Output control methods, devices, equipment, storage media and products

Abstract

This application discloses an output control method, apparatus, device, storage medium, and product, relating to the field of redundant control system technology. The output control method includes: in response to master / standby status information sent to the system, obtaining the system's willingness to preempt master; updating the master / standby status of each channel of the system based on the master / standby status information and the willingness to preempt master; performing a consensus vote on the master / standby status of each channel of the system to obtain a final master / standby status; and determining the control information output by the system based on the final master / standby status. This application solves the technical problem of poor determinism in master / standby status decision-making in conventional dual-system redundant control systems.

Description

Technical Field

[0001] This application relates to the field of redundant control system technology, and in particular to output control methods, devices, equipment, storage media and products. Background Technology

[0002] In redundant control systems with high safety integrity requirements, such as rail transit signal control, a dual-system redundancy hot standby architecture is usually adopted. This means setting up a first control system and a second control system. At any given time, one system acts as the primary system to undertake external output control tasks, while the other system acts as a standby system in a hot standby state to achieve high system availability.

[0003] In conventional technologies, primary / backup contention between two systems typically relies on a network heartbeat-based message negotiation mechanism or a third-party arbitration device. This mechanism uses a software protocol stack to exchange status messages between the primary and backup systems, with each system's business software parsing the messages and executing a primary / backup decision. However, the message parsing and status negotiation process of the software protocol stack has a response delay of tens of milliseconds or even longer, making it difficult to meet hard real-time switching requirements in some high-real-time application scenarios. Furthermore, in situations involving network partitioning or extremely small differences in the startup times of the primary and backup systems, the message negotiation mechanism may result in a dual-primary conflict where both systems simultaneously determine themselves as the primary system, leading to uncontrolled system output and insufficient determinism in the primary / backup status decision. To address these issues, some conventional technical solutions attempt to use dedicated hard lines independent of the business channel to transmit primary / backup status level signals to reduce transmission latency. While such solutions shorten signal transmission time to some extent, they still have the following limitations: the transmission scheme of a single hard-wired channel lacks redundancy and fault tolerance design, and a single cable break or poor contact can lead to the loss of status signals, making it difficult to guarantee the reliability of the system's primary and backup decisions; at the same time, the status detection mechanism of a single channel cannot prevent erroneous decisions caused by the failure of the channel's own hardware, and the system's fault-tolerant capability is still insufficient. Summary of the Invention

[0004] The main objective of this application is to provide an output control method, device, equipment, storage medium, and product, which aims to solve the technical problem of poor determinism in the decision-making of the primary and backup states in conventional dual-redundant control systems.

[0005] To achieve the above objectives, this application proposes an output control method, the method comprising: In response to the master / standby status information sent to the system, obtain the system's willingness to preempt master; Based on the primary / standby status information and the willingness to take over, update the primary / standby status of each channel in this system; A consensus vote is conducted on the primary and backup status of each channel in this system to obtain the final primary and backup status; Based on the final master / standby status, determine the control information that this system outputs to external systems.

[0006] In one embodiment, the step of updating the primary / standby status of each channel in the system based on the primary / standby status information and the willingness to preempt primary status includes: Read the preset main state frequency and backup state frequency; The primary / standby status of the system is determined based on the frequency of the dynamic pulse signal in the primary / standby status information. When the system is determined to be in the master state, the intention to take over the master is ignored, and the master / standby status of each channel in the system is updated to standby status. When the system is determined to be in a non-master state, the master / standby status of each channel in the system is updated to master state.

[0007] In one embodiment, the system channel includes a first channel and a second channel, and the step of updating the primary / standby status of each channel of the system based on the primary / standby status information and the willingness to preempt primary status includes: Based on the first channel, according to the frequency of the dynamic pulse signal contained in the master / standby status information and the master preemption intention, a first master / standby status is generated according to a preset mutual exclusion logic; Based on the second channel, the dynamic pulse signal sent by the second channel of the system is acquired, and a second primary / backup state is generated according to the dynamic pulse signal of the second channel of the system. When the dynamic pulse signal of the second channel of the system represents the master state, the second channel forcibly determines the second master-standby state as the standby state; when the dynamic pulse signal of the second channel of the system represents the non-master state, the second channel determines the second master-standby state to be consistent with the first master-standby state. Write the first primary / backup status to the status register of the first channel, and write the second primary / backup status to the status register of the second channel to complete the primary / backup status update of each channel in the system.

[0008] In one embodiment, the step of performing a consensus vote on the primary / standby status of each channel in the system to obtain the final primary / standby status includes: Read the first primary / backup status from the status register of the first channel, and read the second primary / backup status from the status register of the second channel; When the first primary / standby state is consistent with the second primary / standby state, the final primary / standby state is determined to be the first primary / standby state. When the first primary / standby state is inconsistent with the second primary / standby state, the final primary / standby state is forcibly determined to be standby state, and a fault alarm message is generated.

