Anti-interference redundant control module of fire pump controller and control method thereof

Abstract

The application discloses a kind of anti-interference redundancy control methods of fire pump controller, belong to fire pump control technical field, solve the problem that the health state of backup kernel itself is unknown when dual-kernel redundancy switches, main kernel cannot be trusted after failure Determining its recovery and the self-adaptive capacity is insufficient under extreme working conditions.The method comprises: deploying dual-kernel architecture including main control kernel and backup kernel;The main control kernel generates a takeover request when detecting that the output logic of itself is abnormal;The backup kernel performs a quick self-test before taking over, and can take over after passing;The main control kernel is switched to a listening verification mode, and calculates a consistency score based on the normal control logic model in the hardware write-protected read-only memory area, and recovers the right when the score continuously reaches the recovery threshold.The method is mainly used for fire pump control system, can realize high-reliability redundancy switching and fault recovery, and is suitable for strong electromagnetic interference, high temperature and other extreme working conditions, to improve the operation reliability and survivability of fire pump controller.

Description

Technical Field

[0001] This invention relates to the field of fire pump control technology. More specifically, this invention relates to an anti-interference redundancy control method for a fire pump controller. Background Technology

[0002] Fire pump controllers are core equipment in fire protection systems used to drive and control the operation of fire pump sets, and their reliability directly affects the effectiveness of fire emergency response. In applications such as building fire protection, petrochemical facility fire protection, and ship fire protection, fire pump controllers need to operate stably for extended periods under extreme conditions such as strong electromagnetic interference, high temperature and humidity, vibration and shock, while also meeting the low failure rate requirements of international standards such as NFPA20.

[0003] Currently, known fire pump controllers on the market typically employ a single-core microcontroller or a simple dual-machine hot standby architecture. In the single-core solution, a logic anomaly in the controller's main chip can lead to a complete loss of control of the fire pump group. In the dual-machine hot standby solution, only a simple state copy is performed during the master-slave switchover, without verifying the health status of the backup kernel itself.

[0004] The existing dual-machine hot standby solution has the following problems:

[0005] Traditional switching mechanisms only perform switching when the main kernel detects its own abnormality, without considering whether the backup kernel itself is in a state where it can perform control tasks normally. In a dual-fault scenario where both the main kernel and the backup kernel are faulty, the system will perform an incorrect handover, resulting in the fire pump group still not being able to obtain effective control.

[0006] When the main kernel switches to backup mode after a failure, it usually needs to rely on its own logic to determine whether it has recovered. However, since the reference instruction value is generated by itself, the reference value itself is unreliable when its own logic is disordered. There is a logical paradox of "self-reference verification", which makes the system unable to reliably confirm whether the main kernel has truly recovered and reclaimed control privileges.

[0007] The anti-interference design of existing controllers is mostly based on static and fixed parameter configurations. After a failure occurs, the control strategy cannot be adjusted according to the extreme environmental conditions at that time, which causes the backup kernel to continue to operate according to the normal parameters in strong electromagnetic or high temperature environments, resulting in insufficient reliability.

[0008] Therefore, it is necessary to provide an anti-interference redundancy control scheme for fire pump controllers that can achieve reliable redundant switching under extreme operating conditions, has a self-checking and verification mechanism, and can adaptively adjust control parameters. (Summary of the Invention)

[0009] One object of the present invention is to provide an anti-interference redundancy control method for a fire pump controller, comprising:

[0010] The system is deployed with a dual-kernel architecture, which includes a main control kernel and a backup kernel. The main control kernel is used to execute the core control logic of the fire pump unit and to mirror system status parameters and operation logs to the backup kernel in real time.

[0011] The main control kernel continuously performs self-checks. When it detects an abnormality in its own output logic, it actively generates a takeover request and sends it to the backup kernel.

[0012] Upon receiving the takeover request, the backup kernel first performs a quick self-check before taking over control authority. The quick self-check is used to confirm that the backup kernel's own logical units, verification instruction generation module, and communication interface are in normal condition. If the quick self-check fails, the takeover request is rejected and an alarm signal is generated. If the quick self-check passes, the subsequent takeover is performed.

[0013] The backup kernel takes over control within a preset switching threshold time. Simultaneously, the main control kernel switches to monitoring and verification mode, stops controlling the fire pump group, monitors the output commands of the backup kernel, and calculates the consistency between the monitored commands and its own preset normal control logic model using the following formula: Where C(t) is the consistency score, with a value range of [0, 1], and n is the number of observed samples, I bk (t i ) represents the value of the backup kernel output instruction obtained through monitoring, I ref (t i The reference instruction value output by the pre-configured normal control logic model of the main kernel, T s The sampling period is ϵ, the allowable deviation threshold is ϵ, and I(·) is the indicator function, which is 1 if the condition is met and 0 otherwise.

[0014] The normal control logic model pre-set in the main kernel is stored in a read-only memory area inside the main kernel that is protected by a hardware write protection mechanism. Its core calculation logic and parameters are solidified after the chip is fabricated and cannot be modified by software instructions or external interference.

[0015] When C(t) reaches the preset recovery threshold C within a preset observation period and a preset number of consecutive sampling periods, th If the main kernel has recovered, it is determined that the kernel has returned to normal, and a permission revocation request is actively sent.

[0016] After receiving the recycling request, the backup kernel synchronizes the latest system status and logs to the main control kernel, returns control, and restores the normal mode where the main kernel dominates and the backup kernel performs verification.

[0017] Preferably, the continuous self-testing step of the main control kernel includes:

[0018] The main control kernel has a built-in logic exception detection unit. During each control cycle, this unit collects the control command value I output by the main control kernel. m (t) and the verification instruction value I output by the backup kernel b (t), and calculate the real-time deviation between the two ΔI(t) = |I m (t)-I b (t)|, when the real-time deviation ΔI(t) is greater than the preset command deviation threshold ΔI for N consecutive control cycles. th If this occurs, the main control kernel will determine that the output logic is abnormal and will actively generate a takeover request.

[0019] The logic anomaly detection unit monitors the verification instruction value I output by the backup kernel. b If the variance of I(t) varies over N consecutive control periods, then... b If the variance of ΔI(t) exceeds the preset stability threshold, then regardless of the magnitude of ΔI(t), it is determined that there is an unknown fault in the system, thereby triggering an audible and visual alarm and forcing the system to enter safe mode, rather than simply performing a master-slave switchover.

[0020] Preferably, the step of the backup kernel taking over control within a preset switchover threshold time includes:

[0021] Upon receiving the takeover request, the backup kernel starts its built-in timer and, within a preset switching threshold time, configures the core control parameters pre-stored in the backup kernel as the currently effective control parameters. At the same time, it directly maps the calculation results of the backup kernel to the drive port of the fire pump set for takeover control authority.

[0022] The core control parameters include the switching logic parameters between the main pump and the standby pump, the overload protection threshold parameters, and the linkage control logic parameters.

[0023] Preferably, the step of switching the main control kernel to the monitoring and verification mode includes:

[0024] After the logic anomaly detection unit determines that the main control kernel is outputting a logic anomaly and completes the transfer of authority, the main control kernel switches its internal instruction output register to a listening state. The main control kernel then directly reads the output instruction value I written by the backup kernel to the pump group driver port via the data bus. bk (t), and no longer write its own calculation instruction value;

[0025] The main control kernel will listen to the I bk (t) retrieves the reference instruction value I at the same time point as the preset normal control logic model from the hardware write-protected read-only memory area. ref(t) performs item-by-item pairing, and the paired data is stored in the verification buffer inside the main control kernel for calculating the consistency score C(t).

[0026] Preferably, the step of configuring the pre-stored core control parameters in the backup kernel to the currently effective control parameters includes:

[0027] After receiving the takeover request, the backup kernel first accesses its internal pre-stored parameter storage area, which is divided into a parameter update area and a parameter activation area.

