Robot control system fault protection device and method based on out-of-band management controller

Abstract

The application discloses a kind of robot control system fault protection device and method based on out-of-band management controller, the method includes: out-of-band management controller gathers the operating state parameter of each unit, and according to operating state parameter, fault grading determination is carried out, when determining that fatal failure occurs, channel switching instruction is sent to channel dynamic configuration unit, and bottom control instruction is generated synchronously;Channel dynamic configuration unit responds to channel switching instruction, and the control right of real-time channel is handed over from first communication master station to second communication master station;After second communication master station obtains control right, it receives the bottom control instruction sent by out-of-band management controller, and is forwarded to each execution joint of robot by real-time channel;Out-of-band management controller issues back switch instruction to channel dynamic configuration unit when determining that fault has been eliminated;Channel dynamic configuration unit responds to back switch instruction, and the control right of real-time channel is returned to first communication master station from second communication master station.

Description

Technical Field

[0001] This application relates to the field of robot control technology, and in particular to a fault protection device and method for a robot control system based on an out-of-band management controller, a storage medium, and a computer device. Background Technology

[0002] Humanoid robots, as a product of the deep integration of artificial intelligence and precision mechanics, generally employ a heterogeneous computing architecture in their control systems, where the CPU handles high-level decision-making and motion planning, while the NPU or GPU handles AI inference and visual processing. High-precision synchronous control of the integrated multi-degree-of-freedom joints throughout the body is achieved via the EtherCAT industrial real-time Ethernet protocol. As humanoid robots move from laboratories to open scenarios such as industrial manufacturing, commercial services, and even home care, the requirements for maintaining dynamic balance, joint force control precision, terrain adaptation, and reliability during long-term continuous operation are becoming increasingly stringent. However, the continuous heat generation of high-power-density joint modules, electromagnetic interference and vibration in industrial environments, and any anomaly in the collaborative operation of multiple joints all pose severe challenges to the stability of the control system. Ensuring that the robot does not lose control or fall when the main computing core or communication link malfunctions has become a core technological bottleneck restricting the large-scale safe deployment of humanoid robots.

[0003] Existing humanoid robot control systems have significant shortcomings in fault protection. Current mainstream protection methods primarily focus on software-level fault diagnosis, such as fault identification based on machine learning models like support vector machines and random forests, or process-level monitoring relying on the operating system's built-in watchdog timer. While these solutions can achieve a certain level of fault detection accuracy, their operation is inherently dependent on the main CPU and operating system. If the main operating system experiences a kernel crash, hardware hang, or power failure, the diagnostic program also becomes ineffective, failing to perform any effective protective actions at critical moments. Meanwhile, although EtherCAT communication layers employ technologies like ring network redundancy or dual network redundancy to handle link interruptions, existing redundancy solutions primarily focus on cable faults or slave station failures, lacking mechanisms to address scenarios where the master station itself is "powered but brainless" due to CPU failure, unable to generate effective control frames. More critically, maintaining dynamic balance in humanoid robots depends on millisecond-cycle joint control command flows. If the master station stops sending commands due to a main system failure, the robot will lose posture control within a very short time, leading to falls, equipment damage, or even injuries. Summary of the Invention

[0004] In view of this, this application provides a fault protection device and method for a robot control system based on an out-of-band management controller, a storage medium, and a computer device. By setting an out-of-band management controller independent of the main computing control unit and configuring redundant communication master station units, it solves the technical problem that existing software-level diagnostic schemes become ineffective after the main operating system crashes or the hardware hangs, and cannot perform hardware-level independent monitoring and fault judgment. By using a channel dynamic configuration unit to perform exclusive transfer of real-time channel control authority between the two master stations, and having the second communication master station with the obtained authority forward the backup control instructions generated by the out-of-band management controller, it solves the technical problem that existing EtherCAT redundancy schemes can only cope with link interruptions, but cannot maintain the continuity of joint command flow when the master station cannot generate control frames due to the failure of the main system.