[0009] In one embodiment, the step of determining the control information output by the system based on the final master / standby state includes: Obtain the preset output permission command issued by the business layer; When the final master / standby state is the master state and the output permission instruction is valid, the control information is determined to be output enable; When the final primary / standby status is standby or the output permission instruction is invalid, the control information is determined to be output blocked.

[0010] In one embodiment, the step of obtaining the system's willingness to preempt the master in response to the master / standby status information sent by the system includes: Receive at least two dynamic pulse signals sent by the system through a preset redundant hard-wired interface. The frequency of each of the at least two dynamic pulse signals is detected. When any detected frequency is the preset main state frequency, the main / standby state information is determined to be the main state. When the primary state frequency is not detected on any of the paths, the primary / standby state information is determined to be a non-primary state. The pre-defined host-grabbing request issued by the business layer is used as the host-grabbing intention.

[0011] Furthermore, to achieve the above objectives, this application also proposes an output control device, which includes: The acquisition module is used to obtain the system's willingness to preempt the master in response to the master / standby status information sent by the system. The update module is used to update the primary and backup status of each channel in the system based on the primary and backup status information and the willingness to take over the primary status. The voting module is used to conduct a consensus vote on the primary and backup status of each channel in the system to obtain the final primary and backup status. The output module is used to determine the control information to be output by the system based on the final master / slave status.

[0012] In addition, to achieve the above objectives, this application also proposes an output control device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the output control method as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the output control method described above.

[0014] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the output control method described above.

[0015] One or more technical solutions proposed in this application have at least the following technical effects: Compared to related technologies where software message negotiation leads to contention and response delays in master / standby decision-making, this application obtains the master / standby status information sent by the peer system to assess its own willingness to preempt the master; based on the master / standby status information and the willingness to preempt the master, it updates the master / standby status of each channel of the system; it performs a consensus vote on the master / standby status of each channel of the system to obtain the final master / standby status; and based on the final master / standby status, it determines the control information output by the system. It is understood that when the master / standby status information of the peer system is obtained, this application updates the master / standby status of each channel by combining the master / standby willingness of the system, thereby forming independently held copies of the master / standby status among each channel; therefore, a consensus vote based on the master / standby status of each channel can detect whether the status of each channel is consistent. When the status of each channel is consistent, the final master / standby status is confirmed; when the status of each channel is inconsistent, the voting mechanism eliminates the disagreement, and then output enable or output block is determined based on the final master / standby status, ultimately completing the deterministic decision-making and safe output control of the master / standby status, solving the technical problem of poor determinism in master / standby status decision-making in conventional dual-system redundant control systems. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating an embodiment of the output control method of this application; Figure 2 A simplified flowchart is provided for an embodiment of the output control method of this application; Figure 3 This is a schematic diagram of the module structure of the output control device according to an embodiment of this application; Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the output control method in the embodiments of this application.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution in this application's embodiments is: In response to the master / standby status information sent to the system, obtain the system's willingness to preempt master; Based on the primary / standby status information and the willingness to take over, update the primary / standby status of each channel in this system; A consensus vote is conducted on the primary and backup status of each channel in this system to obtain the final primary and backup status; Based on the final master / standby status, determine the control information that this system outputs to external systems.

[0023] In this embodiment, the application uses an output control device as the execution subject. For ease of description, it will be referred to as "device" in detail below.

[0024] Since conventional technologies rely on software message negotiation for dual-system master-slave competition, they suffer from problems such as high response latency, high risk of competition conflicts, and poor decision reliability due to single-channel failure. This application provides a solution by constructing a hardware-level mutual exclusion competition mechanism based on the physical representation of dynamic frequency signals, a fast response architecture of dual-channel division of labor and transparent transmission, and a safe voting system for multi-channel independent decision-making. This enables the master-slave status decision of the dual-system redundant control system to achieve deterministic mutual exclusion at the physical level, low-latency switching at the architectural level, and fault-oriented safety at the voting level.

[0025] This embodiment aims to improve the determinism, real-time performance, and security of the master / slave status decision of the dual-redundant control system from three levels: physical signal representation, channel division architecture, and multi-channel voting.

[0026] In this embodiment, the research and development background is as follows: the rail transit signal control system has strict mutual exclusion requirements and high real-time requirements for the master and backup competition of the dual-redundant hot standby architecture. Conventional schemes based on network heartbeat message negotiation have the risk of dual master conflict under boundary conditions such as minimal difference in startup time or network partitioning. Moreover, the tens of milliseconds of latency introduced by the software protocol stack are difficult to meet the hard real-time switching requirements. At the same time, the single-channel status detection scheme lacks the fault tolerance capability for hardware common cause failure.

[0027] In this embodiment, the application scenario is a security computer platform that adopts a dual-system redundant hot standby architecture and is required to reach the SIL4 security integrity level. The two systems are connected by redundant hardwires. Each system is configured with two independent hardware channels, namely the first channel and the second channel. The service layer runs on the platform layer and issues control commands in accordance with the principle of primary and standby mutual exclusion.