[0028] Among them, the backup kernel continuously synchronizes the current core control parameters of the main control kernel to the parameter update area through the mirroring process. Before receiving the takeover request, the parameter effective area stores the historical parameter set that has been verified by the backup kernel in the previous license period.

[0029] Upon receiving a takeover request, the backup kernel copies the latest synchronized parameter set from the parameter update area to the parameter effective area and immediately uses the parameters in the parameter effective area as the current control parameters.

[0030] Preferably, the step of the main control kernel actively sending a permission revocation request includes:

[0031] In monitor and verification mode, the main control kernel continuously reaches the recovery threshold C through the consistency score C(t). th Then, perform the following operations to generate a permission revocation request data packet:

[0032] The main control kernel retrieves all paired data since the last privilege revocation from the verification buffer and calculates the consistency score sequence for that period. , ,..., }, from which the maximum value C is selected. max ;

[0033] The main control kernel reads its internally maintained system clock and obtains the value of the last recovery threshold C. th Timestamp T pass And calculate the observation duration ΔT=T from the first time the recovery threshold was reached to the current time. current -T first , among which, T first T is the time stamp when the recovery threshold is first reached. current This is the current timestamp;

[0034] The main control kernel calls its internal status register to read the current main control kernel status code S. core The status codes include the self-test pass flag, the clear flag of the logic exception detection unit, and the kernel temperature status bit.

[0035] The main control kernel will set the maximum consistency score C. max Observation duration ΔT and main control kernel status code S core The data is spliced ​​and encoded to form a permission revocation request data packet with a fixed data frame format, and then sent to the backup kernel through an internal dedicated communication channel.

[0036] Preferably, after the main control kernel regains control, the steps to restore the normal mode of main kernel dominance and backup kernel verification include:

[0037] During the first control cycle after regaining control, the main control kernel will output the instruction value I. m (t) and backup kernel output instruction value I b (t) Simultaneously write to the preset comparison register;

[0038] The comparison register has a built-in hardware comparator that calculates the difference ΔI between the two values. new (t)=∣I m (t)-I b (t)∣;

[0039] If the difference is less than or equal to the preset stability threshold ΔI for three consecutive control cycles, stable If the dual kernels have entered a stable synchronization state, the main control kernel will restore the mirroring frequency of the system status parameters and running logs from the enhanced mode during the takeover period to the preset mirroring cycle of the normal mode.

[0040] Preferably, the step of the backup kernel synchronizing the latest system status and logs to the main control kernel includes:

[0041] Upon receiving the permission revocation request, the backup kernel first suspends its own execution of the pump group control logic and reads its internally maintained synchronization status counter to obtain the number N of new data added since the last synchronization. delta During the pause of the pump control logic, the backup kernel keeps the current value in the output register of its drive port unchanged, and the fire pump unit continues to operate according to the last control instruction before the pause.

[0042] The backup kernel is based on the number of new data N. delta Extract the corresponding new data fragments from the storage area of ​​system status and logs, and package the new data fragments together with the starting address pointer and length information of the data fragments to form an incremental synchronization data packet;

[0043] The backup kernel sends the incremental synchronization data packet to the main control kernel through the internal dedicated communication channel. The main control kernel writes the received incremental data fragment to the corresponding position in its own storage area according to the starting address pointer and length information.

[0044] Preferably, after the backup kernel takes over control, the steps for the backup kernel to execute the core control logic of the fire pump group include:

[0045] After taking over control, the backup kernel reads its internally stored running mode configuration table, which contains the normal mode parameter set and the extreme mode parameter set.

[0046] The backup kernel matches the corresponding operating mode from the operating mode configuration table based on the environmental parameters in the system snapshot information at the time of the failure handed over by the main control kernel, including electromagnetic interference intensity value and ambient temperature value;

[0047] When the matching result is extreme mode, the backup kernel enables the extreme mode parameter set, which includes: the pump group start-stop response time is shortened to 50% of the normal mode response time, the main and backup pump switching action interval is shortened to 60% of the normal mode switching interval, and the fault alarm threshold is reduced to 80% of the normal mode alarm threshold.

[0048] An anti-interference redundant control module for a fire pump controller is provided for executing the method, including:

[0049] The main control kernel is used to execute the core control logic of the fire pump set and generate system status parameters and operation logs in real time.

[0050] The backup kernel is connected to the main control kernel and is used to receive and mirror the system status parameters and operation logs of the main control kernel.

[0051] The logic anomaly detection unit, integrated into the main control kernel, is used to collect the control command value output by the main control kernel and the verification command value output by the backup kernel in each control cycle. When the deviation between the two is greater than a preset threshold in N consecutive control cycles, the main control kernel is determined to be abnormal and a takeover request is generated.

[0052] A rapid self-test unit, integrated in the backup kernel, is used to perform a rapid self-test on the health status of the backup kernel after it receives the takeover request and before it executes the control authority takeover. If the self-test fails, the takeover request is rejected and an alarm signal is generated.

[0053] The monitoring and verification unit, integrated into the main control kernel, is used to stop the control of the fire pump group and switch to monitoring mode after the backup kernel takes over the control authority. It monitors and calculates the consistency score between the output instructions of the backup kernel and its own preset normal control logic model.

[0054] The normal control logic model inside the main control kernel is permanently stored in a read-only memory area protected by a hardware write protection mechanism.

[0055] The permission revoke unit, integrated in the main control kernel, is used to generate and send permission revoke requests to the backup kernel when the consistency score continuously reaches the preset recovery threshold.

[0056] The present invention has at least the following beneficial effects:

[0057] First, this invention allows the backup kernel to perform a quick self-check after the main control kernel detects an abnormality in its own output logic, before taking over control authority. This ensures that the backup kernel's own logic units, verification instruction generation module, and communication interface are in normal condition before allowing takeover. This avoids erroneous handover in the rare dual-fault scenario where both the main kernel and the backup kernel are abnormal, thus improving the reliability of redundancy switching.

[0058] Secondly, this invention stores the normal control logic model pre-set by the main control kernel in a read-only memory area protected by a hardware write protection mechanism. After the chip is fabricated, the core calculation logic and parameters are solidified. In the monitoring and verification mode, the reference instruction value extracted by the main control kernel from this read-only memory area always represents the ideal and absolutely correct control behavior. There is no situation where it provides an incorrect reference value due to its own failure. This fundamentally solves the logical paradox of traditional self-reference verification, enabling the system to reliably determine whether the main kernel has recovered to normal and reclaim control authority.

[0059] Third, the present invention uses a logic anomaly detection unit to simultaneously monitor the instruction deviation between the main control kernel and the backup kernel, as well as the variance of the output instructions of the backup kernel. When the variance exceeds a preset stability threshold, regardless of the magnitude of the deviation, the system is determined to have an unknown fault and is forced to enter a safe mode. This effectively distinguishes between main kernel faults and output jitter caused by external interference or sensor noise, thus avoiding unnecessary false switching.

[0060] Fourth, this invention automatically matches the operating mode based on the environmental parameters in the system snapshot information at the time of failure handed over by the main control kernel after the backup kernel takes over the control authority. When the matching result is extreme mode, the adjusted extreme mode parameter set is enabled, so that the backup kernel can operate in a more conservative and sensitive manner under extreme conditions such as strong electromagnetic fields or high temperatures, thereby improving the system's adaptability and survivability in harsh environments.

[0061] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Detailed Implementation

[0062] The present invention will now be described in further detail with reference to the accompanying drawings, so that those skilled in the art can implement it based on the description.

[0063] It should be noted that, unless otherwise specified, the experimental methods described in the following implementation plan are all conventional methods, and the reagents and materials described are all commercially available unless otherwise specified.

