A redundant watchdog system and variable air volume valve control system

Abstract

The application relates to the technical field of embedded control, and discloses a redundant watchdog system and a variable air volume valve control system. The redundant watchdog system comprises a first main controller, the first main controller comprising a first hardware watchdog and a first software watchdog. The first hardware watchdog provides a reset signal under the condition that the first hardware watchdog does not acquire a dog feeding signal of the first main controller within a preset time, so that the first main controller performs a hardware reset operation. The first software watchdog updates state identifiers and heartbeat time stamps of heartbeat monitoring tasks at all levels, determines whether the heartbeat monitoring tasks at all levels are abnormally operated, and sends an abnormal early warning signal. The first main controller performs an abnormal reset operation under the condition that the first main controller acquires the abnormal early warning signal. The redundant watchdog system can realize double fault detection, the hardware watchdog provides a bottom layer timeout reset, the software watchdog can monitor whether key heartbeat monitoring tasks are abnormal, the hardware watchdog and the software watchdog are heterogeneous and redundant and back up each other, and the fault detection rate is significantly improved.

Description

Technical Field

[0001] This application relates to the field of embedded control technology, and in particular to a redundant watchdog system and a variable air volume valve control system. Background Technology

[0002] In traditional embedded control systems, abnormal program execution by the master controller often lacks comprehensive and reliable detection and recovery mechanisms. Conventional solutions often employ a single watchdog timer for fault monitoring, but its protection capabilities have significant limitations. On one hand, when serious faults such as deadlock, interrupt masking, stack overflow, or clock anomalies occur, a single watchdog timer is prone to malfunction due to triggering mechanism failure, preventing the system from automatically recovering. On the other hand, a single watchdog timer can only detect program stagnation and cannot identify anomalies at the program logic level, such as control algorithms getting stuck in infinite loops, data corruption, or task blocking. However, the main loop continues to periodically perform watchdog feeding operations, causing the watchdog timer to misjudge the system as being in normal operation, resulting in a "false normal" phenomenon and leading to the master controller losing control of the controlled device. Summary of the Invention

[0003] In view of this, the embodiments of this application provide a redundant watchdog system and a variable air volume valve control system, which can effectively solve the problem that a single watchdog is difficult to effectively detect and recover from abnormal operation of the main controller program.

[0004] In a first aspect, embodiments of this application provide a redundant watchdog system, including: a first master controller, the first master controller including a first hardware watchdog and a first software watchdog; The first master controller is used to provide a dog-feeding signal to the first hardware watchdog; The first hardware watchdog is used to provide a reset signal to the first master controller if the watchdog signal is not received within a preset time, so that the first master controller performs a hardware reset operation. The first software watchdog is used to periodically update the status identifier and heartbeat timestamp of each level of the heartbeat monitoring task in the multi-level heartbeat monitoring task, and to determine whether the heartbeat monitoring task at each level is running abnormally based on the heartbeat timestamp, and to send an abnormal warning signal to the first master controller; The first master controller is used to perform an abnormal reset operation based on the status identifier of the heartbeat monitoring task when the abnormal warning signal is received.

[0005] In a first possible embodiment of the first aspect, it further includes: a second master controller, wherein the first master controller is communicatively connected to the second master controller; The second master controller includes a second hardware watchdog and a second software watchdog; The second master controller is used to perform a reset operation on itself based on the second hardware watchdog and the second software watchdog, and to send the reset signal and the abnormal warning signal to the first master controller to perform a reset operation on the first master controller; The first master controller is also used to send the reset signal and the abnormal warning signal to the second master controller based on the first hardware watchdog and the first software watchdog, and to perform a reset operation on the second master controller.

[0006] In a second possible embodiment of the first aspect, it further includes: a first anti-interference reset circuit and a second anti-interference reset circuit; The first anti-interference reset circuit is connected to the first main controller and the second main controller respectively, and transmits the reset signal and the abnormal warning signal sent by the first main controller to the second main controller through electrical isolation; The second anti-interference reset circuit is connected to the second main controller and the first main controller respectively, and transmits the reset signal and the abnormal warning signal sent by the second main controller to the first main controller through electrical isolation.