[0028] In this embodiment, the master / standby status is replaced by dynamic pulse signals of different frequencies instead of traditional high / low levels or message codewords. This allows the system detection module to directly distinguish between three states: "system is master," "system is standby," and "system is faulty or offline," by recognizing the pulse frequency. This assigns a fault-detectable attribute to the master / standby status at the signal encoding level. Furthermore, the master / standby contention decision uses hardware-level mutual exclusion logic. Before sending its own master / standby signal, channel 1 must first check the system status signal. It is only allowed to preempt the system if the system is not master; otherwise, it forces the system to become standby. This logic is executed in real-time by the hardware circuitry, physically eliminating the possibility of dual master or dual standby configurations. To further reduce response latency, this embodiment divides the platform layer into two independent channels, Channel 1 and Channel 2. Channel 1 is responsible for executing the primary / standby contention decision, while Channel 2 is responsible for high-speed detection of the signal from the peer channel 2 and performing transparent transmission or forced standby operation. When Channel 2 detects that the signal from the peer channel 2 is completely non-primary, it directly transmits the primary status signal of its own channel 1 without any software intervention, compressing the primary / standby synchronization delay to the hardware transmission level. In terms of security, this embodiment sets up a dual-channel independent decision mechanism within each system. Channel 1 and Channel 2 independently generate primary / standby states based on their respective acquired peer status signals and their own system's willingness to compete for primary status. The platform software periodically reads the status registers of the two channels for consistency voting. When the two channel states are consistent, the final primary / standby state is confirmed; when the two channel states are inconsistent, a single-channel hardware failure is determined, and the system forces the system to degrade to standby and cuts off external output, achieving fault-oriented security. At the output control level, this embodiment sets up multiple enable conditions. The final enable of external output requires simultaneous fulfillment of three conditions: hardware master / standby status as master, valid output permission at the service layer, and normal master / standby signal feedback from the system. If any condition is not met, the output channel is blocked at the hardware level, forming a complete security closed loop from signal detection to output execution. Through the synergistic effect of the above technical means, this embodiment effectively solves the technical problem of poor determinism in master / standby status determination in conventional dual-redundant control systems.

[0029] Based on this, the embodiments of this application provide an output control method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the output control method of this application.

[0030] In this embodiment, the output control method includes steps S10 to S40: Step S10: In response to the master / standby status information sent to the system, obtain the system's willingness to preempt master. It should be noted that "parallel system" refers to another redundant control system outside of this system. The two systems are physically and logically independent, together forming a dual-system redundant hot standby architecture. Primary / standby status information includes, but is not limited to, indication signals of the current primary or standby status of the parallel system. These indication signals are sent by the parallel system through a preset physical transmission path, and are received by this system as input for primary / standby contention decisions. "Will to become the primary system" refers to the decision signal generated by the business layer of this system based on its own health status and business logic, indicating whether it desires to become the primary system. This signal is sent from the business layer to the platform layer of this system to drive the hardware-level primary / standby contention process.

[0031] Understandably, this step completes the acquisition of two prerequisite pieces of information needed for primary / standby competition: the current real-time status of the counterpart system and the subjective competitive intent of the system itself. By synchronously aggregating these two pieces of information from the business layers of the counterpart system and the system itself to the platform layer of the system, complete decision input conditions are provided for subsequent primary / standby status updates.

[0032] Step S20: Based on the primary / standby status information and the willingness to preempt the primary status, update the primary / standby status of each channel in this system; It should be noted that "master / standby status" refers to the indicator held within each channel, used to represent whether the system should currently be in master or standby status. Each channel refers to two or more independent hardware processing channels set up within the system's platform layer, each channel having independent system signal detection capabilities and system status generation capabilities.

[0033] Understandably, this step integrates the primary / backup status information of the system with the system's willingness to preempt the primary status, driving each channel to synchronously or collaboratively update its internal primary / backup status, thus enabling each channel to form its own independent state copy at the decision level. This multi-channel independent update mechanism provides a redundant comparison basis for subsequent consensus voting.

[0034] Step S30: Perform a consensus vote on the primary and backup status of each channel in this system to obtain the final primary and backup status; It should be noted that consensus voting refers to the process of comparing and jointly determining the primary and backup status of two or more channels item by item. The final primary and backup status refers to the conclusion of the primary and backup status of the system that is finally confirmed and announced by the system platform layer after consensus voting. This conclusion is the direct basis for subsequent output control decisions.

[0035] Understandably, this step utilizes redundant status information between multiple channels for mutual verification, which can effectively identify and handle discrepancies in channel status caused by single-channel hardware failure or signal transmission anomalies, ensuring the uniqueness and reliability of the primary and backup status conclusions of this system. This is a concrete manifestation of the fault-oriented security architecture in the voting process.

[0036] Step S40: Based on the final master / standby status, determine the control information to be output by this system.

[0037] It should be noted that the control information output to the outside includes, but is not limited to, the enable signal of the communication interface of this system, the on / off command of the drive circuit, or the blocking control signal of the safety output port. This control information directly determines whether this system has the physical ability to send control commands to external execution units.