[0005] According to one aspect of this application, a fault protection device for a robot control system based on an out-of-band management controller is provided, comprising: The redundant communication master station unit includes a first communication master station associated with the robot's main computing control unit, and a second communication master station serving as a hot standby redundant master station; An external management controller, set independently of the main computing control unit, is physically connected to the main computing control unit, memory unit, and bus RAS unit via a dedicated management bus. It is used to collect the operating status parameters of each unit and to perform fault classification judgment based on the operating status parameters. In addition, when a fatal fault is determined, it sends a channel switching command to the channel dynamic configuration unit and simultaneously generates a backup control command based on the internally preset backup control strategy. The channel dynamic configuration unit is connected to the out-of-band management controller, the first communication master station, and the second communication master station respectively. It is used to transfer the control authority of the real-time channel from the first communication master station to the second communication master station in response to the channel switching command of the out-of-band management controller, and only a single master station is allowed to occupy the real-time channel at the same time. The second communication master station is used to receive the backup control command sent by the out-of-band management controller after obtaining the control authority, and to forward the backup control command to each execution joint of the robot through the real-time channel; The out-of-band management controller is also used to send a switchback command to the channel dynamic configuration unit when it is determined that the fault has been eliminated. The channel dynamic configuration unit is also used to, in response to the switchback command, return the control authority of the real-time channel from the second communication master station to the first communication master station.

[0006] According to another aspect of this application, a fault protection method for a robot control system based on an out-of-band management controller is provided, comprising: The out-of-band management controller collects the operating status parameters of each unit and performs fault classification judgment based on the operating status parameters. Each unit includes a main computing control unit, a memory unit, and a bus RAS unit. When the out-of-band management controller determines that a fatal fault has occurred, it sends a channel switching command to the channel dynamic configuration unit and simultaneously generates a backup control command based on the internally preset backup control strategy. The channel dynamic configuration unit responds to the channel switching command of the out-of-band management controller by transferring the control authority of the real-time channel from the first communication master station to the second communication master station, and only a single master station is allowed to occupy the real-time channel at any given time. After obtaining the control authority, the second communication master station receives the backup control command sent by the out-of-band management controller and forwards the backup control command to each execution joint of the robot through the real-time channel; When the out-of-band management controller determines that the fault has been eliminated, it sends a switchback command to the channel dynamic configuration unit. In response to the switchback command, the channel dynamic configuration unit returns control of the real-time channel from the second communication master station to the first communication master station.

[0007] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described fault protection method for a robot control system based on an out-of-band management controller.

[0008] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described fault protection method for a robot control system based on an out-of-band management controller.

[0009] By employing the above technical solutions, this application provides a fault protection device and method for a robot control system based on an out-of-band management controller, a storage medium, and a computer device. Through the collaborative design of an out-of-band management controller independent of the main computing control unit, a time-sharing redundant communication master station architecture, and a pre-set backup control strategy, it fundamentally overcomes the fatal flaw of traditional software diagnostic solutions that rely on the main operating system. Even if the main CPU experiences a kernel crash or complete power failure, the independently powered out-of-band management controller can continue to perform hardware monitoring and, within milliseconds, transfer real-time channel control authority from the failed first communication master station to the second communication master station via the channel dynamic configuration unit. This fills the protection blind spot of existing EtherCAT redundancy schemes, which can only handle link interruptions but cannot address the lack of control over the master station due to main system failure. Furthermore, the backup control commands synchronously generated by the out-of-band management controller are continuously sent to each joint via the second communication master station that has obtained control authority, ensuring that the robot can maintain a millisecond-cycle joint control command flow even when the main system is completely paralyzed, avoiding instantaneous loss of control and equipment damage caused by control command interruption. In addition, after troubleshooting, the system automatically switches back to the first communication master station, without relying on the main system software or manual intervention, which is simple and convenient.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This paper presents a schematic flowchart of a fault protection device for a robot control system based on an out-of-band management controller, according to an embodiment of this application. Figure 2 This illustration shows a structural schematic diagram of a fault protection method for a robot control system based on an out-of-band management controller, provided in an embodiment of this application. Figure 3 A flowchart illustrating another fault protection method for a robot control system based on an out-of-band management controller provided in an embodiment of this application is shown. Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0012] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0013] This embodiment provides a fault protection device for a robot control system based on an out-of-band management controller, such as... Figure 1 As shown, the device includes: The redundant communication master station unit includes a first communication master station associated with the robot's main computing control unit, and a second communication master station serving as a hot standby redundant master station; An external management controller, set independently of the main computing control unit, is physically connected to the main computing control unit, memory unit, and bus RAS unit via a dedicated management bus. It is used to collect the operating status parameters of each unit and to perform fault classification judgment based on the operating status parameters. In addition, when a fatal fault is determined, it sends a channel switching command to the channel dynamic configuration unit and simultaneously generates a backup control command based on the internally preset backup control strategy. The channel dynamic configuration unit is connected to the out-of-band management controller, the first communication master station, and the second communication master station respectively. It is used to transfer the control authority of the real-time channel from the first communication master station to the second communication master station in response to the channel switching command of the out-of-band management controller, and only a single master station is allowed to occupy the real-time channel at the same time. The second communication master station is used to receive the backup control command sent by the out-of-band management controller after obtaining the control authority, and to forward the backup control command to each execution joint of the robot through the real-time channel; The out-of-band management controller is also used to send a switchback command to the channel dynamic configuration unit when it is determined that the fault has been eliminated. The channel dynamic configuration unit is also used to, in response to the switchback command, return the control authority of the real-time channel from the second communication master station to the first communication master station.

