Multi-region automation device access, state synchronization and fault recovery method and system

Abstract

The present application relates to the technical field of distributed automation equipment control, and particularly relates to a kind of distributed access, state synchronization and fault recovery method and system for multi-geographical automation equipment.The method is discovered by geographical agent node and initiatively establishes persistent connection, control server issues connection epoch and connection lease, then based on expected state, observation state and local state log, incremental synchronization and abstract check are executed, control command generated by control server carries command identifier, target device generation and fence token, after current physical endpoint is parsed by geographical agent node, idempotent execution is carried out, equipment access and task state synchronization are realized;when network interruption, agent restart or port change, equipment is re-discovered, endpoint generation is incremented, and unfinished log is played back.The present application can inhibit obsolete connection and repeated command, improve the stability of equipment addressing, state consistency and fault recovery in multi-geographical weak network environment.

Description

Technical Field

[0001] This application relates to the field of distributed automation equipment control technology, specifically to a method and system for distributed access, state synchronization, and fault recovery of multi-regional automation equipment. Furthermore, this invention also relates to electronic devices and computer-readable storage media for implementing the aforementioned method. Background Technology

[0002] Cross-regional automated control refers to a technical system that utilizes cloud computing, the Internet of Things (IoT), and edge computing technologies to break down physical space and network segment limitations, enabling unified management, intelligent linkage, and automatic collaboration of equipment, resources, and services distributed across different cities, office locations, or deployment sites. Its core objective is to solve the problems of "data silos" and "response lag" in traditional localized management, achieving seamless collaboration and efficient operation of resources across the entire region.

[0003] In cross-regional automation control scenarios, the control server typically needs to manage agent nodes deployed in different office locations, data centers, or edge networks simultaneously, and further control mobile phones, browser containers, serial port controllers, virtual devices, or other automation terminals through these agent nodes. Because agent nodes and devices are located in different network environments, issues such as network address translation, dynamic ports, temporary network outages, route switching, operating system restarts, and external programs reassigning local endpoints often arise.

[0004] Existing technologies often use the proxy node's current IP address, port, or process session as the device control address and determine online status through simple heartbeats. When a proxy node restarts or a device is re-enumerated, the original device may acquire a new local port or process identifier. The control server may find it difficult to determine whether the newly discovered object is the original device, easily leading to duplicate device records, task target drift, or control commands being sent to outdated endpoints. On the other hand, during network jitter, old and new connections may coexist for a short period. Without connection generation and fencing mechanisms, outdated connections may continue to report status or execute delayed commands.

[0005] Furthermore, existing state synchronization solutions generally employ either timed full reporting or simple overwrite. Full reporting can generate significant network and database pressure when there are a large number of devices, while simple overwrite cannot identify state version rollbacks and state gaps during offline periods. Control commands may also be repeatedly executed during timeout retries, especially non-idempotent operations such as starting applications, modifying device configurations, or performing external actions. Repeated execution can disrupt device state and task consistency. Summary of the Invention

[0006] To address the problems in existing technologies where devices are directly identified by dynamic network addresses or temporary endpoints, leading to device identity drift, outdated concurrent connections, status gaps, and repeated execution of control commands, this application provides a method and system for distributed access, status synchronization, and fault recovery of multi-regional automation devices.

[0007] In the first aspect, this application provides a method for distributed access, state synchronization and fault recovery.

[0008] The method includes: discovering automated devices by regional agent nodes deployed in different regions, generating physical feature digests based on device stability attributes, assigning or inheriting logical device identifiers to the automated devices according to the physical feature digests, establishing an endpoint mapping relationship between the logical device identifiers and the current physical communication endpoints, and maintaining endpoint generation numbers used to represent the changing states of the physical communication endpoints.

[0009] The regional proxy node actively initiates a persistent connection to the control server. After identity authentication, the control server issues a connection epoch and connection lease for the regional proxy node and maintains the connection lease through a heartbeat mechanism.