[0038] Understandably, this step transforms the final primary / standby status confirmed by voting into a deterministic control action on the output channel, ensuring that only the side confirmed as the primary system has the right to output externally, while the side confirmed as the standby system or with voting anomalies is blocked from output at the hardware level. This ensures the mutual exclusion and security of the dual-system output control from the execution end.

[0039] This embodiment provides an output control method. When the master / standby status information of the system is obtained, this application updates the master / standby status of each channel by combining the master's willingness to take over, thereby forming an independently held master / standby status copy among each channel. Therefore, based on the master / standby status of each channel, a consensus vote can be performed to detect whether the status of each channel is consistent. When the status of each channel is consistent, the final master / standby status is confirmed. When the status of each channel is inconsistent, the disagreement is eliminated through a voting mechanism. Then, output enable or output block is determined based on the final master / standby status, and finally the deterministic decision of the master / standby status and safe output control are completed, which solves the technical problem of poor determinism in the master / standby status decision in conventional dual-system redundant control systems.

[0040] In one feasible implementation, the step of updating the primary / standby status of each channel in the system based on the primary / standby status information and the willingness to preempt primary status includes: Read the preset main state frequency and backup state frequency; The primary / standby status of the system is determined based on the frequency of the dynamic pulse signal in the primary / standby status information. When the system is determined to be in the master state, the intention to take over the master is ignored, and the master / standby status of each channel in the system is updated to standby status. When the system is determined to be in a non-master state, the master / standby status of each channel in the system is updated to master state.

[0041] It should be noted that the preset primary state frequency and backup state frequency refer to two pre-configured, distinct frequency values. The primary state frequency identifies the system's current primary state, and the backup state frequency identifies the system's current backup state. Both frequency values ​​are stored in the non-volatile storage area of ​​the system's platform layer. Dynamic pulse signals include, but are not limited to, square wave signals that periodically flip at a preset frequency. The frequency of this signal is selected by the sender from the primary state frequency and the backup state frequency based on its current primary / backup state. Determining the primary / backup state of a peer system refers to the process by which the system detects the actual frequency of the dynamic pulse signal sent by the peer system and compares it with the primary state frequency and the backup state frequency to identify the peer system's current state. Ignoring the attempt to preempt the system means that the system's platform layer rejects the preemption request issued by the service layer during the decision-making stage and does not pass the preemption request to the subsequent state generation stage. Updating to backup or primary state includes, but is not limited to, writing the status registers of each channel of the system into the corresponding backup state code or the corresponding primary state code.

[0042] Understandably, this implementation replaces the representation of master / standby status from conventional level signals or data packets with dynamic pulse signals with identifiable frequencies. This allows the system's status information to not only include the semantics of master or standby, but also the detectable attribute of frequency validity. Based on this, the decision logic prioritizes the system's status. When the system is already master, it forces the system into standby status regardless of its own intention to become master, thus achieving hardware-level deterministic mutual exclusion. Only when the system is not master will it respond to the system's request to become master. This detection-then-decision hardware execution order physically eliminates the possibility of dual-master conflicts.

[0043] In one feasible implementation, the system channel includes a first channel and a second channel, and the step of updating the primary / standby status of each channel of the system based on the primary / standby status information and the willingness to preempt primary status includes: Based on the first channel, according to the frequency of the dynamic pulse signal contained in the master / standby status information and the master preemption intention, a first master / standby status is generated according to a preset mutual exclusion logic; Based on the second channel, the dynamic pulse signal sent by the second channel of the system is acquired, and a second primary / backup state is generated according to the dynamic pulse signal of the second channel of the system. When the dynamic pulse signal of the second channel of the system represents the master state, the second channel forcibly determines the second master-standby state as the standby state; when the dynamic pulse signal of the second channel of the system represents the non-master state, the second channel determines the second master-standby state to be consistent with the first master-standby state. Write the first primary / backup status to the status register of the first channel, and write the second primary / backup status to the status register of the second channel to complete the primary / backup status update of each channel in the system.

[0044] It should be noted that the first channel and the second channel refer to two independent hardware processing channels set up within the system's platform layer. Each channel has its own independent signal detection circuit and state generation logic, and there is no hardware resource sharing between them. The preset mutual exclusion logic refers to the decision rule pre-embedded in the hardware circuit of the first channel. This rule prioritizes the master / standby status of the system. When the system is master, this system is forced to be standby; only when the system is not master is this system allowed to take over mastering. The first master / standby status refers to the state output result generated by the first channel according to the frequency of the dynamic pulse signal sent by the first channel of the system and the system's intention to take over mastering, according to the preset mutual exclusion logic. The second channel of the system refers to the independent hardware channel within the system's platform layer corresponding to the second channel of this system. The dynamic pulse signal sent by the second channel of the system is a state indication signal generated by the second channel of the system according to its own logic. This signal is directly received by the second channel of this system and used as the decision basis. The second master / standby status refers to the independent state output result generated by the second channel based on the dynamic pulse signal from the second channel of the system. Forced designation as standby means that when the second channel detects a dynamic pulse signal indicating a master state from the system's second channel, regardless of the decision of the system's first channel or the system's intention to take over master status, the second channel will be set to standby. Designation consistent with the first master / standby state includes, but is not limited to, the second channel directly transmitting the output signal of the first channel to the output terminal of the second channel, thereby maintaining the same state for both channels. The status register includes, but is not limited to, hardware registers within the system's platform layer that can be read by software, used to store the current master / standby status code of the corresponding channel.

