exception state (RED_OP_XCPT). The hardware updates the network communication topology and updates the number of slave nodes in real time (dividing the network into two sub-networks). After the update is complete, it enters the RED_OP_XCPT_INFO state. The software recalculates the network node latency according to the updated network topology based on the status change.

[0056] If the Port0 link fails, it will be classified as Abnormality 2 (Port0 disconnection abnormality), and the status will jump to the first port abnormality state (RED_OP_XCPT_P0). The hardware updates the network communication topology and updates the number of slave nodes in real time (only retaining the Port1 subnet). After the update is complete, it enters the RED_OP_XCPT_P0_INFO state. The software recalculates the network node latency according to the updated network topology based on the status change.

[0057] Message forwarding paths in each state: Under different redundancy conditions, the forwarding order of EtherCAT master station messages is as follows: 1) Non-redundant networking status Functional message: Port0 sends → EtherCAT slave (1,2,…,N) → Port0 receives.

[0058] Heartbeat message: None.

[0059] 2) Redundant networking status Functional message: Port0 sends → EtherCAT slave (1,2,…,N) → Port1 receives. Its function is that the functional message is received by Port1 after traversing all slaves in the forward direction, thus completing the normal issuance of control commands.

[0060] Heartbeat message: Port1 sends → EtherCAT slave (reverse forwarding) → Port0 receives. Its function is that the heartbeat message is received by Port0 after traversing all slaves in reverse, realizing reverse detection of network connectivity and forming cross-checking with the function message path.

[0061] 3) Abnormal state of the first port (Port0 abnormal) Functional messages: Port1 sends → EtherCAT slave (i,…,N) → Port1 receives. Its function is to switch all transmission and reception of functional messages to Port1 when Port0 is physically disconnected. Port1 simultaneously undertakes the sending and receiving of functional messages, forming a port self-transmission and self-reception working mode, ensuring that control commands can continue to be transmitted to all slaves in the Port1 subnet.

[0062] Heartbeat message: None (sending stopped). Its purpose is to indicate that Port1 has entered full-function communication mode and no longer requires additional probe messages to consume bandwidth.

[0063] 4) Abnormal status of the second port (Port1 abnormal) Functional message: Port0 sends → EtherCAT slave (1,…,i) → Port0 receives. Its function is to switch all functional message transmission and reception to Port0 when Port1 is physically disconnected, forming a self-transmitting and self-receiving working mode of Port0, ensuring that control commands can continue to be transmitted to all slaves in the Port0 subnet.

[0064] Heartbeat message: None (Send stopped). Its purpose is to prevent invalid heartbeat messages from being sent.

[0065] 5) Abnormal status of slave nodes Functional message: Port0 sends → EtherCAT slave (1,…,i) → Port0 receives → Port1 sends → EtherCAT slave (j,…,N) → Port1 receives. Its function is to transmit the functional message sequentially through the two sub-networks when an intermediate slave node goes offline, causing the network to split into two sub-networks. First, Port0 sends the message, traversing the first sub-network and receiving it; then Port1 sends the message, traversing the second sub-network and receiving it. This ensures that a single functional message sequentially covers both split sub-networks, guaranteeing that all online slaves receive control commands.

[0066] Heartbeat message: None (send stopped). Its function is that the dual-path sequential transmission of the function message already serves as a network detection function, so there is no need to send an additional heartbeat message.

[0067] Network recovery mechanism: After anomaly 1, anomaly 2, or anomaly 3 occurs, the main station can automatically restore the network without power loss as the faulty network is repaired. Anomaly 1 Recovery: When all slave stations recover from Anomaly 1, the master station detects a change in the transmission path of messages in the network (heartbeat messages are received again by Port0). The state machine control circuit controls the state machine to automatically recover from the slave node anomaly state (RED_OP_XCPT_INFO) to the redundant network state (RED_OP). Its function is to automatically restore the complete ring redundant topology after all slave stations reconnect, restoring the bidirectional cross-transmission of function messages and heartbeat messages, achieving fully automatic network self-healing. The software re-restores the network topology based on the state change and calculates the network node latency.