[0010] The regional agent node maintains the expected device state, observed device state, and local state logs respectively. It writes device state changes into the local state log with a local version number and sends state increments to the control server. The control server periodically sends state summary verification information, and when the state summaries are inconsistent, it determines the state log version range that needs to be retransmitted based on the confirmed version number, and triggers the retransmission of the difference log for the corresponding version range. When the difference log cannot be used for state repair, it triggers the repair of the complete state snapshot.

[0011] The control server generates a control command, which includes a command identifier, a target logical device identifier, a target endpoint generation number, an execution period, and a fence token. The regional proxy node resolves the target logical device identifier to the current physical communication endpoint. After verifying the connection epoch, the target endpoint generation number, and the fence token, it executes the control command idempotently and sends an execution phase receipt and an execution result summary back to the control server.

[0012] When a network interruption, regional agent node restart, or physical communication endpoint change occurs, the regional agent node rediscovers the automated device, identifies and inherits the corresponding logical device identifier based on the physical feature digest, increments the corresponding endpoint code when the physical communication endpoint changes, restores the connection lease, and replays the unacknowledged records in the local status log to complete the fault recovery of device connection and task status.

[0013] Preferably, the regional agent node maintains a connection state machine for each automated device it connects to. The connection state machine is used to characterize and manage the connection lifecycle of the automated device, including at least offline state, discovery state, connected state, authentication state, ready state, degraded state, recovery state, and isolation state.

[0014] Preferably, when complete stable attributes cannot be obtained, candidate similarity is calculated based on the obtained stable attributes and the most recent binding record; when the candidate similarity is higher than a set threshold and there is no logical device identifier conflict, the original logical device identifier is inherited; when the candidate similarity is lower than or equal to the set threshold or there is a logical device identifier conflict, the original logical device identifier is not inherited, and the automated device is placed in a pending confirmation state.

[0015] Preferably, for a control command that is received for the first time and passes verification, the execution status of the control command is atomically changed from the received state to the executing state through condition update or transaction. During the execution of the control command, the execution checkpoint used to characterize the current execution stage is persistently recorded in the command execution table. For control commands that are received repeatedly, the corresponding external control action is not executed repeatedly, and the persistent execution stage receipt or execution result summary is fed back to the control server according to the current execution status of the control command.

[0016] Preferably, when the connection state machine corresponding to the automated device is in a degraded state, the control commands are classified and processed according to their categories.

[0017] In a second aspect, this application provides a distributed access, state synchronization, and fault recovery system, including a control server, at least one regional proxy node, and at least one automated device connected to the regional proxy node. The automated device communicates with the regional proxy node through a device adapter. The control server includes a connection epoch management module, a lease management module, a state aggregation and digest verification module, a control command module, and a fence token module, which are responsible for connection epoch management, connection lease management, state aggregation, command orchestration, and fence token management. The regional proxy node includes a device discovery module, a logical identity binding module, an endpoint resolution module, a connection lease module, a state log module, a command idempotency module, and a fault recovery module, which are responsible for device discovery, logical identity binding, endpoint resolution, local logging, command execution, and fault recovery.

[0018] Compared with the prior art, this application has at least the following beneficial effects:

[0019] (1) By decoupling the logical device identifier from the physical communication endpoint and using physical feature digests and endpoint codes to maintain the device identity and endpoint mapping relationship, the automated device can maintain a stable logical identity after the local communication port changes, the regional agent node restarts or reconnects, reducing the problem of device identity drift and control target error caused by changes in physical endpoints.

[0020] (2) By actively establishing a persistent connection with the control server through the regional agent node, and combining the connection epoch, connection lease and fence token for validity verification, the automation devices deployed in different regions and different local area network environments can be managed in a unified manner through the regional agent node, while reducing the risk of old or failed connections continuing to modify the device status or execute control commands.