[0064] This invention provides an anti-interference redundancy control method for a fire pump controller, comprising:

[0065] The system employs a dual-core architecture comprising a main control kernel and a backup kernel. The main control kernel executes the core control logic of the fire pump unit and mirrors system status parameters and operation logs to the backup kernel in real time. Specifically, the main control kernel and the backup kernel can be integrated into the same dual-core processor chip. This chip adopts a multi-core architecture, with the two processor cores sharing the chip's internal bus, memory, and peripheral resources, but each having its own independent cache and interrupt controller. This chip can be installed in the center of the printed circuit board of the fire pump controller and connected to peripheral circuits through its pins. In each control cycle, the main control kernel collects sensor data, runs a preset control algorithm, generates control commands, and outputs them to the fire pump unit through the drive port. Simultaneously, it packages the collected system status parameters and operation logs into a fixed data frame format and sends them to the backup kernel through the internal communication bus. The backup kernel receives these and stores them in its dedicated storage area, which can be the static random access memory or flash memory within the backup kernel chip.

[0066] The main control kernel continuously performs self-checks. When it detects an abnormality in its own output logic, it actively generates a takeover request and sends it to the backup kernel. Specifically, the main control kernel has a built-in logic abnormality detection unit. This logic abnormality detection unit checks whether its own output is abnormal in each control cycle. When an abnormality is detected, the main control kernel generates a takeover request data packet containing an abnormality type code and a timestamp, and sends the request to the backup kernel through a dedicated interrupt signal line and data bus. The control cycle can be selected as a value between 1 and 20 ms, for example, 5 ms.

[0067] Upon receiving the takeover request, the backup kernel first performs a quick self-check before taking over control. This quick self-check confirms that the backup kernel's own logic units, verification instruction generation module, and communication interfaces are in normal working order. If the quick self-check fails, the takeover request is rejected and an alarm signal is generated. If the quick self-check passes, subsequent takeover proceeds. Specifically, to address the blind switching problem in existing technologies where the main kernel fails, this invention adds a quick self-check step before the backup kernel takes over control. This self-check is triggered by an independent hardware monitoring circuit and occurs within a very short time, for example, 5 seconds. Within μs, the system completes integrity checks on the backup kernel's core arithmetic unit, verification instruction generator, and inter-core communication interface. The rapid self-test process first executes a set of predefined test instructions on the backup kernel's arithmetic logic unit, including addition, subtraction, multiplication, and division operations, and compares the results with pre-stored standard results. Then, it performs a self-test on the verification instruction generation module, which generates a set of known verification instruction sequences and compares them with pre-stored standard sequences. Finally, it performs a loopback test on the communication interface, sending test data and verifying the correctness of the received data through an internal loopback mode. Only when all checks pass and the backup kernel itself is confirmed to be in a completely healthy and executable state will the subsequent takeover logic proceed. If the backup kernel self-test fails, the system will determine it as an untrusted node, thereby refusing the switchover and activating the highest level alarm. This design effectively avoids erroneous handover in the rare dual-failure scenario where both the main kernel and the backup kernel fail simultaneously.

[0068] The backup kernel takes over control within a preset switching threshold time. Simultaneously, the main control kernel switches to monitoring and verification mode, stops controlling the fire pump group, monitors the output commands of the backup kernel, and calculates the consistency between the monitored commands and its own preset normal control logic model using the following formula: Where C(t) is the consistency score, with a value range of [0, 1], and n is the number of observed samples, I bk (t i ) represents the value of the backup kernel output instruction obtained through monitoring, I ref (t i The reference instruction value output by the pre-configured normal control logic model of the main kernel, T s The sampling period is T, ϵ is the allowable deviation threshold, and I(·) is the indicator function, which is 1 if the condition is met and 0 otherwise. Specifically, the switching threshold time can be selected as a value between 5 and 20 ms, for example, 10 ms, and the sampling period T is T. s The timeout can be selected as a value between 1 and 10 ms, for example, 5 ms. The allowable deviation threshold can be selected as a value between 0.5% and 5%, for example, 2%. The number of observation samples n can be selected as a value between 10 and 100, for example, 50. The derivation of the formula is as follows: First, define the absolute value of the bias d of the i-th observation sample. i =|I bk (t i )-I ref (t i )|, where t i =t-i×T s Define the indicator function I(d) i < When d i Less than the allowable deviation threshold The time function value is 1 if it is not 1, and 0 otherwise. The number of samples that satisfy the bias condition among all n observation samples is... The consistency score C(t) is defined as the ratio of the number of samples that meet the conditions to the total number of samples, i.e., C(t) = S / n. When all samples meet the deviation conditions, C(t) = 1, indicating complete consistency; when no samples meet the conditions, C(t) = 0, indicating complete inconsistency. This formula essentially measures the proportion of the deviation between the backup kernel output instruction and the reference instruction that is less than the allowable threshold within n consecutive sampling periods. The higher the proportion, the better the consistency. After the main control kernel switches to the listening and verification mode, its internal instruction output register is switched to the listening state. The main control kernel no longer writes the calculated instruction value to the drive port, but directly reads the output instruction value written by the backup kernel to the fire pump group drive port through the data bus. The read backup kernel output instruction value is paired item by item with the reference instruction value output by the self-preset normal control logic model at the same time point read from the hardware write-protected read-only memory area. The paired data is stored in the verification buffer inside the main control kernel.

[0069] The pre-configured normal control logic model of the main kernel is stored in a read-only memory area protected by hardware write protection within the main kernel. Its core calculation logic and parameters are fixed after chip fabrication and cannot be modified by software instructions or external interference. Specifically, to solve the problem of the main kernel referencing instruction value I in monitor mode... ref To address the reliability issue of (t), the normal control logic model of this invention is implemented as a baseline model. The core algorithms of this model, such as PID coefficients, logical judgment rules, and key parameters, are fixed during the chip design phase and stored in a specially allocated read-only memory area within the main control kernel, protected by chip hardware write protection mechanisms such as eFuse (one-time programmable fuse) or ROM with a physical anti-tampering layer. Any external software interference, electromagnetic radiation, or abnormal operating environment, such as kernel logic disorder, cannot modify the contents of this read-only area. Therefore, in monitoring mode, the I extracted by the main control kernel... ref (t) always represents ideal and absolutely correct control behavior, and there is no situation where it provides an incorrect reference value due to its own failure, thus solving the paradox of self-reference verification from the root.

[0070] When C(t) reaches the preset recovery threshold C within a preset observation period and a preset number of consecutive sampling periods, th If the main kernel recovers to normal, it will actively send a permission revocation request. Specifically, the preset observation duration can be selected as a value between 2 and 10 seconds, such as 5 seconds, and the recovery threshold can be selected as a value between 0.85 and 0.98, such as 0.95. When the consistency score continuously reaches the recovery threshold, the main control kernel determines that it has recovered to normal, generates a permission revocation request data packet containing a recovery confirmation flag and current status information, and sends it to the backup kernel through the internal communication bus.

[0071] After receiving the recycling request, the backup kernel synchronizes the latest system status and logs to the master kernel, and then relinquishes control, restoring the normal mode where the master kernel is in control and the backup kernel is verifying. Specifically, the backup kernel packages the latest system status parameters and runtime log data stored in its memory and sends them to the master kernel via the communication bus. The master kernel updates its own storage area based on the received data. Subsequently, the backup kernel relinquishes control, and the control signal selector switches the drive signal source from the backup kernel back to the master kernel, restoring the normal working mode where the master kernel is in control and the backup kernel is verifying.

[0072] The above methods enable reliable redundancy switching of the fire pump controller in the event of a main kernel failure. By introducing a pre-takeover self-check mechanism, the risk of switching is avoided even when the backup kernel itself is faulty, thus improving the reliability of the dual-kernel redundancy architecture. By storing the normal control logic model in a hardware write-protected read-only memory area, the absolute correctness of the reference instructions is ensured, resolving the logical paradox of not being able to reliably determine whether the main kernel has recovered after a failure. Through the monitoring and verification mode, the main kernel can regain control after the fault is recovered, achieving a smooth transition of the system from a fault state to a normal state without manual intervention or system reset.