[0014] This application provides a fault protection device for a robot control system based on an out-of-band management controller, which is a hardware-level fault protection system independent of the robot's main computing system. Specifically, it may include a redundant communication master station unit, an out-of-band management controller, and a channel dynamic configuration unit.

[0015] The redundant communication master station unit can be configured with two communication master stations. The first communication master station maintains a connection with the robot's main computing control unit (i.e., the CPU and NPU chipset responsible for motion planning and AI inference) during normal operation, and is responsible for issuing real-time control commands to each execution joint of the robot. The second communication master station is in a standby state as a hot standby redundant master station. Here, hot standby means that it is not completely powered off or offline, but keeps synchronized with the system state at all times, but does not actively send any commands to each execution joint. Together, the two constitute a "one master and one standby" communication hub redundancy scheme, providing a physical hardware foundation for subsequent fault switching.

[0016] The out-of-band management controller (BMC), as the core decision-making unit of the entire protection device, is physically independent of the main computing control unit. It establishes direct physical connections with the main computing control unit, memory unit, and bus RAS unit through a dedicated management bus. Here, "out-of-band" means it does not rely on the main system's data transmission channel but has its own independent communication path. The RAS unit represents reliability, availability, and maintainability; it is a dedicated hardware module responsible for monitoring bus communication quality, capable of detecting anomalies such as error frames and communication delays in data transmission. This application allows the addition of a server-level BMC independent of the main CPU and NPU in the robot control system. This BMC can establish dedicated communication links with the CPU, NPU, memory unit, and bus RAS unit via the IPMI protocol, achieving real-time, independent status monitoring and fault detection. The out-of-band management controller can continuously collect operating status parameters of the aforementioned units (such as temperature, voltage, memory error count, and number of bus error frames), and based on these parameters, perform fault classification, distinguishing the system's health status into different levels. When a fatal failure is detected (i.e., a parameter is severely exceeded, such as excessive CPU temperature or a surge in memory errors), a channel switching command can be immediately issued to the channel dynamic configuration unit. Simultaneously, an emergency control command is generated based on its pre-defined fallback control strategy. This fallback control strategy does not rely on the computing power of the main computing control unit but is completed independently by the out-of-band management controller, thus ensuring that the ability to generate control commands remains even if the main system completely crashes.

[0017] Upon receiving a channel switching command from the out-of-band management controller, the channel dynamic configuration unit immediately executes a control transfer action for the real-time channel. This transfers control of the dedicated real-time channel for transmitting joint control commands from the first communication master station to the second. Throughout the switching process and subsequent operation, it strictly ensures that only one communication master station can occupy the real-time channel at any given time. Here, the real-time channel refers to a high-priority communication link specifically for transmitting joint control commands, requiring extremely low transmission latency to ensure the robot can respond in real time. This exclusive control design fundamentally avoids the problem of "dual master station conflict," preventing two communication master stations from simultaneously sending conflicting control commands to the joint. Such conflicts can not only lead to erratic robot movements but may even damage joint actuators in severe cases. Therefore, the channel dynamic configuration unit effectively ensures the uniqueness and determinism of the communication order through hardware-level mandatory constraints.

[0018] After successfully gaining control of the real-time channel, the second communication master station can immediately receive pre-generated safety control commands from the out-of-band management controller. These commands are then forwarded to the robot's various execution joints via the real-time channel. These execution joints can include high-degree-of-freedom servo drive units such as the hip and ankle joints, each integrating components such as motors, drivers, absolute encoders, and force sensors. The safety control commands generated by the out-of-band management controller are not complex optimal motion plans, but rather emergency adjustment commands based on simplified dynamic models. For example, they prioritize adjusting the angles of the hip and ankle joints, attempting to pull the robot's center of mass back within a stability margin range. This bypasses the failed main computation control unit, allowing the independently powered out-of-band management controller to take over the responsibility of issuing joint control commands within milliseconds. This fills the control vacuum between the main system crash and human intervention, preventing the robot from instantly losing control and falling due to interrupted command flow.