[0021] (3) By combining the expected state of the device, the observed state of the device, the local state log, the state increment and the state summary verification, the missing state log can be retransmitted according to the version information after the network is interrupted or the regional agent node is temporarily offline. When the difference log cannot be repaired, the complete state snapshot is used to restore the state, thereby improving the integrity of the device state synchronization between the control server and the regional agent node and the fault recovery capability.

[0022] (4) The control commands are verified by logical device identifier, endpoint generation number, connection epoch and fence token, and an idempotent execution mechanism is adopted to ensure that control commands that are repeatedly issued, delayed or generated for old communication endpoints will not be repeatedly triggered or erroneously applied to the current automation equipment, thereby improving the reliability of control command execution in a distributed environment.

[0023] (5) By persisting the execution phase and execution result of the control command, when network timeout, repeated issuance or regional agent node restart occurs, the existing execution state of the control command can be identified, avoiding repeated triggering of external device actions by the same control command, and improving the ability to recover and track the task execution state.

[0024] (6) By using regional agent nodes to maintain the connection state machine for automated equipment, and implementing corresponding control strategies for different connection states such as ready, downgraded, recovery and isolation, the equipment can be processed in a hierarchical manner when a local connection anomaly occurs, instead of treating all anomalies as a complete offline process, thereby improving the continuous operation capability and anomaly handling capability of the multi-regional automated equipment access system. Attached Figure Description

[0025] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein:

[0026] Figure 1 The flowchart illustrates a distributed access, state synchronization, and fault recovery method for multi-regional automated devices according to the present invention.

[0027] Figure 2 The schematic diagram illustrates the structure of the distributed automation device access and status synchronization system of the present invention.

[0028] Figure 3 This diagram illustrates the process of endpoint changes and idempotent execution of control commands in this invention. Detailed Implementation

[0029] To enable those skilled in the art to better and fully understand the technical content of this invention, the definitions of some terms involved in this invention are described in detail below. Other terms involved in this invention, unless specifically stated herein, can be understood according to their common meaning in the art. It should be understood that, through the following description of terminology, the features, beneficial effects, and advantages of this invention will become apparent to those skilled in the art upon reading the contents of this specification.

[0030] The term "regional proxy node" as used in this application refers to a computer node deployed in a corresponding regional network environment, communicating with the control server and establishing connections with one or more automated devices within that region. Its functions include obtaining the status of local automated devices, acquiring candidate tasks from the control server, scoring devices based on their real-time status, initiating task claiming requests, and organizing task execution. The regional proxy node can be implemented by software programs running on computers, servers, or edge computing devices.

[0031] The "physical feature digest" referred to in this application refers to the determination of whether the current device is the same as the previous device, used for stable device identification, and serves as the basis for device identification.

[0032] The "logical device identifier" referred to in this application is initially assigned by the system based on the physical feature digest and inherited when the device is rediscovered in subsequent applications. It is a unique number for long-term reference devices within the system, that is, a stable identity recognition feature assigned to the device by the system.

[0033] The term "endpoint generation number" as used in this application is a version number recorded to describe the process of changing versions of the physical communication endpoint corresponding to the same logical device, and it does not participate in the generation of device identity.

[0034] The "connection state machine" referred to in this application is a software state management mechanism maintained within the regional agent node for each automated device it connects to. It is used to describe and manage the connection lifecycle of the automated devices, such as: OFFLINE; DISCOVERED; CONNECTING; AUTHENTICATING; READY.

[0035] The term "state value" as used in this application refers to the specific state content of the corresponding "connection state machine" at the time the state record is generated. For example, when the state type is connection state, the state value can be offline, discovered, connected, authenticated, ready, downgraded, recovered, or isolated; when the state type is application process state, current endpoint, task occupied state, or error state, the state value is the current state information of the corresponding type.

[0036] In this application, "local version number" refers to the version sequence number of the regional agent node's status record, which represents the incremental version number used by the regional agent node when generating the status record; "confirmed version number" refers to the highest local version number that the control server has confirmed received, which represents the highest local version number that the control server has successfully received and confirmed. The two belong to different positions in the same local status log version sequence.