[0068] Anomaly 2 Recovery: When Port0 reconnects, the master station detects that the Port0 link status has been effectively restored. The state machine control circuit controls the state machine to jump from the first port anomaly state (RED_OP_XCPT_P0_INFO) to the slave node anomaly state (RED_OP_XCPT_INFO). Its purpose is that when Port0 recovers from a disconnected state, since there may still be slave node failures in the network (original Anomaly 1), the system first enters the slave node anomaly state to troubleshoot intermediate node failures. This avoids missing confirmation of intermediate node status due to directly jumping back to the redundant network state, ensuring that the network is fully restored before entering the full redundancy working mode. At this point, it is equivalent to entering the Anomaly 1 state. The software re-restores the network topology based on the state change and calculates network node latency.

[0069] Anomaly 3 Recovery: When Port1 reconnects, the master station detects that the Port1 link status has been successfully restored. The state machine control circuit controls the state machine to transition from the second port anomaly state (RED_OP_XCPT_P1_INFO) to the slave node anomaly state (RED_OP_XCPT_INFO). This ensures that after Port1 recovers, the intermediate node status must be confirmed first, using the same processing logic as for Port0 recovery, guaranteeing consistency between the recovery mechanisms at both ends and reducing the complexity of the state machine design. At this point, it is equivalent to entering the Anomaly 1 state. The software then re-establishes the network topology based on the state change and calculates the network node latency.

[0070] Software interface: In this invention, complex redundant logic and exception handling mechanisms are implemented in hardware. The EtherCAT master controller provides the current network status code to external software through a status register. By exposing the current network status to the software through a read-only register, the software can obtain network topology information and exception types as needed for auxiliary functions such as distributed clock synchronization updates and network node delay recalculation. Simultaneously, it maintains the software's awareness of the network status, facilitating human-machine interface display and fault log recording. The software only needs to read the status register to obtain network status and exception information, and recalculate the network node delay according to the updated network topology when the status changes. This significantly reduces the complexity of software development and shortens the system development cycle.

[0071] Preferred Embodiment: In one preferred embodiment, the anomaly detection circuit and the state machine control circuit are integrated into the FPGA chip. Utilizing the FPGA's hardware parallel processing capabilities and deterministic latency characteristics, pure hardware logic execution for anomaly detection and state transitions is achieved. This avoids pipeline delays, interrupt response delays, and operating system scheduling uncertainties in the CPU software execution path, ensuring that the end-to-end latency from anomaly occurrence to path switching completion is constant and predictable.

[0072] The heartbeat message is sent at a 1-microsecond interval. Continuously sending heartbeat messages at a high frequency of microseconds ensures that network anomalies are detected by the hardware detection circuit within 1 microsecond. Compared to the millisecond-level detection cycle of traditional software polling, this reduces the anomaly detection latency by three orders of magnitude, fully meeting the high real-time requirements of applications such as high-speed motion control. The entire process of anomaly detection, state transition, and message forwarding path switching is completed by hardware logic without software intervention, achieving a response speed at the microsecond level, fully meeting the high real-time requirements of industrial automation.

[0073] In another preferred embodiment, the EtherCAT master controller can freely switch between non-redundant and redundant networking modes via software configuration registers to adapt to different application scenarios. In non-redundant networking mode, the system can operate in traditional single-port communication mode for scenarios such as synchronizing distributed clocks of slave stations.

[0074] Example 1: Hardware Architecture Example of EtherCAT Master Redundancy Networking System This embodiment provides an FPGA-integrated EtherCAT master station redundant networking system. The core hardware carrier is a Xilinx Artix7 series FPGA chip. The FPGA integrates message transceiver circuits, anomaly detection circuits, and state machine control circuits. Externally, it brings out two Gigabit Ethernet PHY interfaces, Port0 (first Ethernet port) and Port1 (second Ethernet port). The hardware Link status signal output by the PHY chip is directly connected to the anomaly detection circuit inside the FPGA.