[0007] In a third possible embodiment of the first aspect, the heartbeat monitoring tasks at each level correspond to different heartbeat timeout thresholds; The first software watchdog is also used to determine whether the heartbeat timestamp of each level of the heartbeat monitoring task is updated within the corresponding heartbeat timeout threshold. If the heartbeat timestamp is not updated within the heartbeat timeout threshold, the heartbeat monitoring task is determined to be running abnormally. If the heartbeat timestamp is updated within the heartbeat timeout threshold, the heartbeat monitoring task is determined to be operating normally.

[0008] In a fourth possible embodiment of the first aspect, the first software watchdog is further configured to select whether to report the abnormal warning signal to the first master controller based on the abnormality level of the heartbeat monitoring task. If the abnormality level of the heartbeat monitoring task is at level one, the abnormality warning signal and the status identifier of the heartbeat monitoring task will be reported to the first master controller. If the heartbeat monitoring task experiences an anomaly at level two, an anomaly log is recorded, allowing the first main controller to continue running the heartbeat monitoring task.

[0009] In a fifth possible embodiment of the first aspect, the status identifier includes one or more of an abnormal status identifier and a software infinite loop identifier; The first master controller is also used to control the heartbeat monitoring task to stop running and start a backup heartbeat monitoring task when it receives the abnormal warning and the abnormal status identifier. The first master controller is also used to control the restart of the heartbeat monitoring task upon receiving the abnormal warning and the software dead loop flag.

[0010] In a sixth possible embodiment of the first aspect, the status identifier includes one or more of a task idle identifier and a task start execution identifier; The first software watchdog is also used to enter a low-power sleep mode when all the heartbeat monitoring tasks are in the task idle state. The first software watchdog is also used to enter normal working mode when one or more of the heartbeat monitoring tasks are in the condition that the task starts execution flag is displayed.

[0011] In a seventh possible embodiment of the first aspect, the status identifier includes a task-running-specific identifier; The first software watchdog is also used to extend the heartbeat timeout threshold of the heartbeat monitoring task when the heartbeat monitoring task is under the condition of the task running special identifier.

[0012] In the eighth possible embodiment of the first aspect, both the first anti-interference reset circuit and the second anti-interference reset circuit include a first filter capacitor, a voltage regulator, a second filter capacitor, a transient voltage suppression diode, a first voltage divider resistor, a third filter capacitor, an optocoupler, and a second voltage divider resistor. The parallel node of the first filter capacitor and the voltage regulator is connected to the power supply, and the parallel node of the voltage regulator, the second filter capacitor, and the transient voltage suppression diode is connected to the first voltage divider resistor; The parallel node of the first voltage divider resistor and the third filter capacitor is respectively connected to the first main controller or the second main controller and the first input terminal of the optocoupler, and the first output terminal of the optocoupler is connected to the second main controller or the first main controller; The second input terminal of the optocoupler is grounded, and the second output terminal of the optocoupler is connected to the second voltage divider resistor; The first filter capacitor, the second filter capacitor, the third filter capacitor, the transient voltage suppression diode, and the second voltage divider resistor are all grounded.

[0013] Secondly, embodiments of this application provide a variable air volume valve control system, including: at least one variable air volume valve and the aforementioned redundant watchdog system.

[0014] The embodiments of this application have the following beneficial effects: A redundant watchdog system according to this embodiment includes: a first master controller, which includes a first hardware watchdog and a first software watchdog; the first master controller is used to provide a "feed" signal to the first hardware watchdog; the first hardware watchdog is used to provide a reset signal to the first master controller if it does not receive a "feed" signal within a preset time, so that the first master controller performs a hardware reset operation; the first software watchdog is used to periodically update the status identifier and heartbeat timestamp of each level of heartbeat monitoring task in a multi-level heartbeat monitoring task, determine whether each level of heartbeat monitoring task is running abnormally based on the heartbeat timestamp, and send an abnormality warning signal to the first master controller; the first master controller is used to perform an abnormality reset operation based on the status identifier of the heartbeat monitoring task when it receives an abnormality warning signal. Based on the above scheme, the redundant watchdog system can achieve dual fault detection. The hardware watchdog provides low-level timeout reset, which is not affected by the software state. The software watchdog can monitor whether the critical heartbeat monitoring task is abnormal. The two are heterogeneous and redundant, and serve as backups for each other. Even if the software watchdog is bypassed or the hardware watchdog is misconfigured, the other can still trigger a safe reset, which significantly improves the fault detection rate. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This paper illustrates a first structural schematic diagram of a redundant watchdog system according to an embodiment of the present application; Figure 2 A second structural schematic diagram of the redundant watchdog system according to an embodiment of this application is shown; Figure 3 This illustration shows a third structural diagram of the redundant watchdog system according to an embodiment of this application; Figure 4 A schematic diagram of a fourth structure of the redundant watchdog system according to an embodiment of this application is shown.