[0037] In this application, "atomic" refers to atomicity in database / concurrency control. The so-called "atomic state transition" is the process by which a regional agent node, after receiving a valid control command for the first time, changes the command from the "received" state to the "executing" state through indivisible operations such as database transactions and condition updates, ensuring that the same command will not be started by two execution processes simultaneously due to concurrent requests or network retries.

[0038] The "command execution table" referred to in this application is a set of data records that are persistently maintained locally by the regional agent node to record the execution status and execution process information of control commands. The command identifier is used as the sole basis for identifying control commands. The table records one or more of the following information: the execution status of the control command, execution checkpoints, stage receipts, and execution result summaries. It is used to identify the existing execution status of the control command after the control command is repeatedly received, the regional agent node is restarted, or the execution is interrupted, so as to avoid repeating the execution of external control actions that have already been executed.

[0039] In this application, "execution checkpoint" refers to a record / information in the "command execution table" used to indicate the current execution progress, that is, an execution progress record persistently saved when the command execution reaches a certain critical stage. The "execution checkpoint" is recorded in the command execution table and is used to determine the stage to which the command has been executed after receiving repeated commands, restarting the regional agent node, or the execution being interrupted.

[0040] Furthermore, the terms "comprising," "including," and "containing" in this invention are non-limiting. The articles "an" and "a" are understood to refer to one or more protected or described in the claims.

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention.

[0042]

Example 1

[0043] The simplified working process of the method of this invention is as follows: the regional proxy node discovers the device and generates a physical feature digest, and binds the physical device to a stable logical device identifier; the regional proxy node actively initiates a persistent connection to the control server, and the control server issues a connection epoch and a connection lease; the regional proxy node maintains the expected state, observed state, and local state logs, and keeps the state of the control server consistent through state increment and digest verification; the control command carries the command identifier, endpoint generation, and fence token, and the regional proxy node parses the current endpoint and performs idempotent execution; after network interruption, proxy restart, or endpoint change, the device is rediscovered, the endpoint generation is incremented, and unacknowledged logs are replayed.

[0044] The specific steps of the method of the present invention will be further described below with reference to the accompanying drawings.

[0045] Reference Figure 1 The distributed access, status synchronization and fault recovery method for multi-regional automated devices of the present invention is implemented according to the following steps.

[0046] S1. Device discovery and stable logical identity construction.

[0047] In an optional embodiment, one or more regional proxy nodes are deployed in each region. The regional proxy nodes run a device discoverer that scans locally controllable objects by adapter type, including but not limited to mobile terminals, browser containers, serial port controllers, virtual machines, emulators, and external automation processes. The discoverer does not directly use the scanned port number as the device identity; instead, it reads relatively stable device attributes.

[0048] Specifically, the device hardware sequence information, system device identifier, adapter type, account container identifier, configuration directory summary, and communication protocol type are standardized. Standardization includes removing case differences, unifying path separators, filtering temporary fields, and sorting by field name. A hash value is calculated from the standardized results to obtain the physical feature summary H. Upon initial discovery, the regional agent node requests a logical device identifier L from the control server and establishes a binding relationship between L, H, the regional agent node identifier A, and the endpoint generation G.

[0049] When a device reappears but some stable attributes are unreadable, the regional agent node calculates candidate similarity based on existing attributes and the most recently bound record. Candidate similarity is obtained by weighting the matching results of each attribute, with hardware sequence information and system device identifier having higher weights. Port number and process identifier are not involved in stable identity calculation. The original logical device identifier is inherited only when the highest candidate similarity exceeds a threshold, the difference between it and the second-highest candidate exceeds a conflict threshold, and the corresponding logical device is not currently occupied by other active agents; otherwise, a device record to be confirmed is created.