[0073] In another technical solution, the continuous self-testing steps of the main control kernel include:

[0074] The main control kernel has a built-in logic exception detection unit. During each control cycle, this unit collects the control command value I output by the main control kernel. m (t) and the verification instruction value I output by the backup kernel b (t), and calculate the real-time deviation between the two ΔI(t) = |I m (t)-I b (t)|, when the real-time deviation ΔI(t) is greater than the preset command deviation threshold ΔI for N consecutive control cycles. thIf the main control kernel outputs a logical error, it is determined that the main control kernel is abnormal, and a takeover request is actively generated. Specifically, the number of consecutive abnormality determinations N can be selected as a value between 3 and 20, for example, 5, and the instruction deviation threshold I... th The value can be selected as 1% to 10% of the rated output value, for example, 5%. The logic anomaly detection unit can be implemented using the digital logic module in a field-programmable gate array (FPGA) chip. This chip is internally configured with multiple comparators, counters, accumulators, and registers, and acquires I at the beginning of each control cycle. m (t) and I b The first comparator calculates the difference between the two and takes the absolute value to obtain I(t). The first counting and comparison module internally maintains a counter. When I(t) is greater than I... th The counter increments by 1 if the counter is not incremented, otherwise it is reset to zero. When the counter value reaches N, a high-level signal is output to the interrupt request input pin of the main control core.

[0075] The logic anomaly detection unit monitors the verification instruction value I output by the backup kernel. b If the variance of I(t) varies over N consecutive control periods, then... b If the variance of ΔI(t) exceeds a preset stability threshold, regardless of the magnitude of ΔI(t), an unknown fault is determined to exist in the system, thereby triggering an audible and visual alarm and forcing the system into a safe mode, rather than simply performing a master-slave switchover. Specifically, the stability threshold can be selected as a value between 0.5% and 5% of the variance of the rated output value, for example, 2%. The variance calculation module inside the logic anomaly detection unit receives I... b (t), this module internally maintains a shift register of length N, and in each control cycle, it shifts the latest I... b The (t) value is shifted into the register, and the variance calculation module calculates the variation variance. If the variance value exceeds the stability threshold, a high-level signal is output and connected to the system safety mode control signal line and the audible and visual alarm drive circuit. The system safety mode control signal line is connected to the safety mode input pin of the main control core and the backup core. When the signal is high, both cores stop executing normal control logic and switch the drive signal of the fire pump group to the preset safety state. The audible and visual alarm drive circuit drives the light-emitting diode to flash and the buzzer to emit intermittent sounds.

[0076] In another technical solution, the step of the backup kernel taking over control within a preset switchover threshold time includes:

[0077] Upon receiving the takeover request, the backup kernel starts its built-in timer and, within a preset switching threshold time, configures the pre-stored core control parameters in the backup kernel as the currently effective control parameters. Simultaneously, it directly maps the calculation results of the backup kernel to the drive port of the fire pump unit for takeover control. Specifically, the switching threshold time can be selected as a value between 2 and 50 ms, for example, 10 ms. The backup kernel first starts its built-in timer module, sets the initial count value and auto-reload value of the timer, and generates a timer interrupt after a preset switching threshold time. Then it accesses its internal parameter storage area and reads the pre-stored core control parameters into the working register. The reading process of these core control parameters adopts the direct memory access method. The direct memory access controller reads the parameter data from the flash memory and writes it directly into the working register without occupying the processing time of the central processing unit. The generated drive instructions are directly written to the output register of the drive port through the direct memory access controller. Each bit of the output register corresponds to the drive signal of a power transistor. The output register of the backup kernel and the output register of the main control kernel are connected to the actual drive line through a hardware selector. After the backup kernel takes over the control authority, the control signal of the hardware selector is controlled by the backup kernel, switching the drive signal source from the main control kernel to the backup kernel.

[0078] The core control parameters include switching logic parameters for the main pump and the standby pump, overload protection threshold parameters, and linkage control logic parameters. Specifically, the switching logic parameters for the main pump and the standby pump may include a switching delay time, which can be selected as a value between 1 and 30 seconds, such as 5 seconds. The rotation cycle for automatically switching to the standby pump after the main pump has run for a preset time can be selected as a value between 24 and 168 hours, such as 72 hours. The overload protection threshold parameters may include a percentage overload value of the rated current, which can be selected as a value between 105% and 150%, such as 120%. The overload duration can be selected as a value between 1 and 60 seconds, such as 10 seconds. The linkage control logic parameters may include a linkage delay time with other fire-fighting equipment, which can be selected as a value between 0 and 10 seconds, such as 2 seconds.

[0079] In another technical solution, the step of switching the main control kernel to the monitoring and verification mode includes:

[0080] After the logic anomaly detection unit determines that the main control kernel is outputting a logic anomaly and completes the transfer of authority, the main control kernel switches its internal instruction output register to a listening state. The main control kernel then directly reads the output instruction value I written by the backup kernel to the pump group driver port via the data bus. bk(t), instead of writing its own computational instruction value; specifically, the main control kernel configures its internal bus control register to set the direction of the instruction output register to input, so that it no longer drives data to the bus, but reads data from the bus. The main control kernel's bus controller sets the read / write control bit of the instruction output register to read-only mode, making it a listening node. The output instruction value written by the backup kernel to the drive port is transmitted through the bus. The main control kernel's instruction output register, as a slave device on the bus, receives data from the bus and stores it in its data register. The main control kernel's central processing unit reads the listened-in output instruction value I from the data register in each control cycle. bk (t), the data bus can be selected as a serial peripheral interface bus or an internal integrated circuit bus, and the operating speed can be selected as a value between 1 and 50 Mbps, for example 10 Mbps;

[0081] The main control kernel will listen to the I bk (t) retrieves the reference instruction value I at the same time point as the preset normal control logic model from the hardware write-protected read-only memory area. ref (t) performs item-by-item pairing, and the paired data is stored in the verification buffer inside the main control kernel for calculating the consistency score C(t); specifically, the capacity of the verification buffer can be selected as a value between 256 and 4096 bytes, for example, 1024 bytes, which can store at least 50 pairs of instruction value samples. The main control kernel will I bk (t) and I ref (t) Paired in chronological order, each pair of data contains a timestamp, I bk (t) value and I ref The (t) value, the paired data is written to the verification buffer in sequence. The verification buffer adopts the management method of circular buffer. When the amount of data written reaches the buffer capacity, the new data overwrites the oldest data, ensuring that the buffer always stores the paired data within the most recent period.

[0082] In another technical solution, the step of configuring the pre-stored core control parameters in the backup kernel as the currently effective control parameters includes:

[0083] After receiving a takeover request, the backup kernel first accesses its internal pre-stored parameter storage area, which is divided into a parameter update area and a parameter activation area. Specifically, the parameter update area and the parameter activation area can each occupy two independent sectors of the backup kernel's internal flash memory. The capacity of each sector can be selected as a value between 4 and 64 KB, for example, 16 KB. The backup kernel's flash memory can be divided into multiple sectors, with two sectors serving as the parameter update area and the parameter activation area, respectively. The parameter update area and the parameter activation area are physically two contiguous storage areas in the flash memory. Reading and writing are performed through sector erasure and page programming operations in the flash memory. The backup kernel also includes a direct memory access controller for data copying operations between flash memory areas.

[0084] The backup kernel continuously synchronizes the current core control parameters of the main control kernel to the parameter update area through a mirroring process. Before receiving a takeover request, the parameter validity area stores the historical parameter set that has been verified by the backup kernel in the previous licensing cycle. Specifically, the licensing cycle refers to the cycle corresponding to the license signal sent by the main control kernel at the end of each parameter synchronization cycle. The license signal indicates that the current parameters have been running stably for a complete control cycle. In normal operating mode, the main control kernel packages its currently used core control parameters into data frames in each parameter synchronization cycle and sends them to the backup kernel through the internal communication bus. After receiving the data frames, the backup kernel writes them to the database. The parameter update area is written using an erase-then-write method. Before each write operation, the entire contents of the parameter update area are erased, and then the new parameter data is written. After the write is completed, the backup kernel performs verification operations, including cyclic redundancy check and summation check, to ensure the correctness of the written data. Before receiving a takeover request, the parameter effective area stores the historical parameter set that has been verified by the backup kernel in the previous license cycle. The license signal is sent by the master control kernel at the end of each parameter synchronization cycle, indicating that the current parameters have been running stably for a complete control cycle. After receiving the license signal, the backup kernel copies the parameters in the parameter update area to the parameter effective area.