[0045] It is understandable that this implementation divides the platform layer into a first channel and a second channel, achieving hardware-level separation of the primary / backup competition decision-making function and the rapid response function. The first channel, as the decision-making channel, plays a core role in interacting equally with the first channel of the opposing system and executing preset mutual exclusion logic. The second channel, as the rapid pass-through channel, directly detects the dynamic pulse signal of the second channel of the opposing system, bypassing the decision-making link of the first channel. When the second channel of the opposing system is not the primary channel, it directly passes the primary state of the first channel to the output of the second channel of this system. When the second channel of the opposing system is the primary channel, it overwrites the decision result of the first channel of this system and forces the output of the backup state. This division of labor architecture allows the system to complete the transmission and synchronization of primary / backup state signals without waiting for software intervention in non-conflict scenarios, compressing the inter-channel response delay to the hardware transmission level. In conflict scenarios, the forced backup mechanism of the second channel provides a second line of defense independent of the first channel, preventing the dual-primary state from being transmitted outward due to failure or incorrect decision of the first channel. Each channel generates an independent primary / backup state and writes it into its respective state register, providing redundant data for subsequent cross-channel consensus voting by the platform software.

[0046] In one feasible implementation, the step of performing a consensus vote on the primary and backup states of each channel in the system to obtain the final primary and backup states includes: Read the first primary / backup status from the status register of the first channel, and read the second primary / backup status from the status register of the second channel; When the first primary / standby state is consistent with the second primary / standby state, the final primary / standby state is determined to be the first primary / standby state. When the first primary / standby state is inconsistent with the second primary / standby state, the final primary / standby state is forcibly determined to be standby state, and a fault alarm message is generated.

[0047] It should be noted that reading the first primary / standby status in the status register of the first channel refers to the platform software accessing the hardware register of the first channel via the internal bus to obtain the status code previously generated and written by the first channel according to the preset mutual exclusion logic. Reading the second primary / standby status in the status register of the second channel refers to the platform software accessing the hardware register of the second channel in the same way to obtain the status code previously generated and written by the second channel based on the dynamic pulse signal of the second channel. Consistency means that the status codes of the first primary / standby status and the second primary / standby status are exactly the same, that is, both channels determine that the system is in the primary status or both determine that the system is in the standby status. Inconsistency means that the status codes of the first primary / standby status and the second primary / standby status are different, that is, one channel determines that the system is in the primary status while the other channel determines that the system is in the standby status. Forcing a standby status includes, but is not limited to, the platform software writing the final primary / standby status register into the standby status code and sending a degradation instruction to the output control circuit of the system, so that the system presents a standby status to the outside world. Fault alarm information includes, but is not limited to, channel voting abnormality indications reported to the service layer, hardware fault records sent to the maintenance and diagnostic system, or alarm output signals driving the audible and visual alarm devices.

[0048] Understandably, this implementation leverages the hardware independence of the first and second channels, using the independently generated primary / standby states of each channel as voting inputs. By comparing the state codes of the two channels, it achieves detection and fault tolerance for single-channel hardware failures. When the states of the two channels are consistent, this consistent state undergoes dual-channel cross-validation, and its reliability is higher than the self-decision result of a single channel, thus being confirmed as the final primary / standby state. When the states of the two channels are inconsistent, it indicates that at least one channel has experienced a hardware failure or signal transmission error. In this case, the system cannot determine which channel's decision is correct. Therefore, this implementation, following the fault-oriented safety principle, forcibly downgrades the system to a standby state to prevent the system from incorrectly outputting in the primary state due to a single-channel failure. Simultaneously, it generates fault alarm information so that maintenance personnel can promptly locate and repair the faulty hardware. This voting mechanism elevates the final confirmation right of the primary / standby state from a single hardware channel to a cross-channel joint arbitration level, providing the system with fault tolerance against random hardware failures.

[0049] In one feasible implementation, the step of determining the control information output by the system based on the final master / standby state includes: Obtain the preset output permission command issued by the business layer; When the final master / standby state is the master state and the output permission instruction is valid, the control information is determined to be output enable; When the final primary / standby status is standby or the output permission instruction is invalid, the control information is determined to be output blocked.