[0050] Endpoint mapping records include protocol type, actual address, actual port, process instance, configuration directory, creation time, and endpoint generation number. For adapters that support port reservation, the regional agent node calculates the desired endpoint based on the logical device identifier and reserves priority for it; when the desired endpoint is unavailable, other actual endpoints are allocated, but the control server always uses only the logical device identifier for addressing, thereby avoiding coupling between upper-layer tasks and local ports.

[0051] S2, Connection Era, Lease and Connection Health Status Establishment.

[0052] In an optional embodiment, the regional proxy node actively initiates a persistent connection to connect to the control server to adapt to network address translation and inbound port restrictions in the regional network. Before establishing the connection, the regional proxy node completes two-way authentication using a node certificate, device key, or one-time registration credential. After successful authentication, the control server generates a monotonically increasing connection epoch E for the regional proxy node and issues a connection lease.

[0053] Each message in the connection carries the regional proxy node identifier A, the connection epoch E, the message sequence number Seq, and the generation time. The control server retains only one currently valid connection epoch for the regional proxy node; when a new connection completes authentication, the lease corresponding to the old connection is revoked, and even if the old transport channel has not been closed immediately, its subsequent messages will no longer have their validity status modified due to the connection epoch mismatch.

[0054] Regional proxy nodes calculate connection health based on heartbeat round-trip latency, latency jitter, consecutive packet loss counts, status log backlog, and command acknowledgment backlog. The heartbeat period is not a fixed value but dynamically adjusted between a set minimum and maximum period: the period is extended when the connection is stable and there is no backlog, and shortened when jitter is detected or unacknowledged commands are present. The connection state machine includes at least the following states: offline, discovery, connected, authenticated, ready, degraded, recovered, and isolated.

[0055] When consecutive heartbeat failures occur but the local device remains controllable, the regional agent node enters a degraded state, executing only commands related to secure stop, status queries, and explicitly permitted offline execution. After the lease expires, commands requiring exclusive control of the server are no longer executed. Upon network recovery, it enters a recovery state, first completing authentication, epoch updates, and state repair before transitioning to a ready state.

[0056] S3, Dual-state model and incremental state consistency repair.

[0057] In an optional embodiment, the control server stores the desired state (DesiredState) for each logical device, while the regional proxy node stores the observed state (ObservedState) obtained from real-time observations of the device. The desired state may include whether the device should be online, whether the target application should be running, the target configuration version, and the task occupancy status; the observed state may include connection status, application process status, current endpoint, resource usage, error codes, and the time of most recent activity.

[0058] After detecting a change in the observed state, the regional agent node generates a state record R. The state record includes at least the logical device identifier L, connection epoch E, endpoint generation G, local version number V, state type, state value, and generation time. The state record is first written to the local persistent log and then entered into the pending-send queue. Upon receiving the record, the control server merges the state only if the connection epoch equals the current epoch and the local version number is greater than the device's confirmed version number, and then returns the confirmed version number.

[0059] To prevent log gaps caused by prolonged offline periods, the control server and regional proxy nodes periodically calculate a state digest D. The state digest can be generated from the logical device identifier, endpoint generation, latest version number, and key state values. If the digests match, there is no need to transmit the complete state; if the digests do not match, the control server requests the difference logs for the specified version range based on the confirmed version number. If the difference logs have been compressed and cleaned up, or if the endpoint generation spans multiple versions, a complete state snapshot is requested for repair.

[0060] The status log is moved to the compressible area after receiving confirmation from the control server. Regional agent nodes retain the most recent checkpoint and unconfirmed status records to limit local storage growth. By using a disk-first, then-send approach, even if the agent process exits during transmission, it can resume transmission from the confirmed version number upon restarting.

[0061] S4, logical addressing, fence verification, and idempotent command execution.

[0062] In an optional embodiment, the control server creates a control command C. The control command includes a globally unique command identifier (CommandId), a target logical device identifier (L), an expected endpoint generation (Gexp), an execution deadline (Deadline), a command category, a parameter summary, and a fence token (F). The fence token is generated by the control server when granting execution rights to a task or device and has monotonicity or a unique lease constraint.