[0019] When the out-of-band management controller continuously monitors and finds that the operating status parameters of each unit have returned to the normal range and have been running stably for a preset period of time, it can determine that the fault has been eliminated and then sends a switchback command to the channel dynamic configuration unit. In response to this switchback command, the channel dynamic configuration unit returns control of the real-time channel from the second communication master station to the first communication master station, restoring the system to its initial normal operating mode. In this embodiment, the system can automatically switch to the backup channel to maintain operation when a fault occurs, and automatically return to the primary channel after the fault is eliminated, without any manual intervention. This design avoids the cumbersome operation of manually restarting the main system or manually restoring the configuration after a fault in a unidirectional redundancy scheme, achieving complete automation of the entire redundancy takeover process.

[0020] By applying the technical solution of this embodiment, through the collaborative design of an out-of-band management controller independent of the main computing control unit, a time-sharing redundant communication master station architecture, and a pre-set backup control strategy, the fatal flaw of traditional software diagnostic solutions that rely on the main operating system is fundamentally overcome. Even if the main CPU experiences a kernel crash or complete power failure, the independently powered out-of-band management controller can continue to perform hardware monitoring and, within milliseconds, transfer real-time channel control authority from the failed first communication master station to the second communication master station via the channel dynamic configuration unit. This fills the blind spot in existing EtherCAT redundancy solutions, which can only handle link interruptions but cannot address the lack of control over the master station due to main system failure. Furthermore, the backup control commands synchronously generated by the out-of-band management controller are continuously sent to each joint via the second communication master station that has obtained control authority, ensuring that the robot can maintain a millisecond-cycle joint control command flow even when the main system is completely paralyzed, avoiding instantaneous loss of control and equipment damage caused by control command interruption. In addition, after fault resolution, the system automatically switches back to the first communication master station, without relying on the main system software or manual intervention, making the process simple and convenient.

[0021] Optionally, in this embodiment of the application, the out-of-band management controller integrates a fault classification and determination module; the fault classification and determination module is used to: output a fatal fault determination result when the operating status parameter exceeds a preset fatal fault threshold; and output a potential fault determination result when the operating status parameter does not exceed the preset fatal fault threshold, but the rate of change of the operating status parameter within a preset time window exceeds a preset rate of change threshold. The fault classification and determination module is further configured to: when outputting the potential fault determination result, send a warning signal to the target receiving terminal through a non-real-time channel, and simultaneously wake up the second communication master station to enter the state synchronization preparation mode; the state synchronization preparation mode is a mode in which the current system state data is synchronized with the first communication master station in advance before the second communication master station obtains the real-time channel control authority; and when outputting the fatal fault determination result, output the channel switching instruction to the channel dynamic configuration unit.

[0022] In this embodiment, the out-of-band management controller can integrate a fault classification and judgment module. Its core lies in upgrading the traditional single-threshold alarm mechanism to a two-dimensional classification system. The preset fatal fault threshold refers to the absolute safety boundary preset for various operating status parameters, such as CPU temperature exceeding 85°C or memory ECC error count exceeding 100 times per second. Once any parameter exceeds this boundary, it indicates that the system is in a severely abnormal state, and mandatory protective actions such as master station switching must be executed immediately. The characteristic of this type of fault is that it "has already occurred and the consequences are serious," leaving no buffer or warning time for the system. Therefore, the corresponding handling strategy is to directly trigger a channel switching command, skipping the warning process.

[0023] In contrast, the trigger condition for potential fault determination is that although the operating status parameter has not yet exceeded the preset fatal fault threshold, its rate of change within a preset time window exceeds the preset rate of change threshold. Here, the rate of change refers to the slope or speed of parameter change over time. For example, if the CPU temperature rises sharply by 10°C in 10 seconds, even though the current temperature may only be 70°C and has not yet reached the preset fatal fault threshold of 85°C, this rapid increase in temperature often indicates potential risks such as heat dissipation system failure, sudden load increase, or internal chip damage. By introducing this dynamic rate of change monitoring dimension, the system can identify the trend signal of rapidly accumulating risks before the fault truly deteriorates to a fatal level, thereby upgrading the protective action from passive "post-event remediation" to proactive "pre-event warning".