[0050] It should be noted that the preset business layer refers to the application software layer running above the system's platform layer. The business layer makes output permission decisions based on its own business logic and system health status. Output permission instructions include, but are not limited to, output enable bits or output block bits issued by the business layer to the platform layer. These instructions are written back to the platform layer's output control register by the business layer after receiving the final master / slave status reported by the platform layer. This is a confirmation and authorization signal from the business layer regarding the platform layer's master / slave status conclusion. Output enable means that the hardware switch of the system's external communication interface and drive loop is turned on, and the system obtains the physical permission to send control commands to external execution units. Output block means that the system's external communication interface and drive loop are disconnected at the hardware level, and the system cannot send any control commands to external execution units; the output port is placed in a safe state.

[0051] It is understandable that this implementation decomposes the final control over external output into two independent conditions: the platform layer hardware master / standby status and the business layer output permission instruction. These two conditions are logically ANDed. Only when the platform layer confirms that the system is in master status and the business layer confirms that output is allowed, does the system actually obtain external output permission. If either condition—the platform layer is in standby status or the business layer has not granted output permission—is not met, output is blocked by hardware. This dual-condition enabling mechanism ensures that the hardware decision of master / standby status and the application logic decision of the business layer mutually constrain each other. This prevents the business layer from erroneously outputting when the platform layer is not master, and also prevents the platform layer from arbitrarily outputting when the business layer determines that the system is unhealthy. This forms a layered closed-loop control from platform hardware voting to business logic confirmation, ensuring the security and controllability of output actions from the execution end.

[0052] In one feasible implementation, the step of obtaining the system's willingness to preempt the master in response to the master / standby status information sent by the system includes: Receive at least two dynamic pulse signals sent by the system through a preset redundant hard-wired interface. The frequency of each of the at least two dynamic pulse signals is detected. When any detected frequency is the preset main state frequency, the main / standby state information is determined to be the main state. When the primary state frequency is not detected on any of the paths, the primary / standby state information is determined to be a non-primary state. The pre-defined host-grabbing request issued by the business layer is used as the host-grabbing intention.

[0053] It should be noted that the preset redundant hard-wired interface refers to a signal transmission channel between the system and the counterpart system connected by two or more physically independent wires. Each wire is equipped with an independent isolation drive circuit and a receiving detection circuit, and the wires are independent of each other in terms of physical path and electrical characteristics. At least two dynamic pulse signals refer to dynamic pulse signals transmitted by the counterpart system through each wire in the redundant hard-wired interface. Each signal is driven by the same signal source at the transmitting end but is separated from each other in the transmission path, and is received separately by each independent detection circuit of the system at the receiving end. Separate detection frequencies include, but are not limited to, independent pulse period measurement and frequency calculation for each received dynamic pulse signal by the system. The detection process for each signal is executed in parallel by its corresponding hardware capture unit. The main state frequency refers to a pre-configured specific frequency value used to characterize the main state, and each detection circuit uses this frequency value as a decision threshold. Non-main states include, but are not limited to, situations where the counterpart system does not transmit any dynamic pulse signals, the frequency of the dynamic pulse signals transmitted by the counterpart system is the backup state frequency, the frequency of the dynamic pulse signals transmitted by the counterpart system deviates from the preset value beyond the allowable range, or the amplitude of the dynamic pulse signals transmitted by the counterpart system is lower than the effective threshold.

[0054] It is understandable that this implementation, by setting up redundant hard-wired interfaces at the physical transmission layer, enables the primary and backup status signals of the opposing system to be transmitted to the local system in parallel via multiple independent physical paths, avoiding the complete loss of status signals due to a single wire break, poor contact, or failure of a single drive circuit. At the signal decision level, this implementation adopts a strategy of determining the opposing system as the primary system if the primary status frequency is detected on any path. This strategy prioritizes the assumption that the opposing system is likely to be the primary system, and only considers the opposing system as non-primary when no primary status frequency is detected on all redundant paths. This ensures that even if some transmission paths fail, as long as any path is still transmitting the primary status signal normally, the local system can correctly identify the primary status of the opposing system and suppress its own preemptive behavior, thereby further strengthening the safety-oriented design against dual-primary conflict in the signal reception stage. At the same time, the independent detection of each signal allows the local system to distinguish between various situations such as the opposing system being the primary system, the opposing system being the backup system, and the opposing system being offline or faulty, providing a more accurate input basis for primary / backup contention decision.

[0055] For example, to help understand the implementation flow of the output control method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 2 , Figure 2 A simplified flowchart of an output control method is provided. Specifically, the safety control system comprises System A and System B. System A and System B are physically and logically redundant. Each system contains a first channel (main competition channel) and a second channel (fast pass-through competition channel). The first channel is equipped with a "request pulse generation module" and an "output feedback module" to execute the main / standby competition logic, output main / standby status signals, and check its own output status in real time. The second channel is equipped with a "parallel system request detection module" to independently receive dynamic pulse signals sent by the parallel system and perform pass-through or forced standby operations. System A and System B transmit main / standby request signals to each other through two redundant hard-wired interfaces. Simultaneously, a bidirectional signal link is provided between Channel 1 and Channel 2 within each system to ensure that the decision signal of Channel 1 can be transmitted to the output of the second channel of the same system without software delay when the detection result of Channel 2 meets the conditions.