[0063] After receiving the control command, the regional proxy node sequentially verifies the connection epoch, connection lease, fence token, execution period, and expected endpoint generation. If the current endpoint generation of the target logical device is inconsistent with Gexp, it indicates that the device endpoint has been replaced after the command was generated. The command is rejected, and an endpoint change receipt is returned. After successful verification, the endpoint resolution module resolves the logical device identifier to the current actual communication endpoint.

[0064] The regional proxy node establishes a command execution table with CommandId as the primary key. Upon receiving a command for the first time, it atomically changes the state from non-existent to pending execution and records a checkpoint before executing the external action; during execution, it records the start of the step, the completion of the step, and a result summary; after execution, it writes the final state. When receiving the same CommandId repeatedly, it does not repeat the external action, but instead returns the saved current stage or final result.

[0065] For automated commands requiring multiple steps, the command can be broken down into reentrant steps, each containing a pre-execution state assertion and a completion state assertion. After the agent restarts, it determines whether a step has been completed based on the device's current observed state and the most recent checkpoint, avoiding blind retries based solely on process exit status.

[0066] S5, fault recovery under network, process and endpoint changes.

[0067] In an optional embodiment, when a local agent node restarts, it first loads the node identity, local device binding table, status log, command execution table, and most recently confirmed version, and then re-executes device discovery. For devices whose physical feature digests match historical records, the original logical device identifier is continued to be used; if the actual communication endpoint changes, the endpoint generation number is incremented and an endpoint change status record is generated.

[0068] After the regional proxy node reconnects to the control server, it submits the last connection epoch, state summary, unacknowledged log range, and summary of the command in execution. The control server issues a new connection epoch and selects one of three recovery methods based on the summary: no-difference acknowledgment, difference log retransmission, or full snapshot. For commands in execution, the control server returns a continue, terminate, or compensate instruction based on the command execution period, fence token, and the current task ownership.

[0069] When an external program reallocates the browser debugging port, proxy port, or device communication port during proxy operation, the device discoverer detects that the old endpoint is unavailable and the new endpoint has appeared. If the new endpoint corresponds to the same physical characteristic digest, the regional proxy node updates the endpoint mapping and increments the endpoint generation under the same logical device identifier. Thereafter, new commands use the new generation, and old commands become invalid due to generation mismatch.

[0070] For devices that are temporarily out of service, the regional agent node does not immediately delete the logical binding, but instead enters a recovery waiting period. During the recovery waiting period, it periodically attempts to re-enumerate and handshake; if the waiting period exceeds the limit and multiple conflicts are detected, it enters an isolation state, awaiting manual confirmation or secure unbinding. This avoids both the creation of duplicate devices due to short-term plugging and unplugging and the incorrect inheritance to another physical device.

[0071]

Example 2

[0072] The distributed access, status synchronization and fault recovery system for multi-regional automated devices of the present invention includes a control server, at least one regional agent node and at least one automated device connected to the regional agent node.

[0073] The control server can be deployed on a cloud server or in a control server data center, while regional agent nodes are deployed in local area networks in various regions. Automation devices connect to the regional agent nodes via USB, ADB, serial port, LAN protocol, browser debugging protocol, or other device adapters.

[0074] The regional agent node includes a device discovery module, a logical identity binding module, an endpoint resolution module, a connection lease module, a status log module, a command idempotency module, and a fault recovery module.

[0075] The control server includes a connection epoch management module, a lease management module, a status aggregation and digest verification module, a control command module, and a fence token module. Specifically, the connection epoch management module is responsible for determining currently valid connections; the lease management module is responsible for renewal and expiration revocation; the status aggregation module is responsible for version merging and digest verification; the control command module is responsible for command lifecycle management; and the fence token module is responsible for preventing obsolete tasks from continuing to occupy the device.