[0085] Upon receiving a takeover request, the backup kernel copies the latest synchronized parameter set from the parameter update area to the parameter effective area and immediately uses the parameters in the parameter effective area as the current control parameters. Specifically, the backup kernel first reads the status flag of the parameter update area to determine whether the data in the parameter update area is the latest valid data. If it is, it copies the parameter data from the parameter update area to the parameter effective area through the direct memory access controller. If the data in the parameter update area is invalid or does not exist, it directly uses the existing historical parameter set in the parameter effective area. After the copy is completed, the parameters in the parameter effective area are read into the working register and immediately enabled as the current control parameters.

[0086] In another technical solution, the step of the main control kernel actively sending a permission revocation request includes:

[0087] In monitor and verification mode, the main control kernel continuously reaches the recovery threshold C through the consistency score C(t). th Then, perform the following operations to generate a permission revocation request data packet:

[0088] The main control kernel retrieves all paired data since the last privilege revocation from the verification buffer and calculates the consistency score sequence for that period. , ,..., }, from which the maximum value C is selected. max Specifically, the main control kernel maintains a pointer that records the address of the first piece of data written to the verification buffer after the last privilege revocation. All data from that address to the current write pointer is the data to be extracted. The main control kernel calculates a consistency score for these paired data in chronological order, obtaining a consistency score sequence, and then iterates through and selects the maximum value C. max ;

[0089] The main control kernel reads its internally maintained system clock and obtains the value of the last recovery threshold C. th Timestamp T pass And calculate the observation duration ΔT=T from the first time the recovery threshold was reached to the current time. current -T first , among which, T first T is the time stamp when the recovery threshold is first reached. current This is the current timestamp; specifically, the system clock precision can be selected as a value between 1μs and 1 ms, such as 100 μs, and the maximum observation duration can be set to a value between 10 and 60 s, such as 30 s. The main control core integrates a real-time clock module with an independent crystal oscillator source and frequency divider circuit, which can provide a high-precision time reference.

[0090] The main control kernel calls its internal status register to read the current main control kernel status code S. core The status code includes a self-test pass flag, a logic exception detection unit clear flag, and a kernel temperature status bit. Specifically, the self-test pass flag is located at bit 0 of the status register. When the main control kernel's self-test program passes, this bit is set to 1. The logic exception detection unit clear flag is located at bit 1. When the logic exception detection unit detects that an exception has been cleared, this bit is set to 1. The kernel temperature status bit is located at bits 2 and 3, which encodes the temperature range of the main control kernel chip. For example, 00 indicates the normal temperature range, 01 indicates a high temperature warning, 10 indicates over-temperature protection, and 11 indicates a temperature sensor failure.

[0091] The main control kernel will set the maximum consistency score C. max Observation duration ΔT and main control kernel status code S core The data is spliced ​​and encoded to form a permission revocation request data packet with a fixed data frame format, and sent to the backup kernel through an internal dedicated communication channel. Specifically, the data frame format may include a frame header, data length, maximum consistency score, observation duration, status code, checksum, and frame trailer. The frame header can be selected as 0xAA55, and the frame trailer can be selected as 0x55AA. The frame header occupies 2 bytes, the data length occupies 2 bytes, Cmax occupies 4 bytes, T occupies 4 bytes, Score occupies 2 bytes, the checksum occupies 2 bytes, and the frame trailer occupies 2 bytes. The entire data packet is 18 bytes long. The checksum can be calculated using a cyclic redundancy check algorithm on all data except the frame header and frame trailer. The transmission process uses direct memory access, where the direct memory access controller reads data from memory and writes it into the transmission register of the communication channel. After transmission is completed, an interrupt is generated to notify the main control kernel.

[0092] In another technical solution, after the main control kernel regains control, the steps to restore the normal mode of main kernel dominance and backup kernel verification include:

[0093] During the first control cycle after regaining control, the main control kernel will output the instruction value I. m (t) and backup kernel output instruction value I b (t) Simultaneously write to the preset comparison register; specifically, the comparison register can be a dedicated peripheral register inside the main control kernel. This register has double-buffered input ports, each of which is connected to the instruction output register of the main control kernel and the instruction output register of the backup kernel. The comparison register integrates a hardware comparator, which is implemented by an analog-to-digital conversion circuit or a digital comparison circuit.

[0094] The comparison register has a built-in hardware comparator that calculates the difference ΔI between the two values. new (t)=∣I m (t)-I b (t)∣; Specifically, the hardware comparator inside the comparison register calculates I in real time. m (t) and I b The absolute value of the difference between (t) is used to obtain I. new (t);

[0095] If the difference is less than or equal to the preset stability threshold ΔI for three consecutive control cycles, stableIf the dual kernels have entered a stable synchronization state, the master kernel will restore the mirroring frequency of system status parameters and running logs from the enhanced mode during the takeover period to the preset mirroring cycle of the normal mode. Specifically, the enhanced mode refers to the working mode in which the backup kernel performs data mirroring at a higher frequency than the normal mode mirroring frequency after taking over control, to ensure that the master kernel can obtain sufficient real-time system status data for monitoring and verification during the takeover period, with a stability threshold of I. stable The value can be selected as 0.5% to 3% of the rated output value, for example, 1%. The number of continuous stable determination cycles can be selected as 2 to 10, for example, 3. The preset image period for normal mode can be selected as 10 to 100 ms, for example, 20 ms. The image period for enhanced mode during takeover can be selected as 1 to 10 ms, for example, 2 ms. The hardware comparator will... new (t) and the preset stability threshold I stable Compare, if I new (t) is less than or equal to I stable If the counter inside the comparison register is incremented by 1, otherwise the counter is cleared to zero. After the counter increments by 1 for three consecutive control cycles, the stable synchronization flag bit in the status register of the comparison register is set to 1, triggering an interrupt signal to notify the main control kernel that the dual kernels have entered a stable synchronization state. After receiving the interrupt signal, the main control kernel performs a mirror frequency adjustment operation, changing the mirror period from the currently used enhanced mode period value to the preset mirror period value of the normal mode.

[0096] In another technical solution, the steps of the backup kernel synchronizing the latest system status and logs to the main control kernel include:

[0097] Upon receiving the permission revocation request, the backup kernel first suspends its own execution of the pump group control logic and reads its internally maintained synchronization status counter to obtain the number N of new data added since the last synchronization. delta Specifically, the width of the synchronization status counter can be selected as 16 bits or 32 bits. For example, 32 bits can count a maximum value of 2^32 minus 1. The synchronization status counter inside the backup kernel can be configured as a general-purpose timer inside the chip in counting mode. The counter automatically increments each time the system status or log data is updated. After receiving the permission revocation request, the backup kernel first executes a pause instruction to clear the execution flag of the pump group control logic to stop the control program from executing, but keeps the communication interface and storage management functions running. Then, it reads the current value of the synchronization status counter. The synchronization status counter was cleared after the last synchronization was completed, so this value is the number of new data added since the last synchronization.