[0017] Explanation of key component symbols: 100 - Redundant watchdog system; 110 - First master controller; 111 - First hardware watchdog; 112 - First software watchdog; 120 - Second master controller; 121 - Second hardware watchdog; 122 - Second software watchdog; 130 - First anti-interference reset circuit; 140 - Second anti-interference reset circuit. Detailed Implementation

[0018] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0019] The components of the embodiments of this application described and illustrated in the accompanying drawings can be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of this application provided in the drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] In the following text, the terms "comprising," "having," and their cognates, which may be used in various embodiments of this application, are intended only to indicate a particular feature, number, step, operation, element, component, or combination thereof, and should not be construed as primarily excluding the presence of one or more other features, numbers, steps, operations, elements, components, or combinations thereof, or adding the possibility of one or more combinations thereof. Furthermore, the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0021] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of this application pertain. Terms (such as those defined in commonly used dictionaries) shall be interpreted as having the same meaning as in their contextual meaning in the relevant technical field and shall not be construed as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of this application.

[0022] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0023] In harsh environments such as high altitude, high temperature, high humidity, or strong electromagnetic interference, the variable air volume valve control system is susceptible to power fluctuations, signal interference, and program malfunctions, which can lead to valve malfunction and inaccurate airflow, endangering building environmental safety and energy efficiency.

[0024] Traditional watchdog timers and ordinary reset circuits have weak anti-interference capabilities, making it difficult to guarantee long-term reliable operation. Traditional RC reset or non-isolated reset circuits may generate glitches during power fluctuations or ground potential drift, leading to false resets, or fail to output effective reset pulses under strong interference, causing the controller to "freeze." Variable air volume (VAV) valve actuator drives, communication interfaces, and the main controller share a common ground, which easily introduces conducted / radiated noise, interfering with weak sensor signals (such as differential pressure and temperature), thus causing misjudgments and control oscillations. Once the main control system crashes and cannot recover automatically, manual intervention is required, seriously affecting the environmental safety and continuous operation of critical locations such as cleanrooms, negative pressure wards, and data centers.

[0025] To address these issues, this application provides a redundant watchdog system and a variable air volume (VAV) valve control system. It offers an operational protection mechanism with a dual-redundant watchdog architecture (hardware watchdog + software watchdog collaborative monitoring) and optocoupler isolation anti-interference reset technology. Electrical isolation cuts off interference paths, and dual watchdog detection improves fault identification rates, ensuring the VAV controller can still safely reset and operate stably under extreme conditions, meeting the stringent high reliability requirements of ventilation systems in critical locations such as medical facilities and laboratories.

[0026] The redundant watchdog system will be described below with reference to some specific embodiments.

[0027] Figure 1 A schematic diagram of a redundant watchdog system 100 according to an embodiment of this application is shown. Exemplarily, the redundant watchdog system 100 includes a first master controller 110, which includes a first hardware watchdog 111 and a first software watchdog 112.

[0028] In one embodiment, the first master controller 110 is used to provide a feeding signal to the first hardware watchdog 111; the first hardware watchdog 111 is used to provide a reset signal to the first master controller 110 if it does not receive the feeding signal within a preset time, so that the first master controller 110 performs a hardware reset operation.

[0029] In one embodiment, the first hardware watchdog 111 employs a dedicated reset chip for configuring a fixed timeout preset time, such as 1.6 seconds. The first master controller 110 needs to periodically output a watchdog feed signal. If the watchdog is not fed within the timeout period, the first hardware watchdog 111 pulls down its reset pin, providing a reset signal to the first master controller 110. This enables a hardware reset operation to be performed upon receiving the reset signal. The hardware reset operation includes a series of actions, such as forcing the first master controller 110 to restart and resume normal operation. The first hardware watchdog 111 provides underlying timeout protection and is unaffected by the state of the first master controller 110.