[0075] Hardware mode configuration logic After the device is powered on and reset, the state machine defaults to the NON_RED_OP non-redundant networking state. At this time, the Port1 hardware is turned off, and only Port0 sends and receives EtherCAT function messages, which are used for the initial scan of slave stations and calculation of the basic distributed clock offset. The upper-layer software writes the redundancy enable instruction to the FPGA internal mode configuration register through the AXI register bus, and the hardware switches to the RED_OP redundant networking normal state to build a closed loop network.

[0076] Redundant mode message transmission logic The FPGA's internal message transceiver circuit has a built-in independent heartbeat message generation module that generates fixed-length heartbeat messages. A hardware timer strictly controls the transmission interval to 1μs. Under normal redundant conditions: Functional message path: Port0 TX → forwarded by all EtherCAT slaves via ESC → Port1 RX; Heartbeat message path: Port1 TX → all EtherCAT slave stations reverse forwarding → Port0 RX.

[0077] Anomaly detection hardware judgment logic The anomaly detection circuit acquires two signals in parallel: Port0 Link level and Port1 Link level, while simultaneously monitoring whether a complete heartbeat message has been received in the Port1 RX buffer. The hardware combinational logic outputs a fault indicator in real time. 1) A complete heartbeat message exists in the Port1 RX buffer && Port0 Link = high level (valid) → Output slave node exception flag; 2) A complete heartbeat message exists in the Port1 RX buffer && Port0 Link = low level (failure) → Output Port0 disconnection error flag; 3) Port1 Link = Low level (failure) → Output Port1 disconnection error indicator.

[0078] Hardware state machine transition and message switching control The state machine control circuit is implemented using finite state machine (FSM) hardware logic. The transition and message control rules for each state are as follows: 1) Port1 disconnection anomaly detected: directly jump to the second port abnormal state RED_OP_XCPT_P1_INFO; the message transceiver circuit shuts down the heartbeat message generation module, and the function message is switched to Port0 self-transmission and self-reception (Port0 TX→Port0RX); 2) If a slave node anomaly or Port0 disconnection is detected: Prioritize switching to the RED_OP_EMG emergency handling state; the hardware synchronization message buffer module automatically resends synchronization messages. After the synchronization message is sent, the Port0 Link level is read to distinguish faults. Port0 Link Valid: Jump to RED_OP_XCPT_INFO slave node abnormal state; message transceiver circuit disables heartbeat messages, Port0 independently transmits and receives first sub-network messages, and Port1 independently transmits and receives second sub-network messages; Port0 Link failure: Jump to the first port abnormal state of RED_OP_XCPT_P0_INFO; the message transceiver circuit disables heartbeat messages, and the function message switches to Port1 self-transmission and self-reception; 3) Fault repair and recovery logic: When Port0 Link returns to high level in RED_OP_XCPT_P0_INFO state, jump to RED_OP_XCPT_INFO; When Port1 Link returns to high level in RED_OP_XCPT_P1_INFO state, jump to RED_OP_XCPT_INFO. In the RED_OP_XCPT_INFO state, the heartbeat message restores the complete path from Port1 TX to Port0 RX and then jumps back to the RED_OP redundancy normal state.

[0079] Software interaction interface The FPGA has a 32-bit read-only status register. Different bits in the register are encoded to indicate the current operating status, fault type, fault port, and total number of online slaves. The upper-layer ARM / CPU software can obtain all network information simply by reading the register. It does not need to participate in any fault judgment or message switching logic. The software only needs to recalculate the distributed clock delay based on the status code.