[0024] When the fault classification and determination module outputs the potential fault determination result, two parallel response paths can be initiated. One is to send a warning signal to the target receiving terminal through a non-real-time channel. Here, the non-real-time channel refers to a low-bandwidth communication link independent of the real-time channel dedicated to transmitting joint control commands. It is used to transmit time-insensitive information such as monitoring data and fault logs. Even if there is a slight delay in data transmission on this channel, it will not affect the robot's dynamic balance control. The target receiving terminal can be a remote operation and maintenance monitoring platform, a tablet device of the on-site operator, or a status display panel on the robot itself. The purpose is to allow operation and maintenance personnel to be aware of potential fault risks in the system in advance and to prepare for manual intervention or on-site evacuation.

[0025] Secondly, the second communication master station is synchronously woken up and enters the state synchronization preparation mode. Here, synchronous wake-up means that this action occurs simultaneously with the issuance of the warning signal, without any sequential delay. The state synchronization preparation mode means that the second communication master station, before obtaining real-time channel control authority, synchronizes the current system state data with the currently active first communication master station, such as the latest joint position command sequence, robot posture estimation values, EtherCAT bus configuration parameters, and other key context information. The core significance of this preparatory action is to advance the data preparation process required for takeover from after a fatal failure occurs to when a potential failure is warned. This ensures that if a fatal failure does occur, the second communication master station already has a complete set of cached data that is fully synchronized with the current control state, eliminating the need to spend time requesting or copying data from the first communication master station at the switchover time, thereby compressing the total switchover time to the millisecond level.

[0026] When the fault classification and determination module outputs a fatal fault determination result, it immediately outputs a channel switching command to the channel dynamic configuration unit to transfer control authority. Compared with early warning and preparation for potential faults, fatal fault response eliminates all intermediate links of notification and preparation, and directly executes the final protection action. This differentiated design logic ensures that the system can complete takeover in emergency situations with the shortest path and the fewest steps, avoiding the waste of millisecond-level time windows due to performing too many pre-operations.

[0027] The hierarchical response mechanism of this application effectively avoids the dilemma of "either everything is normal or it suddenly collapses" in the single threshold scheme, significantly reduces the probability of robot loss of control due to sudden failure, and creates a time window for human intervention by sending out early warning signals, fundamentally improving the fault tolerance and robustness of the humanoid robot control system in complex operating environments.

[0028] Optionally, in this embodiment of the application, the out-of-band management controller integrates a master station status monitoring module; the master station status monitoring module is used to broadcast heartbeat signals to the first communication master station and the second communication master station at a first preset period, and update the validity status of the master station in real time according to the survival confirmation frames returned by each master station; The master station status monitoring module is also used to shorten the broadcast period of the heartbeat signal to a preset encryption period when the number of times the liveness confirmation frame is not received from any master station reaches a preset threshold, so as to accelerate the confirmation of the validity status of any master station; if the number of times the liveness confirmation frame is not received within the preset encryption period reaches a preset fault confirmation threshold, then the master station is determined to be faulty, and the channel switching instruction is output to the channel dynamic configuration unit. The channel dynamic configuration unit is also used to respond to the channel switching command by interrupting the connection between the first communication master station and the real-time channel at the physical layer, forcibly releasing the physical signal occupation of the real-time channel; after a silence interval associated with the first preset period of the heartbeat signal, establishing the connection between the second communication master station and the real-time channel, and restoring the heartbeat signal to the first preset period; The channel dynamic configuration unit is also used to perform offline detection on the first communication master station through a dedicated diagnostic link independent of the real-time channel during the silent interval. If the validity status of the first communication master station is determined to be normal, the current switching process is terminated and the control authority of the first communication master station over the real-time channel is maintained.

[0029] In this embodiment, the out-of-band management controller may also integrate a master station status monitoring module. Specifically, the master station status monitoring module broadcasts a heartbeat signal to the first and second communication master stations at a first preset period. Upon receiving the signal, the two master stations can return a survival confirmation frame as a response. The master station status monitoring module can then maintain a validity status table in real time, recording whether the two master stations are currently in normal working condition, based on the arrival of these survival confirmation frames. This proactive, periodic, two-way confirmation mechanism complements the aforementioned method of reading operating status parameters. The heartbeat signal detects the functional health indicator of whether the master station can respond to communication requests normally, while the operating status parameters reflect whether the master station's internal physical indicators such as temperature, voltage, and error count are normal. Together, they constitute a comprehensive assessment of the master station's health status from different dimensions.