[0030] In another embodiment, the first software watchdog 112 is used to periodically update the status identifier and heartbeat timestamp of each level of the multi-level heartbeat monitoring task. Based on the heartbeat timestamp, it determines whether each level of the heartbeat monitoring task is running abnormally and sends an abnormal warning signal to the first master controller 110. The first master controller 110 is used to perform an abnormal reset operation based on the status identifier of the heartbeat monitoring task when it receives the abnormal warning signal. The first hardware watchdog 111 and the first software watchdog 112 are heterogeneous and redundant, and serve as backups for each other, which significantly improves the fault detection rate and effectively prevents the first master controller 110 from falsely operating normally.

[0031] In this embodiment, the heartbeat monitoring task includes, but is not limited to, airflow PID calculation tasks, communication parsing tasks, and sensor sampling tasks. The software watchdog can implement multi-level heartbeat monitoring using the FREE-RTOS task scheduler in the first main controller 110. In the FREE-RTOS task scheduler, each critical task periodically calls the task heartbeat update function (heartbeat_update(task_id)) to update the status identifier and heartbeat timestamp of the heartbeat monitoring task. The heartbeat timestamp records the system time point when the heartbeat monitoring task last successfully called heartbeat_update() to report live, used to monitor tasks and determine whether the task has timed out and failed to report live, resulting in a stuck or blocked exception. The status identifier is an identifier variable used to mark the current running stage and working state of the task, indicating whether the task is in a running, idle, scanning, sampling, or calculation state, supporting accurate fault location, hierarchical processing, and a false positive prevention mechanism.

[0032] In one embodiment, each level of heartbeat monitoring task corresponds to a different heartbeat timeout threshold. Exemplarily, the first software watchdog 112 is also used to determine whether the heartbeat timestamp of each level of heartbeat monitoring task is updated within the corresponding heartbeat timeout threshold. If the heartbeat timestamp is not updated within the heartbeat timeout threshold, the heartbeat monitoring task is determined to be malfunctioning; if the heartbeat timestamp is updated within the heartbeat timeout threshold, the heartbeat monitoring task is determined to be functioning normally.

[0033] In this embodiment, each heartbeat monitoring task corresponds to an independent timer, used to start timing from the previous heartbeat timestamp and determine whether the next heartbeat timestamp is updated within the heartbeat timeout threshold. Exemplarily, the heartbeat timing is based on the real-time clock (RTC) of the first main controller 110 or a separate hardware component, allowing timing to continue even when the first main controller 110 enters a low-power sleep mode, unaffected by this. The heartbeat timeout threshold is set according to the task's criticality. For example, the heartbeat timeout threshold for a communication task is set to 500ms, for an LED task to 0.5s, for an airflow PID calculation task to 0.2s (calculation time), for a communication parsing task to 5s, and for a sensor sampling task to 0.2s.

[0034] In another embodiment, the first software watchdog 112 is further configured to select whether to report an anomaly warning signal to the first master controller 110 based on the level of operational anomaly in the heartbeat monitoring task. If the level of operational anomaly in the heartbeat monitoring task is at level one, the anomaly warning signal and the status identifier of the heartbeat monitoring task are reported to the first master controller 110; if the level of operational anomaly in the heartbeat monitoring task is at level two, an anomaly log is recorded, allowing the first master controller 110 to continue running the heartbeat monitoring task.

[0035] In this embodiment, the system can select whether to report the abnormality level of the heartbeat monitoring task to the first main controller 110. Level 1 abnormality corresponds to severe and fatal abnormalities in the heartbeat monitoring task. In this case, the abnormality warning signal and the current status identifier of the heartbeat monitoring task can be promptly reported to the first main controller 110. The first main controller 110 can then promptly shut down the heartbeat monitoring task, enter safe mode, or restart the task and the entire machine. Level 2 abnormality corresponds to minor abnormalities in the heartbeat monitoring task. In this case, an abnormality log can be recorded, and the heartbeat monitoring task can continue running. The abnormality log is an automatically recorded collection of information indicating where, when, and what the abnormality occurred. It is used for fault tracing, status query, and maintenance diagnosis. For minor abnormalities, it only records non-critical fault records that do not affect normal operation.