[0076] In the regional proxy node, the device discovery module is responsible for enumeration, the logical identity module is responsible for binding, the endpoint resolution module is responsible for converting logical addresses to actual endpoints, the status log module is responsible for writing to disk first and then reporting, the command idempotency module is responsible for checkpoints and handling duplicate requests, and the fault recovery module is responsible for reconnection and log replay.

[0077] The modules described above can be implemented using software, hardware, or a combination of both. Each module can be deployed within the same process or split into a process monitor, device adapter process, and database write process. In the process-split configuration, the regional agent node can also monitor child process exit events, clean up orphan processes and invalid lock files, ensuring that the necessary endpoint resources can be reclaimed during fault recovery.

[0078]

Example 3

[0079] This embodiment exemplifies the operation process of the above-described method and system.

[0080] For example, the control server has bound logical device L-01 to regional agent node A, with a historical endpoint generation of 7 and an actual port of 40001. After the external device management program restarts, it maps this device to 40013. The regional agent node confirms through physical feature digest that 40013 still corresponds to L-01, so it updates the endpoint generation to 8 and reports it. The previously generated delayed command carrying endpoint generation 7 is rejected upon arrival; the control server regenerates the command based on the new generation, and the regional agent node parses it to 40013 for execution.

[0081] For example, regional agent node A experiences a network outage after executing the second step of command C-100. The completion record of this step is written to the local command execution table, but the control server does not receive the final confirmation. After the network is restored, the control server resends C-100 due to a timeout. The regional agent node queries the system and finds that the second step of the command has been completed. Based on the device observation status, it confirms that the target state has been reached and directly returns the cached result without repeating the execution. This avoids repeated startups, configurations, or submissions of external operations.

[0082] Thus, this application sets generational or idempotent constraints at five levels: device identity, connection session, physical endpoint, state version, and command execution, so that multi-regional automation devices can maintain stable addressing and consistent control under network jitter, agent restart, and endpoint changes.

[0083]

Example 4

[0084] This embodiment provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. Using the system described in Embodiment 2, the processor executes the computer program to implement the method described in Embodiment 1.

[0085]

Example 5

[0086] This embodiment provides a computer-readable storage medium storing a computer program that uses the system described in Embodiment 2. When the computer program is executed by a processor, it implements the method described in Embodiment 1.

[0087] When the method and system of the present invention are used, and when the method or system of the present invention is run using the electronic device or computer-readable storage medium of the present invention, stable logical addressing can be provided for automated equipment in multi-regional, weak network and dynamic endpoint environments, blocking outdated connections and outdated commands, reducing state synchronization traffic, and rebuilding equipment state and unfinished tasks after the agent node restarts or the network recovers.

[0088] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. The technical features of the above-described embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the appended claims.

Claims

1. A method for multi-regional automated equipment access, status synchronization, and fault recovery, characterized in that, include: Automated devices are discovered by regional proxy nodes deployed in different regions. Physical feature summaries are generated based on the device's stability attributes. Logical device identifiers are assigned to the automated devices. An endpoint mapping relationship and endpoint generation number are established between the logical device identifiers and the current physical communication endpoints. The regional proxy node actively initiates a persistent connection to the control server. After successful authentication, the control server issues a monotonically increasing connection epoch and a connection lease with a valid period, so that the status messages and control messages transmitted on the persistent connection carry the regional proxy node identifier, connection epoch, and message sequence number. The regional agent node maintains the expected device status, observed device status, and local status logs. It writes device status changes into the local status log with a local version number and sends status increments to the control server. The control server periodically sends status summary verification information and triggers differential log retransmission or complete status snapshot repair when the status summary is inconsistent. The control server generates control commands, which include a command identifier, a target logical device identifier, a target endpoint generation number, an execution period, and a fence token. The target logical device identifier is resolved to the current physical communication endpoint by the regional proxy node. After verifying the connection epoch, the target endpoint generation number and the fence token, the control command is executed idempotently and a phase receipt and result summary are fed back to the control server to realize device access and task status synchronization. When a network interruption, regional agent node restart, automated device re-enumeration, or physical communication endpoint change occurs, the regional agent node rediscovers the automated device, inherits the corresponding logical device identifier based on the physical feature digest, increments the endpoint generation number, restores the connection lease, and replays unacknowledged records in the local status log, thus completing the fault recovery of device connection and task status.