[0080] Example 2: Complete Process of EtherCAT Master Redundancy Network Anomaly Recovery Method This embodiment executes the anomaly recovery process based on the hardware system of Embodiment 1. The complete steps are as follows: Step 1, Initialization Configuration: The master station is powered on, the hardware state machine enters the NON_RED_OP non-redundant mode, the software scans all slave stations and establishes the basic network topology; the software writes to the redundancy enable register, the hardware switches to the RED_OP redundancy normal state, Port0 and Port1 build a ring network, and continuously send heartbeat messages at a 1μs cycle. Step 2, Hardware Parallel Monitoring: The anomaly detection circuit continuously collects the level of Port0 and Port1 Link, and analyzes the inner beat message in the Port1 receive buffer in real time; Step 3, Fault Trigger Handling 1 (Intermediate Slave Node Disconnection): A slave node in the middle of the ring network disconnects, splitting the ring network into two independent sub-networks, Port0 and Port1. Port1 RX receives its own heartbeat message, and Port0 Link level is active. The hardware determines that the slave node is abnormal, and the state machine jumps to the RED_OP_EMG emergency state to resend the synchronization message. Then it jumps to RED_OP_XCPT_INFO, disables the heartbeat message, and Port0 and Port1 independently send and receive sub-network messages. The software reads the status register and updates the segment network node delay. Step 4, Fault Repair: Manually replace the broken network cable, the ring network is closed again, and the heartbeat message transmission path is restored to Port1 and Port0; the hardware detects that the heartbeat message path is restored, the state machine automatically jumps back to the RED_OP redundancy normal state, and restarts the 1μs heartbeat message loop detection. Step 5, Fault Trigger Handling 2 (Port0 Network Port Disconnection): The Port0 network cable is disconnected, the Port0 Link level fails, and the Port1 RX receives a heartbeat message; the hardware determines that the Port0 is disconnected abnormally, first enters RED_OP_EMG to resend the synchronization message, and then jumps to RED_OP_XCPT_P0_INFO; the message is switched to Port1 self-sending and self-receiving, and the heartbeat message is stopped; Step 6, Port Repair and Recovery: Reconnect the Port0 network cable tightly. The Port0 Link level will return to valid, and the state machine will jump to RED_OP_XCPT_INFO. After all links are repaired, it will automatically switch back to the redundant normal state. Step 7, Fault Triggering Processing 3 (Port1 Network Port Disconnection): The Port1 network cable is disconnected, the Port1 Link level directly fails, and the hardware determines that Port1 is disconnected and abnormal; the state machine directly jumps to RED_OP_XCPT_P1_INFO, the function message Port0 is sent and received automatically, and the heartbeat message is turned off; after reconnecting Port1, it jumps to the slave abnormal state, and after all links are repaired, the ring network redundancy mode is restored.

[0081] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An EtherCAT master station redundant networking system, characterized in that, The EtherCAT master station redundant networking system includes The EtherCAT master controller includes a first Ethernet port and a second Ethernet port, which are used to connect the two ends of the EtherCAT slave network to form a ring network topology. The message transceiver circuit is configured to, in redundant networking mode, send function messages through the first Ethernet port and receive the function messages through the second Ethernet port, and send heartbeat messages through the second Ethernet port and receive the heartbeat messages through the first Ethernet port. The anomaly detection circuit is configured to detect network anomaly types based on the link status signal of the first Ethernet port, the link status signal of the second Ethernet port, and the reception status of the heartbeat message; the anomaly types include first Ethernet port disconnection anomaly, second Ethernet port disconnection anomaly, and slave node anomaly; Specifically, when the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port is valid, the slave node is determined to be abnormal; when the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port is invalid, the first Ethernet port is determined to be disconnected; when the link status of the second Ethernet port is invalid, the second Ethernet port is determined to be disconnected. The state machine control circuit is configured to perform state transitions between multiple redundant states based on the detection results of the anomaly detection circuit, and to control the message transceiver circuit to switch message forwarding paths based on the current state. The state machine control circuit is configured to control the state machine to have at least the following states: non-redundant networking state, redundant networking state, first port abnormal state, second port abnormal state, and slave node abnormal state. The state machine also has an emergency handling state; When the anomaly detection circuit detects an anomaly in the slave node or a disconnection anomaly in the first Ethernet port, the state machine control circuit controls the state machine to first jump to the emergency processing state. In the emergency processing state, the message transceiver circuit resends a synchronization message. After that, the state machine control circuit controls the state machine to jump to the corresponding anomaly state according to the link status of the first Ethernet port. In the redundant networking state: the function message is sent through the first Ethernet port, forwarded by the EtherCAT slave station, and then received by the second Ethernet port; the heartbeat message is sent through the second Ethernet port, forwarded by the EtherCAT slave station, and then received by the first Ethernet port. In the abnormal state of the first port: the function message is sent through the second Ethernet port and received by the second Ethernet port, and the message transceiver circuit stops sending the heartbeat message; In the abnormal state of the second port: the function message is sent through the first Ethernet port and received by the first Ethernet port, and the message transceiver circuit stops sending the heartbeat message; In the abnormal state of the slave node: the function message is sent through the first Ethernet port, forwarded through the first sub-network and received by the first Ethernet port, then sent through the second Ethernet port, forwarded through the second sub-network and received by the second Ethernet port, and the message transceiver circuit stops sending the heartbeat message.