[0036] For example, status identifiers include, but are not limited to, task lifecycle identifiers, functional stage identifiers, health / abnormality identifiers, and resource readiness identifiers. Task lifecycle identifiers indicate whether the heartbeat monitoring task has started, is executing, or has terminated normally. Examples include, but are not limited to, task start-running identifiers (TASK_RUNNING), task completion identifiers (TASK_COMPLETED), and task idle identifiers (TASK_IDLE). Functional stage identifiers identify the specific functional sub-stage the task is currently in. Functional stage identifiers include, but are not limited to, sensor sampling status identifiers (SENSOR_SAMPLING), PID algorithm calculation loop status identifiers (PID_CALCULATING), serial port receive status identifiers (UART_RECEIVING), and Bluetooth transmit ready status identifiers (BLE_TX_READY). Health / abnormality flags are used to indicate whether communication errors, verification failures, timeouts, or other abnormalities have occurred. Health / abnormality flags include, but are not limited to, the HEARTBEAT_OK flag, the TIMEOUT_PENDING flag, the DATA_CRC_ERROR flag, and the SENSOR_COMM_FAIL flag. Resource readiness flags are used to indicate whether dependent peripherals or resources are available. Resource readiness flags include, but are not limited to, the ADC sampling ready flag (ADC_READY), the UART_RX_BUF_VALID flag, and the WIFI_CONNECTED flag.

[0037] In one embodiment, when a heartbeat timeout triggers an alarm, the abnormal type of the heartbeat monitoring task can be immediately determined by reading the status identifier. Targeted recovery can be performed based on the status identifier without resetting the first main controller 110 as a whole, ensuring that other normal heartbeat monitoring tasks are not affected.

[0038] In one embodiment, the first master controller 110 is also used to control the heartbeat monitoring task to stop running and start a backup heartbeat monitoring task when receiving an abnormal warning and an abnormal status indicator. For example, when a sensor communication failure indicator is received, only that sensor is disabled and the backup sensor algorithm is enabled. The entire process does not require a complete reset of the first master controller 110, and it avoids the failure of the heartbeat monitoring task from causing the entire system to crash.

[0039] In one embodiment, the first master controller 110 is further configured to control the restart of the heartbeat monitoring task upon receiving an anomaly warning and a software infinite loop flag. For example, when a PID algorithm calculation loop status flag is received, the PID algorithm calculation task context is forcibly restarted. In this embodiment, a reset operation can be driven based on the status flag, and by accurately locating the anomaly type, a targeted and precise response to the task anomaly can be implemented, avoiding misjudgment and overreaction.

[0040] In one embodiment, the first software watchdog 112 is further configured to enter a low-power sleep mode when all heartbeat monitoring tasks are in the task idle state; the first software watchdog 112 is further configured to enter a normal operating mode when one or more heartbeat monitoring tasks are in the task execution state state. In this embodiment, the switching between the low-power sleep mode and the normal operating mode achieves real-time unification of security and energy saving, realizes auxiliary low-power management, and overcomes the inherent contradiction between high reliability and high power consumption of industrial controllers under harsh operating conditions.

[0041] In another embodiment, the first software watchdog 112 is also used to extend the heartbeat timeout threshold of the heartbeat monitoring task when the heartbeat monitoring task is in the task running special flag.

[0042] In this embodiment, some heartbeat monitoring tasks are inherently time-consuming, such as BLE (Bluetooth Low Energy) broadcast scanning tasks. By setting a dedicated task running identifier, their heartbeat threshold can be temporarily extended to prevent false triggering of the watchdog timer. For example, setting a Bluetooth scanning status identifier (BLE_SCANNING) for a BLE broadcast scanning task can extend its corresponding heartbeat timeout threshold when the first software watchdog 112 detects that the BLE broadcast scanning task is set to the Bluetooth scanning status identifier, thus avoiding task misjudgment due to long scanning operation time and improving monitoring accuracy and system stability.

[0043] In this embodiment, even if the software watchdog is bypassed or the hardware watchdog is misconfigured, the other party can still trigger a safety reset, significantly improving the fault detection rate. After the first master controller 110 malfunctions, it can automatically complete a safety reset and restore control within a short time without manual intervention. Combined with non-volatile memory recording fault logs, it facilitates post-event analysis, ensures the continuity of the ventilation system, and avoids pressure imbalance, cross-contamination, or temperature and humidity out of control due to master controller failure.

[0044] In one embodiment, such as Figure 2 As shown, the redundant watchdog system 100 also includes a second master controller 120, and the first master controller 110 is communicatively connected to the second master controller 120. Exemplarily, the second master controller 120 includes a second hardware watchdog 121 and a second software watchdog 122.