[0098] The backup kernel is based on the number of new data N.delta The system extracts the corresponding new data fragments from the system status and log storage area, and packages these new data fragments together with the starting address pointer and length information of the data fragments to form an incremental synchronization data packet. Specifically, the maximum length of the incremental synchronization data packet can be selected as a value between 256 and 2048 bytes, for example, 1024 bytes. The system status and log storage area of ​​the backup kernel can be selected from the chip's internal static random access memory, divided into multiple fixed-size data blocks. Each data block contains a data fragment, which includes data content and a data header. The data header contains the data fragment number, timestamp, and data length information. The storage area adopts a circular buffer management method, where the latest data overwrites the oldest data. The backup kernel calculates the data based on N... delta The value is extracted from the newly added data fragment in the storage area, the write pointer of the storage area is accessed, and N is traced back from the write pointer. delta The starting address is the location of a data block; N data blocks are read continuously from this starting address. delta A data block, including the read starting address pointer, N delta The length information and the data content of all data segments are concatenated together to form an incremental synchronization data packet. The data packet format is as follows: the starting address pointer occupies 4 bytes, the data length information occupies 4 bytes, and the content of each data segment follows in sequence.

[0099] The backup kernel sends the incremental synchronization data packet to the main control kernel through the internal dedicated communication channel. The main control kernel writes the received incremental data fragments to the corresponding positions in its own storage area according to the starting address pointer and length information. Specifically, after receiving the incremental synchronization data packet, the main control kernel parses the starting address pointer, data length, and incremental data content. Based on the starting address pointer, it determines the target write position in its own storage area and writes the received incremental data fragments sequentially to the continuous storage area starting at that position. After writing is completed, the main control kernel updates the write pointer and synchronization status counter of its storage area to ensure that the storage data of the main control kernel is consistent with the storage data of the backup kernel.

[0100] In another technical solution, after the backup kernel takes over control, the steps for the backup kernel to execute the core control logic of the fire pump group include:

[0101] After taking over control, the backup kernel reads its internally stored running mode configuration table, which contains a normal mode parameter set and an extreme mode parameter set. Specifically, the normal mode parameter set and the extreme mode parameter set can be pre-stored in the backup kernel's flash memory, each occupying an independent storage area. The running mode configuration table is organized in tabular form, with each row corresponding to a running mode and each column corresponding to a parameter.

[0102] The backup kernel matches the corresponding operating mode from the operating mode configuration table based on the environmental parameters in the system snapshot information at the time of the failure handed over by the main control kernel, including the electromagnetic interference intensity value and the ambient temperature value. Specifically, the electromagnetic interference intensity value can be represented as a digital quantity ranging from 0 to 100, where 0 represents no electromagnetic interference and 100 represents the highest electromagnetic interference level. The ambient temperature value is in °C and ranges from -40 to 85°C. The matching logic can use a threshold comparison method. If the electromagnetic interference intensity value is greater than the preset electromagnetic interference threshold, such as 60, or the ambient temperature value is greater than the preset high temperature threshold, such as 65°C, or the ambient temperature value is less than the preset low temperature threshold, such as -20°C, the matching result is the extreme mode; otherwise, the matching result is the normal mode.

[0103] When the matching result is extreme mode, the backup kernel enables the extreme mode parameter set, which includes: the pump start-stop response time is shortened to 50% of the normal mode response time, the main / standby pump switching interval is shortened to 60% of the normal mode switching interval, and the fault alarm threshold is reduced to 80% of the normal mode alarm threshold. Specifically, the pump start-stop response time in normal mode is 5 s, which is shortened to 2.5 s in extreme mode; the main / standby pump switching interval in normal mode is 10 s, which is shortened to 6 s in extreme mode; and the overload current threshold in the fault alarm threshold in normal mode is 120% of the rated current, which is reduced to 96% of the rated current in extreme mode. After loading the extreme mode parameter set, the subsequent control logic executed by the backup kernel will run according to these adjusted parameters, responding to system state changes in a more conservative and sensitive manner.

[0104] Through the above technical solutions, this invention achieves reliable redundant switching of the fire pump controller in the event of a main kernel failure. By introducing a pre-takeover self-test mechanism, it avoids the risk of switching even when the backup kernel itself is faulty. By storing the normal control logic model in a hardware write-protected read-only memory area, it ensures the absolute correctness of the reference instructions. By using a listening and verification mode, it enables the main kernel to regain control after the fault is recovered. By automatically matching the operating mode according to environmental parameters and enabling the adjusted parameter set in extreme mode, it enables the backup kernel to operate in a more conservative and sensitive manner under extreme conditions, thereby comprehensively improving the reliability and survivability of the fire pump controller under extreme conditions.

[0105] An anti-interference redundancy control module for a fire pump controller is provided, used to execute the anti-interference redundancy control method for the fire pump controller, comprising:

[0106] The main control kernel is used to execute the core control logic of the fire pump set and generate system status parameters and operation logs in real time. Specifically, the main control kernel can be an industrial-grade microcontroller chip based on the ARM Cortex architecture. This chip integrates an independent processor core, cache and interrupt controller, and is installed in the center of the printed circuit board of the fire pump controller. It is connected to the peripheral circuit through the chip's pins. In each control cycle, the main control kernel collects sensor data, runs a preset control algorithm, generates control commands and outputs them to the fire pump set through the drive port. At the same time, it packages the system status parameters and operation logs collected each time according to a fixed data frame format and sends them to the backup kernel through the internal communication bus. The control cycle can be selected as a value between 1 and 20 ms, for example, 5 ms.

[0107] The backup kernel is communicatively connected to the main control kernel and is used to receive and mirror the system status parameters and operation logs of the main control kernel. Specifically, the backup kernel can be a microcontroller chip of the same model as the main control kernel, or another processor core integrated in the same dual-core processor chip. The backup kernel is connected to the main control kernel through an internal high-speed bus, receives the status parameters and log data sent by the main control kernel and stores them in its dedicated storage area. This storage area can be the static random access memory or flash memory inside the backup kernel chip. The backup kernel and the main control kernel are each connected to an independent power module. Each power module includes an input filter circuit, a DC-DC converter and an output voltage regulator circuit. The input terminals of the two power modules can be connected to different power buses to achieve power supply redundancy.

[0108] A logic anomaly detection unit, integrated within the main control core, is used to collect the control command value output by the main control core and the verification command value output by the backup core in each control cycle. When the deviation between the two exceeds a preset threshold for N consecutive control cycles, the main control core is determined to be faulty, and a takeover request is generated. Specifically, the logic anomaly detection unit can be implemented using a digital logic module in a field-programmable gate array (FPGA). This chip can be installed on the printed circuit board of the fire pump controller, located in the area between the main control core chip and the backup core chip. It is connected to the instruction output port of the main control core chip and the verification command output port of the backup core chip via traces on the printed circuit board. The FPGA is internally configured with multiple comparators, counters, accumulators, and registers. At the beginning of each control cycle, it simultaneously collects the control command value I output by the main control core through its input pins. m The first comparator calculates the difference between the two values, Ib(t) and the verification instruction value output by the backup kernel, and obtains the real-time deviation ΔI(t) by taking the absolute value. The first counting and comparison module maintains a counter. When ΔI(t) is greater than the preset instruction deviation threshold ΔI, the counter will be used to calculate the real-time deviation. thThe counter increments by 1 if the counter is not active, and resets to zero if the counter value reaches N. When the counter value reaches N, a high-level signal is output to the interrupt request input pin of the main control kernel, triggering the main control kernel to generate a takeover request. The number of consecutive exception checks N can be selected as a value between 3 and 20, for example, 5. The instruction deviation threshold ΔI is also specified. th A value between 1% and 10% of the rated output value can be selected, for example, 5%;

[0109] A rapid self-test unit, integrated within the backup kernel, performs a rapid self-test of the backup kernel's health status after receiving the takeover request but before executing control takeover. If the self-test fails, the takeover request is rejected and an alarm signal is generated. Specifically, the rapid self-test unit is triggered by an independent hardware monitoring circuit, and within a very short time, for example, 5 seconds... Within μs, the system completes integrity checks on the backup kernel's core arithmetic unit, verification instruction generator, and inter-core communication interface. The rapid self-test process first executes a set of predefined test instructions on the backup kernel's arithmetic logic unit, including addition, subtraction, multiplication, and division operations, and compares the results with pre-stored standard results. Then, it performs a self-test on the verification instruction generation module, which generates a set of known verification instruction sequences and compares them with pre-stored standard sequences. Finally, it performs a loopback test on the communication interface, sending test data through an internal loopback mode and verifying the correctness of the received data. Only when all checks pass and the backup kernel itself is confirmed to be in a completely healthy and executable state will the subsequent takeover logic proceed. If the backup kernel self-test fails, the system determines it to be an untrusted node, refuses to switch over, and activates the highest level alarm. This design effectively avoids erroneous handover in the rare dual-failure scenario where both the main kernel and the backup kernel fail simultaneously.