[0056] In one implementation, system A and system B are connected via a pre-defined redundant hard-wired interface, which includes at least two physically independent transmission wires that serve as backups for each other. System A and system B each send dynamic pulse signals to each other, including but not limited to square wave signals. Specifically, the primary system status indication signal is a square wave signal of a first frequency (e.g., a 10kHz square wave with a 50% duty cycle, active high), and the backup system status indication signal is a square wave signal of a second frequency (e.g., a 1kHz square wave with a 50% duty cycle, active high).

[0057] When the system detects that the signal frequency of the other system exceeds the preset tolerance (e.g., ±5%) or has a continuous low level without frequency pulses, it determines that the primary / backup physical signal sent by the other system is in a "fault / invalid" state. This determination is incorporated into the composition of the primary / backup status information as the input basis for the primary / backup competition decision.

[0058] In one implementation, the second channel is configured as an independent hardware pass-through channel. After the first channel makes a master / standby decision, its generated status signal is directly sent to the input of the second channel. When the second channel detects that the dynamic pulse signal sent by the opposing second channel is "completely non-master" (i.e., does not contain the first frequency signal), it does not need to go through the software protocol stack for processing, nor does it need the central processing unit to execute any interrupts or scheduling. It directly passes the master status signal of the first channel to the output of its own system through the hardware link. This architecture reduces the synchronization delay of master / standby switching to the microsecond level of the hardware circuit's inherent transmission delay. If the second channel detects that the opposing second channel has sent the first frequency signal, it forcibly overwrites the output signal of its own first channel through a hardware comparison circuit and continues to send the second frequency signal, thereby ensuring the physical determinism of dual master mutual exclusion at the execution level.

[0059] In one implementation, before the platform layer outputs control information to external devices, the processor maintains and stores three sets of key status values ​​in real time: the first set is the "final primary / backup status of this system" determined after dual-channel voting; the second set is the "actual return check status of this system" detected by the first channel through the "output return check module"; and the third set is the "current primary / backup status of the other system" detected by the second channel in real time.

[0060] The platform layer's external output enablement is subject to the following preconditions: the first set of status values ​​must be in a "master state," the second set of status values ​​must be consistent with the first set (normal feedback), and the third set of status values ​​cannot conflict with the system's own status value. If any of these conditions are not met, the system directly cuts off the external output channel via hardware mechanisms. Simultaneously, before initiating a master-preemption request, the business layer must check the health status of its own platform. If the platform is unhealthy, the business layer is prohibited from sending master-preemption requests to the platform layer to prevent a faulty system from preempting the master system's output. This multi-level feedback and status filtering mechanism constitutes the final line of defense for "fault-oriented security" in this solution.

[0061] In one implementation, when the processor reads the status registers of the first and second channels and finds that the first primary / standby status is inconsistent with the second primary / standby status, the processor performs a fault-oriented safety action: on the one hand, it forcibly overwrites the output control circuit, cutting off all external output channels of the system; on the other hand, it forcibly rewrites the primary / standby status register of the system to standby status encoding and reports a serious hardware fault alarm of dual-channel inconsistency to the service layer. Since the system has lost the ability to output the master signal at the hardware level and its status has been forcibly downgraded to standby, the other system will continue to maintain its master status or automatically preempt the master without interference, thereby ensuring that a single-channel hardware fault will not cause erroneous output at the system level and meeting the SIL4 safety integrity level requirements.

[0062] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the output control method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0063] This application also provides an output control device, please refer to... Figure 3 The output control device includes: The acquisition module 10 is used to obtain the system's willingness to preempt the master in response to the master / standby status information sent by the system. The update module 20 is used to update the primary and backup status of each channel in the system based on the primary and backup status information and the willingness to preempt the primary status. Voting module 30 is used to perform a consensus vote on the primary and backup status of each channel in the system to obtain the final primary and backup status. Output module 40 is used to determine the control information to be output by the system based on the final master / slave status.

[0064] The output control device provided in this application, employing the output control method described in the above embodiments, can solve the technical problem of poor determinism in the decision-making of the primary and backup states in conventional dual-redundant control systems. Compared with the prior art, the beneficial effects of the output control device provided in this application are the same as those of the output control method described in the above embodiments, and other technical features in the output control device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0065] This application provides an output control device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the output control method in Embodiment 1 above.

[0066] The following is for reference. Figure 4The diagram illustrates a structural schematic suitable for implementing the output control device of the embodiments of this application. The output control device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, tablets, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital televisions and desktop computers. Figure 4 The output control device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0067] like Figure 4 As shown, the output control device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the output control device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the output control device to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show output control devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0068] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0069] The output control device provided in this application, employing the output control method described in the above embodiments, can solve the technical problem of poor determinism in the decision-making of the primary and backup states in conventional dual-redundant control systems. Compared with the prior art, the beneficial effects of the output control device provided in this application are the same as those of the output control method provided in the above embodiments, and other technical features of the output control device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0070] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0071] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0072] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the output control method described in the above embodiments.