[0045] In one embodiment, the second master controller 120 is used to perform a reset operation on itself based on the second hardware watchdog 121 and the second software watchdog 122. Similarly, the second master controller 120 can perform the same functions as the first master controller 110 in the above embodiment, the second hardware watchdog 121 can perform the same functions as the first hardware watchdog 111 in the above embodiment, and the second software watchdog 122 can perform the same functions as the first software watchdog 112 in the above embodiment, thereby realizing the second master controller 120's own anomaly detection and reset.

[0046] In another embodiment, the second master controller 120 is further configured to send a reset signal and an abnormality warning signal to the first master controller 110 to perform a reset operation on the first master controller 110. The first master controller is further configured to send a reset signal and an abnormality warning signal to the second master controller 120 based on the first hardware watchdog 111 and the first software watchdog 112 to perform a reset operation on the second master controller 120.

[0047] In this embodiment, to prevent its own watchdog from malfunctioning, when its own watchdog fails to detect any anomalies for a period of time, the second master controller 120 can communicate with the first master controller 110 in real time. The first master controller 110 and the second master controller 120 can each send a "feed" signal to the other's hardware watchdog. If the other's hardware watchdog does not receive a "feed" signal within a preset time, it determines that the other party is malfunctioning and provides a reset signal, causing the other party's master controller to perform a hardware reset operation. The other party's software watchdog can also periodically update the status flags and heartbeat timestamps of each level of the other party's multi-level heartbeat monitoring task to determine if the other party's heartbeat monitoring task is malfunctioning, send an anomaly warning signal to the master controller, and send status flags through the communication interface, thereby enabling the other party's master controller to perform a targeted reset operation upon receiving the warning signal and status flag.

[0048] It is understandable that the first master controller 110 and the second master controller 120, while realizing their own abnormal monitoring, also realize mutual supervision to solve the risk of failure of their own watchdog and resulting loss of control, and ensure the reliability of the redundant watchdog system 100.

[0049] In another embodiment, such as Figure 3As shown, the redundant watchdog system 100 further includes a first anti-interference reset circuit 130 and a second anti-interference reset circuit 140. Exemplarily, the first anti-interference reset circuit 130 is connected to both the first master controller 110 and the second master controller 120, transmitting the reset signal and abnormal warning signal sent by the first master controller 110 to the second master controller 120 via electrical isolation. The second anti-interference reset circuit 140 is connected to both the second master controller 120 and the first master controller 110, transmitting the reset signal and abnormal warning signal sent by the second master controller 120 to the first master controller 110 via electrical isolation.

[0050] This embodiment addresses typical harsh application scenarios such as high altitude (e.g., altitude ≥ 3000 m), high temperature and humidity (e.g., temperature -30℃ to +70℃, humidity ≤ 95% RH), and strong electromagnetic interference (e.g., proximity to variable frequency fans, elevators, and radio frequency equipment). A first anti-interference reset circuit 130 and a second anti-interference reset circuit 140 are set between the first main controller 110 and the second main controller 120. The first anti-interference reset circuit 130 is connected to the signal generation terminal of the first main controller 110 and the signal receiving terminal of the second main controller 120, while the second anti-interference reset circuit 140 is connected to the signal generation terminal of the second main controller 120 and the signal receiving terminal of the first main controller 110. This provides electrical isolation, preventing external strong electrical noise from entering sensitive digital circuits through the reset line, ensuring a clean and stable reset pulse, and eliminating reset failures or repeated restarts caused by power supply fluctuations.

[0051] In one implementation, such as Figure 4 As shown, the first master controller 110 and the second master controller 120 communicate in full-duplex mode. Both the first anti-interference reset circuit 130 and the second anti-interference reset circuit 140 include a first filter capacitor (such as...). Figure 4 C1 and C4 shown), voltage regulator (such as Figure 4 U1 as shown), the second filter capacitor (as shown) Figure 4 C2 and C5 shown), transient voltage suppressor diode (such as ...)). Figure 4 TVS1 and TVS2 shown), first voltage divider resistor (as shown) Figure 4 R1 and R3 as shown), the third filter capacitor (as shown) Figure 4 C3 and C6 shown), optocoupler (such as Figure 4 (as shown in U2 and U3) and the second voltage divider resistor (such as Figure 4 (R2 and R4 are shown).