[0110] The monitoring and verification unit, integrated into the main control kernel, is used to stop the fire pump group control and switch to monitoring mode after the backup kernel takes over control authority. It monitors and calculates the consistency score between the backup kernel's output commands and its own preset normal control logic model. Specifically, this is to address the issue of the main kernel referencing command value I in monitoring mode. ref To address the reliability issue of (t), the normal control logic model of this invention is implemented as a baseline model. The core algorithms of this model, such as PID coefficients, logical judgment rules, and key parameters, are solidified during the chip design phase and stored in a specially allocated read-only memory area within the main control kernel, protected by chip hardware write protection mechanisms such as eFuse (one-time programmable fuse) or ROM with a physical anti-tampering layer. Any external software interference, electromagnetic radiation, or abnormal operating environment, such as kernel logic disorder, cannot modify the contents of this read-only area. Therefore, in monitoring mode, the I extracted by the main control kernel... ref(t) Always represents ideal and absolutely correct control behavior, and there is no situation where it provides incorrect reference values ​​due to its own failure. This fundamentally solves the paradox of self-reference verification. After the backup kernel takes over the control authority, the monitoring and verification unit switches the instruction output register inside the main control kernel to the monitoring state. The main control kernel no longer writes calculated instruction values ​​to the drive port, but directly reads the output instruction values ​​written by the backup kernel to the fire pump group drive port through the data bus. The read backup kernel output instruction values ​​are matched item by item with the reference instruction values ​​output by the self-preset normal control logic model at the same time point, which are read from the hardware write-protected read-only memory area. The matched data is stored in the verification buffer inside the main control kernel for use according to the consistency scoring formula. Calculate the current consistency score, where the sampling period T s The value can be selected between 1 and 10 ms, for example, 5 ms; the allowable deviation threshold ϵ can be selected between 0.5% and 5%, for example, 2%; and the number of observation samples n can be selected between 10 and 100, for example, 50.

[0111] The normal control logic model inside the main control kernel is permanently stored in a read-only memory area protected by a hardware write protection mechanism.

[0112] The permission revoke unit, integrated into the main control kernel, generates and sends a permission revoke request to the backup kernel when the consistency score continuously reaches a preset recovery threshold. Specifically, the preset observation duration can be selected as a value between 2 and 10 seconds, for example, 5 seconds, and the recovery threshold can be selected as a value between 0.85 and 0.98, for example, 0.95. After the consistency score continuously reaches the recovery threshold, the permission revoke unit extracts all paired data since the last permission revoke from the verification buffer, calculates the consistency score sequence within that period, and selects the maximum value C. max The main control kernel reads the system clock it maintains internally to obtain the timestamp T of the last recovery threshold. pass And calculate the observation duration ΔT=T from the first time the recovery threshold was reached to the current time. current -T first The main control kernel calls its internal status register to read the current main control kernel status code S. core The status code includes the self-test pass flag, the clear flag of the logic exception detection unit, and the kernel temperature status flag. The privilege revoke unit sets the maximum consistency score C. max Observation duration ΔT and main control kernel status code S coreThe data packets are spliced ​​and encoded to form a permission revocation request data packet with a fixed data frame format, and sent to the backup kernel through an internal dedicated communication channel. The data frame format may include a frame header, data length, maximum consistency score, observation duration, status code, checksum, and frame trailer. The frame header can be selected as 0xAA55, and the frame trailer can be selected as 0x55AA. The frame header occupies 2 bytes, the data length occupies 2 bytes, Cmax occupies 4 bytes, ΔT occupies 4 bytes, Score occupies 2 bytes, the checksum occupies 2 bytes, and the frame trailer occupies 2 bytes. The entire data packet is 18 bytes long. The checksum can be calculated by using a cyclic redundancy check algorithm on all data except the frame header and frame trailer.

[0113] The aforementioned modules can be integrated into a single dual-core processor chip, where the main control core and backup core are the chip's two processor cores. The logic anomaly detection unit, fast self-test unit, monitoring and verification unit, and permission revoke unit are implemented through programmable logic units within the chip and communicate via the chip's internal high-speed bus. Alternatively, the modules can be distributed across different hardware, such as using two independent microcontroller chips for the main control core and backup core, and an independent field-programmable gate array (FPGA) chip for the logic anomaly detection unit. The modules communicate and coordinate via a data bus on the printed circuit board. Regardless of the deployment method, all modules work together to complete an integrated redundant control process from anomaly detection, fast self-test, permission takeover, monitoring and verification to permission revoke.

[0114] Through the above technical solution, this invention realizes dual-core redundant control of the fire pump controller. By organically combining the logic anomaly detection unit, the fast self-test unit, the monitoring and verification unit, and the permission revocation unit, a complete closed-loop control from fault detection to safe takeover and then to recovery and recycling is realized. Fault handling and system recovery can be completed automatically without manual intervention. By solidifying the normal control logic model in the hardware write-protected read-only memory area, the absolute correctness of the reference instructions is fundamentally guaranteed, and the survivability of the system under extreme conditions is improved.

[0115] Although embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details and embodiments shown and described herein.

Claims

1. An anti-interference redundancy control method for a fire pump controller, characterized in that, include: The system is deployed with a dual-kernel architecture, which includes a main control kernel and a backup kernel. The main control kernel is used to execute the core control logic of the fire pump unit and to mirror system status parameters and operation logs to the backup kernel in real time. The main control kernel continuously performs self-checks. When it detects an abnormality in its own output logic, it actively generates a takeover request and sends it to the backup kernel. Upon receiving the takeover request, the backup kernel first performs a quick self-check before taking over control authority. The quick self-check is used to confirm that the backup kernel's own logical units, verification instruction generation module, and communication interface are in normal condition. If the quick self-check fails, the takeover request is rejected and an alarm signal is generated. If the quick self-check passes, the subsequent takeover is performed. The backup kernel takes over control within a preset switching threshold time. Simultaneously, the main control kernel switches to monitoring and verification mode, stops controlling the fire pump group, monitors the output commands of the backup kernel, and calculates the consistency between the monitored commands and its own preset normal control logic model using the following formula: Where C(t) is the consistency score, with a value range of [0, 1], and n is the number of observed samples, I bk (t i ) represents the value of the backup kernel output instruction obtained through monitoring, I ref (t i The reference instruction value output by the pre-configured normal control logic model of the main kernel, T s The sampling period is ϵ, the allowable deviation threshold is ϵ, and I(·) is the indicator function, which is 1 if the condition is met and 0 otherwise. The normal control logic model pre-set in the main kernel is stored in a read-only memory area inside the main kernel that is protected by a hardware write protection mechanism. Its core calculation logic and parameters are solidified after the chip is fabricated and cannot be modified by software instructions or external interference. When C(t) reaches the preset recovery threshold C within a preset observation period and a preset number of consecutive sampling periods, th If the main kernel has recovered, it is determined that the kernel has returned to normal, and a permission revocation request is actively sent. After receiving the recycling request, the backup kernel synchronizes the latest system status and logs to the main control kernel, returns control, and restores the normal mode where the main kernel dominates and the backup kernel performs verification.