[0073] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0074] The aforementioned computer-readable storage medium may be included in the output control device; or it may exist independently and not assembled into the output control device.

[0075] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by an output control device, cause the output control device to: In response to the master / standby status information sent to the system, obtain the system's willingness to preempt master; Based on the primary / standby status information and the willingness to take over, update the primary / standby status of each channel in this system; A consensus vote is conducted on the primary and backup status of each channel in this system to obtain the final primary and backup status; Based on the final master / standby status, determine the control information that this system outputs to external systems.

[0076] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0077] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0078] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0079] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described output control method, which can solve the technical problem of poor determinism in the decision-making of the primary and backup states in conventional dual-redundant control systems. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the output control method provided in the above embodiments, and will not be repeated here.

[0080] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the output control method described above.

[0081] The computer program product provided in this application can solve the technical problem of poor determinism in the decision-making of the primary and backup states in conventional dual-redundant control systems. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the output control method provided in the above embodiments, and will not be repeated here.

[0082] All acquisition of signals, information, or actions in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization of the owner of the relevant device.

[0083] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. An output control method, characterized in that, The method includes: In response to the master / standby status information sent to the system, obtain the system's willingness to preempt master; Based on the primary / standby status information and the willingness to take over, update the primary / standby status of each channel in this system; A consensus vote is conducted on the primary and backup status of each channel in this system to obtain the final primary and backup status; Based on the final master / standby status, determine the control information that this system outputs to external systems.

2. The method as described in claim 1, characterized in that, The step of updating the primary / standby status of each channel in the system based on the primary / standby status information and the willingness to preempt primary status includes: Read the preset main state frequency and backup state frequency; The primary / standby status of the system is determined based on the frequency of the dynamic pulse signal in the primary / standby status information. When the system is determined to be in the master state, the intention to take over the master is ignored, and the master / standby status of each channel in the system is updated to standby status. When the system is determined to be in a non-master state, the master / standby status of each channel in the system is updated to master state.

3. The method as described in claim 1, characterized in that, The system's channels include a first channel and a second channel. The step of updating the primary / standby status of each channel based on the primary / standby status information and the willingness to preempt primary status includes: Based on the first channel, according to the frequency of the dynamic pulse signal contained in the master / standby status information and the master preemption intention, a first master / standby status is generated according to a preset mutual exclusion logic; Based on the second channel, the dynamic pulse signal sent by the second channel of the system is acquired, and a second primary / backup state is generated according to the dynamic pulse signal of the second channel of the system. When the dynamic pulse signal of the second channel of the system represents the master state, the second channel forcibly determines the second master-standby state as the standby state; when the dynamic pulse signal of the second channel of the system represents the non-master state, the second channel determines the second master-standby state to be consistent with the first master-standby state. Write the first primary / backup status to the status register of the first channel, and write the second primary / backup status to the status register of the second channel to complete the primary / backup status update of each channel in the system.

4. The method as described in claim 3, characterized in that, The step of performing a consensus vote on the primary and backup status of each channel in the system to obtain the final primary and backup status includes: Read the first primary / backup status from the status register of the first channel, and read the second primary / backup status from the status register of the second channel; When the first primary / standby state is consistent with the second primary / standby state, the final primary / standby state is determined to be the first primary / standby state. When the first primary / standby state is inconsistent with the second primary / standby state, the final primary / standby state is forcibly determined to be standby state, and a fault alarm message is generated.

5. The method as described in claim 1, characterized in that, The step of determining the control information output by this system based on the final master / standby status includes: Obtain the preset output permission command issued by the business layer; When the final master / standby state is the master state and the output permission instruction is valid, the control information is determined to be output enable; When the final primary / standby status is standby or the output permission instruction is invalid, the control information is determined to be output blocked.

6. The method as described in claim 1, characterized in that, The step of obtaining the system's willingness to preempt the master in response to the master / standby status information sent by the system includes: Receive at least two dynamic pulse signals sent by the system through a preset redundant hard-wired interface. The frequency of each of the at least two dynamic pulse signals is detected. When any detected frequency is the preset main state frequency, the main / standby state information is determined to be the main state. When the primary state frequency is not detected on any of the paths, the primary / standby state information is determined to be a non-primary state. The pre-defined host-grabbing request issued by the business layer is used as the host-grabbing intention.

7. An output control device, characterized in that, The device includes: The acquisition module is used to obtain the system's willingness to preempt the master in response to the master / standby status information sent by the system. The update module is used to update the primary and backup status of each channel in the system based on the primary and backup status information and the willingness to take over the primary status. The voting module is used to conduct a consensus vote on the primary and backup status of each channel in the system to obtain the final primary and backup status. The output module is used to determine the control information to be output by the system based on the final master / slave status.

8. An output control device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the output control method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the output control method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the output control method as described in any one of claims 1 to 6.

Images