[0052] Exemplarily, the parallel node of the first filter capacitor and the voltage regulator is connected to the power supply. The parallel node of the voltage regulator, the second filter capacitor, and the transient voltage suppression diode is connected to the first voltage divider resistor. The parallel node of the first voltage divider resistor and the third filter capacitor is connected to the first main controller 110 or the second main controller 120, and the first input terminal of the optocoupler, respectively. The first output terminal of the optocoupler is connected to the second main controller 120 or the first main controller 110. The second input terminal of the optocoupler is grounded, and the second output terminal of the optocoupler is connected to the second voltage divider resistor. The first filter capacitor, the second filter capacitor, the third filter capacitor, the transient voltage suppression diode, and the second voltage divider resistor are all grounded to GND.

[0053] In this embodiment, the optocoupler input side uses an independent LDO power supply and is equipped with a TVS diode and a filter capacitor. The signal is rectified by RC to ensure that the minimum reset time requirement of the main controller is met. This anti-interference reset circuit design achieves coordinated defense of full-link electrical isolation and multi-level noise suppression, ensuring the reliable operation of the redundant watchdog system 100 under harsh conditions. Through the protection of filter capacitors, TVS transient clamping, independent LDO voltage regulation, and high-speed optocoupler isolation, the signal transmission interference path is cut off. Moreover, the circuit board layout strictly separates the digital ground and the isolation ground, with single-point connection to avoid direct common ground.

[0054] In one implementation, a four-layer circuit board (PCB) can be designed to achieve power isolation, signal isolation, and a good EMC (Electro-Magnetic Compatibility) layout. Dual watchdogs and an anti-interference reset circuit are integrated into the main controller motherboard. Fault injection and reliability testing are performed on the redundant watchdog system 100, simulating software faults such as program deadlock, stack overflow, and interrupt masking to verify whether the dual watchdogs can effectively trigger the reset. For example, ±4 kV Electrical Fast Transient (EFT), ±8 kV Electro-Static Discharge (ESD), and surge impacts are applied to test the reset circuit's immunity. A 72-hour aging test is conducted in a high-low temperature humidity test chamber to monitor the reset false trigger rate and system stability. Prototypes are deployed in typical harsh environments such as negative pressure wards in high-altitude hospitals, coastal high-humidity data centers, and industrial plants, and run continuously for more than 6 months, recording the number of faults, self-healing success rate, and airflow control deviation. Compared with the traditional single watchdog solution, the MTBF improvement effect and the reduction in operation and maintenance costs are verified.

[0055] In this embodiment, the design of the anti-interference reset circuit, after testing, enabled the redundant watchdog system 100 to pass the EMC test and operate reliably under extreme conditions such as altitude of 4000m, temperature of -30℃ to +70℃, and relative humidity of 95%, making it suitable for high reliability requirements in scenarios such as hospital isolation wards, high-altitude laboratories, and ship cabins.

[0056] This application also provides a variable air volume (VAV) valve control system, exemplary of which includes at least one VAV valve and a redundant watchdog system 100 as described in the above embodiment. A first master controller 110 and a second master controller 120 in the redundant watchdog system 100 control the valve opening of each VAV valve.

[0057] Since this variable air volume valve control system adopts the redundant watchdog system 100 of the above embodiment, it has all the advantages of the redundant watchdog system 100. It is understood that the options in the above embodiments also apply to this embodiment, and therefore will not be described again here.

[0058] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that, as an alternative implementation, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0059] In addition, the functional modules or units in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0060] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a smartphone, personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0061] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A redundant watchdog system, characterized in that, include: The first master controller includes a first hardware watchdog and a first software watchdog; The first master controller is used to provide a dog-feeding signal to the first hardware watchdog; The first hardware watchdog is used to provide a reset signal to the first master controller if the watchdog signal is not received within a preset time, so that the first master controller performs a hardware reset operation. The first software watchdog is used to periodically update the status identifier and heartbeat timestamp of each level of the heartbeat monitoring task in the multi-level heartbeat monitoring task, and to determine whether the heartbeat monitoring task at each level is running abnormally based on the heartbeat timestamp, and to send an abnormal warning signal to the first master controller; The first master controller is used to perform an abnormal reset operation based on the status identifier of the heartbeat monitoring task when the abnormal warning signal is received.