2. The EtherCAT master station redundant networking system according to claim 1, characterized in that, If the first Ethernet port reconnects when the first port is in an abnormal state, the state machine will jump to the abnormal state of the slave node. If the second Ethernet port reconnects while the second port is in an abnormal state, the state machine will transition to the abnormal state of the slave node. If all slave nodes recover to normal when the slave node is in an abnormal state, the state machine will switch to the redundant networking state.

3. The EtherCAT master station redundant networking system according to claim 1 or 2, characterized in that, The minimum interval between heartbeat messages is 1 microsecond; the anomaly detection circuit and the state machine control circuit are integrated into the FPGA chip; the EtherCAT master controller also has a status register for providing the current network status code to external software.

4. An anomaly recovery method for an EtherCAT master station redundant networking system as described in any one of claims 1-3, applied to an EtherCAT master station controller including a first Ethernet port and a second Ethernet port, characterized in that, The anomaly recovery method includes: In redundant networking mode, a function message is sent through the first Ethernet port and received by the second Ethernet port; a heartbeat message is sent through the second Ethernet port and received by the first Ethernet port. The link status of the first Ethernet port and the second Ethernet port is monitored in real time, and the reception of the heartbeat message is also monitored. When a network anomaly is detected, the anomaly type is identified based on the link status and the heartbeat message reception status; the anomaly types include first Ethernet port disconnection anomaly, second Ethernet port disconnection anomaly, and slave node anomaly. Specifically, when the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port is valid, the slave node is identified as abnormal; when the second Ethernet port receives the heartbeat message and the link status of the first Ethernet port is invalid, the first Ethernet port is identified as disconnected; when the link status of the second Ethernet port is invalid, the second Ethernet port is identified as disconnected. Based on the identified anomaly type, the control state machine jumps to the corresponding anomaly state, and switches the message forwarding path according to the anomaly state to restore communication; The state machine has at least a non-redundant networking state, a redundant networking state, a first port abnormal state, a second port abnormal state, and a slave node abnormal state; the state machine also has an emergency processing state. When the slave node is identified as abnormal or the first Ethernet port is disconnected, the state machine is controlled to first jump to the emergency processing state. In the emergency processing state, a synchronization message is resent. Then, the state machine is controlled to jump to the corresponding abnormal state according to the link status of the first Ethernet port. In the redundant networking state, the function message is sent through the first Ethernet port, forwarded by the EtherCAT slave station, and received by the second Ethernet port; the heartbeat message is sent through the second Ethernet port, forwarded by the EtherCAT slave station, and received by the first Ethernet port. In the abnormal state of the first port, the function message is sent through the second Ethernet port and received by the second Ethernet port, and the sending of the heartbeat message is stopped; In the abnormal state of the second port, the function message is sent through the first Ethernet port and received by the first Ethernet port, and the sending of the heartbeat message is stopped; When the slave node is in an abnormal state, the function message is sent through the first Ethernet port, forwarded through the first sub-network and received by the first Ethernet port, then sent through the second Ethernet port, forwarded through the second sub-network and received by the second Ethernet port, and the sending of the heartbeat message is stopped.

5. The anomaly recovery method according to claim 4, characterized in that, If the first Ethernet port reconnects when the first port is in an abnormal state, the state machine is controlled to jump to the abnormal state of the slave node. If the second Ethernet port reconnects when the second port is in an abnormal state, the state machine is controlled to jump to the abnormal state of the slave node. If all slave nodes recover to normal under abnormal conditions, the state machine is controlled to jump to the redundant networking state. The minimum interval between heartbeat messages is 1 microsecond.

Images