2. The anti-interference redundancy control method for a fire pump controller as described in claim 1, characterized in that, The steps of the main control kernel's continuous self-test include: The main control kernel has a built-in logic exception detection unit. During each control cycle, this unit collects the control command value I output by the main control kernel. m (t) and the verification instruction value I output by the backup kernel b (t), and calculate the real-time deviation between the two ΔI(t) = |I m (t)-I b (t)|, when the real-time deviation ΔI(t) is greater than the preset command deviation threshold ΔI for N consecutive control cycles. th If this occurs, the main control kernel will determine that the output logic is abnormal and will actively generate a takeover request. The logic anomaly detection unit monitors the verification instruction value I output by the backup kernel. b If the variance of I(t) varies over N consecutive control periods, then... b If the variance of ΔI(t) exceeds the preset stability threshold, then regardless of the magnitude of ΔI(t), it is determined that there is an unknown fault in the system, thereby triggering an audible and visual alarm and forcing the system to enter safe mode, rather than simply performing a master-slave switchover.

3. The anti-interference redundancy control method for a fire pump controller as described in claim 1, characterized in that, The steps for the backup kernel to take over control within a preset switchover threshold time include: Upon receiving the takeover request, the backup kernel starts its built-in timer and, within a preset switching threshold time, configures the core control parameters pre-stored in the backup kernel as the currently effective control parameters. At the same time, it directly maps the calculation results of the backup kernel to the drive port of the fire pump set for takeover control authority. The core control parameters include the switching logic parameters between the main pump and the standby pump, the overload protection threshold parameters, and the linkage control logic parameters.

4. The anti-interference redundancy control method for a fire pump controller as described in claim 2, characterized in that, The steps for the main control kernel to switch to monitoring and verification mode include: After the logic anomaly detection unit determines that the main control kernel is outputting a logic anomaly and completes the transfer of authority, the main control kernel switches its internal instruction output register to a listening state. The main control kernel then directly reads the output instruction value I written by the backup kernel to the pump group driver port via the data bus. bk (t), and no longer write its own calculation instruction value; The main control kernel will listen to the I bk (t) retrieves the reference instruction value I at the same time point as the preset normal control logic model from the hardware write-protected read-only memory area. ref (t) performs item-by-item pairing, and the paired data is stored in the verification buffer inside the main control kernel for calculating the consistency score C(t).

5. The anti-interference redundancy control method for a fire pump controller as described in claim 3, characterized in that, The step of configuring the pre-stored core control parameters in the backup kernel to the currently effective control parameters includes: After receiving the takeover request, the backup kernel first accesses its internal pre-stored parameter storage area, which is divided into a parameter update area and a parameter activation area. Among them, the backup kernel continuously synchronizes the current core control parameters of the main control kernel to the parameter update area through the mirroring process. Before receiving the takeover request, the parameter effective area stores the historical parameter set that has been verified by the backup kernel in the previous license period. Upon receiving a takeover request, the backup kernel copies the latest synchronized parameter set from the parameter update area to the parameter effective area and immediately uses the parameters in the parameter effective area as the current control parameters.

6. The anti-interference redundancy control method for a fire pump controller as described in claim 2, characterized in that, The steps of the main control kernel actively sending a permission revocation request include: In monitor and verification mode, the main control kernel continuously reaches the recovery threshold C through the consistency score C(t). th Then, perform the following operations to generate a permission revocation request data packet: The main control kernel retrieves all paired data since the last privilege revocation from the verification buffer and calculates the consistency score sequence for that period. , ,..., }, from which the maximum value C is selected. max ; The main control kernel reads its internally maintained system clock and obtains the value of the last recovery threshold C. th Timestamp T pass And calculate the observation duration ΔT=T from the first time the recovery threshold was reached to the current time. current -T first , among which, T first T is the time stamp when the recovery threshold is first reached. current This is the current timestamp; The main control kernel calls its internal status register to read the current main control kernel status code S. core The status codes include the self-test pass flag, the clear flag of the logic exception detection unit, and the kernel temperature status bit. The main control kernel will set the maximum consistency score C. max Observation duration ΔT and main control kernel status code S core The data is spliced ​​and encoded to form a permission revocation request data packet with a fixed data frame format, and then sent to the backup kernel through an internal dedicated communication channel.

7. The anti-interference redundancy control method for a fire pump controller as described in claim 1, characterized in that, After the main control kernel regains control, the steps to restore the normal mode of main kernel dominance and backup kernel verification include: During the first control cycle after regaining control, the main control kernel will output the instruction value I. m (t) and backup kernel output instruction value I b (t) Simultaneously write to the preset comparison register; The comparison register has a built-in hardware comparator that calculates the difference ΔI between the two values. new (t)=∣I m (t)-I b (t)∣; If the difference is less than or equal to the preset stability threshold ΔI for three consecutive control cycles, stable If the dual kernels have entered a stable synchronization state, the main control kernel will restore the mirroring frequency of the system status parameters and running logs from the enhanced mode during the takeover period to the preset mirroring cycle of the normal mode.

8. The anti-interference redundancy control method for a fire pump controller as described in claim 1, characterized in that, The steps for the backup kernel to synchronize the latest system status and logs to the main control kernel include: Upon receiving the permission revocation request, the backup kernel first suspends its own execution of the pump group control logic and reads its internally maintained synchronization status counter to obtain the number N of new data added since the last synchronization. delta During the pause of the pump control logic, the backup kernel keeps the current value in the output register of its drive port unchanged, and the fire pump unit continues to operate according to the last control instruction before the pause. The backup kernel is based on the number of new data N. delta Extract the corresponding new data fragments from the storage area of ​​system status and logs, and package the new data fragments together with the starting address pointer and length information of the data fragments to form an incremental synchronization data packet; The backup kernel sends the incremental synchronization data packet to the main control kernel through the internal dedicated communication channel. The main control kernel writes the received incremental data fragment to the corresponding position in its own storage area according to the starting address pointer and length information.

9. The anti-interference redundancy control method for a fire pump controller as described in claim 1, characterized in that, After the backup kernel takes over control, the steps for the backup kernel to execute the core control logic of the fire pump group include: After taking over control, the backup kernel reads its internally stored running mode configuration table, which contains the normal mode parameter set and the extreme mode parameter set. The backup kernel matches the corresponding operating mode from the operating mode configuration table based on the environmental parameters in the system snapshot information at the time of the failure handed over by the main control kernel, including electromagnetic interference intensity value and ambient temperature value; When the matching result is extreme mode, the backup kernel enables the extreme mode parameter set, which includes: the pump group start-stop response time is shortened to 50% of the normal mode response time, the main and backup pump switching action interval is shortened to 60% of the normal mode switching interval, and the fault alarm threshold is reduced to 80% of the normal mode alarm threshold.

10. An anti-interference redundant control module for a fire pump controller, used to execute the method as described in any one of claims 1 to 9, characterized in that, include: The main control kernel is used to execute the core control logic of the fire pump set and generate system status parameters and operation logs in real time. The backup kernel is connected to the main control kernel and is used to receive and mirror the system status parameters and operation logs of the main control kernel. The logic anomaly detection unit, integrated into the main control kernel, is used to collect the control command value output by the main control kernel and the verification command value output by the backup kernel in each control cycle. When the deviation between the two is greater than a preset threshold in N consecutive control cycles, the main control kernel is determined to be abnormal and a takeover request is generated. A rapid self-test unit, integrated in the backup kernel, is used to perform a rapid self-test on the health status of the backup kernel after it receives the takeover request and before it executes the control authority takeover. If the self-test fails, the takeover request is rejected and an alarm signal is generated. The monitoring and verification unit, integrated into the main control kernel, is used to stop the control of the fire pump group and switch to monitoring mode after the backup kernel takes over the control authority. It monitors and calculates the consistency score between the output instructions of the backup kernel and its own preset normal control logic model. The normal control logic model inside the main control kernel is permanently stored in a read-only memory area protected by a hardware write protection mechanism. The permission revoke unit, integrated in the main control kernel, is used to generate and send permission revoke requests to the backup kernel when the consistency score continuously reaches the preset recovery threshold.

Images