2. The redundant watchdog system according to claim 1, characterized in that, Also includes: The second master controller is communicatively connected to the first master controller; The second master controller includes a second hardware watchdog and a second software watchdog; The second master controller is used to perform a reset operation on itself based on the second hardware watchdog and the second software watchdog, and to send the reset signal and the abnormal warning signal to the first master controller to perform a reset operation on the first master controller; The first master controller is also used to send the reset signal and the abnormal warning signal to the second master controller based on the first hardware watchdog and the first software watchdog, and to perform a reset operation on the second master controller.

3. The redundant watchdog system according to claim 2, characterized in that, Also includes: First anti-interference reset circuit and second anti-interference reset circuit; The first anti-interference reset circuit is connected to the first main controller and the second main controller respectively, and transmits the reset signal and the abnormal warning signal sent by the first main controller to the second main controller through electrical isolation; The second anti-interference reset circuit is connected to the second main controller and the first main controller respectively, and transmits the reset signal and the abnormal warning signal sent by the second main controller to the first main controller through electrical isolation.

4. The redundant watchdog system according to claim 1, characterized in that, The heartbeat monitoring tasks at each level correspond to different heartbeat timeout thresholds; The first software watchdog is also used to determine whether the heartbeat timestamp of each level of the heartbeat monitoring task is updated within the corresponding heartbeat timeout threshold. If the heartbeat timestamp is not updated within the heartbeat timeout threshold, the heartbeat monitoring task is determined to be running abnormally. If the heartbeat timestamp is updated within the heartbeat timeout threshold, the heartbeat monitoring task is determined to be operating normally.

5. The redundant watchdog system according to claim 4, characterized in that, The first software watchdog is also used to select whether to report the abnormal warning signal to the first main controller based on the abnormality level of the heartbeat monitoring task. If the abnormality level of the heartbeat monitoring task is at level one, the abnormality warning signal and the status identifier of the heartbeat monitoring task will be reported to the first master controller. If the heartbeat monitoring task experiences an anomaly at level two, an anomaly log is recorded, allowing the first main controller to continue running the heartbeat monitoring task.

6. The redundant watchdog system according to claim 1, characterized in that, The status identifier includes one or more of the abnormal status identifier and the software infinite loop identifier; The first master controller is also used to control the heartbeat monitoring task to stop running and start a backup heartbeat monitoring task when it receives the abnormal warning and the abnormal status identifier. The first master controller is also used to control the restart of the heartbeat monitoring task upon receiving the abnormal warning and the software dead loop flag.

7. The redundant watchdog system according to claim 1, characterized in that, The status identifier includes one or more of the task idle identifier and the task start execution identifier; The first software watchdog is also used to enter a low-power sleep mode when all the heartbeat monitoring tasks are in the task idle state. The first software watchdog is also used to enter normal working mode when one or more of the heartbeat monitoring tasks are in the condition that the task starts execution flag is displayed.

8. The redundant watchdog system according to claim 1, characterized in that, The status identifier includes a task-specific identifier; The first software watchdog is also used to extend the heartbeat timeout threshold of the heartbeat monitoring task when the heartbeat monitoring task is under the condition of the task running special identifier.

9. The redundant watchdog system according to claim 3, characterized in that, Both the first anti-interference reset circuit and the second anti-interference reset circuit include a first filter capacitor, a voltage regulator, a second filter capacitor, a transient voltage suppression diode, a first voltage divider resistor, a third filter capacitor, an optocoupler, and a second voltage divider resistor; The parallel node of the first filter capacitor and the voltage regulator is connected to the power supply, and the parallel node of the voltage regulator, the second filter capacitor, and the transient voltage suppression diode is connected to the first voltage divider resistor; The parallel node of the first voltage divider resistor and the third filter capacitor is respectively connected to the first main controller or the second main controller and the first input terminal of the optocoupler, and the first output terminal of the optocoupler is connected to the second main controller or the first main controller; The second input terminal of the optocoupler is grounded, and the second output terminal of the optocoupler is connected to the second voltage divider resistor; The first filter capacitor, the second filter capacitor, the third filter capacitor, the transient voltage suppression diode, and the second voltage divider resistor are all grounded.

10. A variable air volume valve control system, characterized in that, include: At least one variable air volume valve and a redundant watchdog system as described in any one of claims 1-9.

Images