2. The method according to claim 1, characterized in that, The device stability attributes include hardware sequence information, system device identifier, adapter type, account container identifier, configuration directory summary, and communication protocol type; The process of generating physical feature summaries based on device stability attributes includes: Obtain at least two stability attributes from the device stability attributes of the automated equipment; The physical feature summary is obtained by standardizing, sorting, and hashing the stable attributes. When complete stable attributes cannot be obtained, candidate similarity is calculated based on the obtained stable attributes and the most recent binding record. The original logical device identifier is inherited only when the candidate similarity is higher than the set threshold and there is no logical device identifier conflict.

3. The method according to claim 1, characterized in that, The regional proxy node maintains a connection state machine, which includes at least the following states: offline state, discovery state, connection state, authentication state, ready state, degraded state, recovery state, and isolation state. The regional proxy node calculates the connection health based on heartbeat round-trip time, number of consecutive packet loss, length of pending status log, and backlog of command receipts, and keeps the connection state machine switching between ready, degraded and recovered states according to the connection health. When the connection health is below the isolation threshold or continuous authentication fails, the system enters the isolation state and stops receiving new non-recovery control commands.

4. The method according to claim 3, characterized in that, The state increment consists of a set of state records, each of which includes a logical device identifier, connection epoch, endpoint generation number, local version number, state type, state value, and generation time. The control server only accepts status records where the connection epoch is equal to the current valid connection epoch and the local version number is greater than the confirmed version number. The status digest verification information consists of a hash digest generated from multiple logical device identifiers, corresponding endpoint generation numbers, and confirmed version numbers, in order to determine the version range that needs to be retransmitted.

5. The method according to claim 3, characterized in that, When the connection state machine corresponding to the automated device is in a degraded state, during the connection degrade period, commands are classified into safe stop, status query, deferred execution, and prohibited offline execution categories according to the command type. The safe stop and status query commands are allowed to be executed after local policy verification, the commands that can be executed in a delayed manner are written into the waiting queue, and the commands that are prohibited from being executed offline are rejected. After the connection is restored, the waiting queue is cleaned up or reset according to the command execution period, command priority, and target endpoint generation number.

6. The method according to claim 1, characterized in that, The endpoint mapping relationship includes expected endpoints and actual endpoints; The regional agent node prioritizes reserving the desired endpoint for the automated equipment. When the desired endpoint is occupied or the port is reassigned by an external program, an available actual endpoint is selected and the endpoint mapping relationship is written. The control server only stores the logical device identifier and endpoint generation number, and does not directly use the actual port as the cross-regional control address, so as to keep the upper-layer task target unchanged when the actual endpoint changes.

7. The method according to claim 1, characterized in that, The idempotent execution includes: A command execution table is established on the regional agent node side, with the command identifier as the primary key. The command execution table records the status of pending execution, execution in progress, completed, failed, and result pending confirmation. For control commands that are received for the first time and pass verification, perform atomic state transitions and persistently execute checkpoints; For repeatedly received control commands, return a persisted stage receipt or result summary; Control commands carrying old connection epochs, old endpoint generation numbers, or invalid fence tokens are rejected.

8. A distributed access, status synchronization, and fault recovery system for multi-regional automated equipment, characterized in that, It includes a control server, at least one regional agent node, and at least one automated device connected to the regional agent node; The regional proxy node includes a device discovery module, a logical identity binding module, an endpoint resolution module, a connection lease module, a status log module, a command idempotency module, and a fault recovery module; The control server includes a connection epoch management module, a lease management module, a status aggregation and digest verification module, a control command module, and a fence token module; The system is configured to perform the method of any one of claims 1 to 7.

9. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images