[0030] When the number of times the master station status monitoring module fails to receive a liveness confirmation frame from any master station reaches a preset threshold (e.g., no response after three consecutive broadcasts), it does not immediately determine that the master station has failed and trigger a handover. Instead, it shortens the broadcast period of the heartbeat signal from a relatively sparse first preset period to a preset encryption period, i.e., it increases the detection frequency to send heartbeat signals to the master station more frequently. This effectively distinguishes between two completely different situations: "the master station is truly dead" and "it's just occasional packet loss due to network jitter." If the master station failed to respond to the first one or two probes due to a momentary load spike or brief electromagnetic interference, it is likely to recover under the high-frequency detection of the preset encryption period, thus avoiding an unnecessary handover operation. Conversely, if there is still no response during the encrypted detection period, it can be basically confirmed that the master station has indeed failed. This two-level detection mechanism of "sparse detection to save bandwidth and encrypted confirmation to eliminate false alarms" significantly reduces the false handover rate while ensuring the real-time nature of fault detection.

[0031] If the number of times a liveness confirmation frame is not received within the preset encryption period further reaches the preset fault confirmation threshold, the master station status monitoring module will finally determine that the master station has failed and output a channel switching instruction to the channel dynamic configuration unit.

[0032] Upon receiving a channel switching command, the first action of the channel dynamic configuration unit is not to immediately connect the second communication master station to the real-time channel. Instead, it interrupts the connection between the first communication master station and the real-time channel at the physical layer, forcibly releasing the physical signal occupancy of the real-time channel. Here, the physical layer refers to the lowest physical medium layer in the OSI seven-layer network model, i.e., the actual electrical or optical signal transmission layer. This hard disconnection at the physical layer avoids residual signal interference or level conflicts that may occur during "soft switching." Even if the first communication master station has logically failed, its hardware circuitry may still output uncertain noise levels or residual signals to the bus. If not completely disconnected at the physical layer, these chaotic signals may compete with the normal command signals of the second communication master station on the bus, potentially leading to communication errors or even physical damage to the driver chip. After the physical layer interrupt is completed, the channel dynamic configuration unit can wait for a silent interval associated with the first preset period of the heartbeat signal, such as a full heartbeat cycle, to ensure that all residual physical signals on the bus have completely dissipated and attenuated, and that the communication medium is in an absolutely idle and clean state. Then, it establishes a connection between the second communication master station and the real-time channel, and restores the heartbeat signal to the first preset period after a successful connection. This fundamentally eliminates the possibility of signal collisions between the two masters at the bus level.

[0033] During the aforementioned silent interval, the channel dynamic configuration unit can also perform offline testing on the first communication master station via a dedicated diagnostic link independent of the real-time channel. This dedicated diagnostic link is physically completely separated from the real-time channel undergoing the handover, so its testing process will not be affected by any bus state switching, nor will it be unable to proceed due to the communication medium being silent. The offline testing may involve attempting to send simple register read commands or status query instructions to the first communication master station via this dedicated link to determine whether the master station has truly failed completely, or whether only its interface circuit with the real-time channel has malfunctioned while the core functions of the master station remain intact. If the offline testing determines that the first communication master station is actually in a normal state, it indicates that the previous heartbeat packet loss was likely due to a fault in the master station's real-time channel interface module or an abnormality in the related drive circuit, rather than a complete master station crash. In this case, the current handover process can be terminated directly, and the first communication master station's control over the real-time channel can be maintained.

[0034] This application's embodiments employ a two-level monitoring strategy combining normal heartbeat signal detection and encrypted confirmation, a physical layer-based hard handover timing with a disconnect-then-reconnect mechanism, and an offline self-test and handover termination mechanism for independent link diagnosis during silent intervals. This approach ensures that the handover can be completed at a speed guaranteed by the physical layer when the main station truly fails. Furthermore, the encrypted confirmation and offline self-test significantly reduce the probability of erroneous handovers triggered by momentary interference or local interface failures. This gives the entire system intelligent discrimination and fault-tolerant recovery capabilities, providing humanoid robots with efficient and robust communication redundancy in complex electromagnetic environments and uncertain working conditions.

[0035] Optionally, in this embodiment of the application, the redundant communication master station unit further includes a shared memory region; the shared memory region is located between the first communication master station and the second communication master station, and is used to store the respective operating status data synchronously written by the first communication master station and the second communication master station. The out-of-band management controller is physically connected to the shared memory region via a dedicated management bus. It is also used to read the running status data of the first communication master station and the second communication master station stored in the shared memory region at a second preset period, and to cross-verify the read running status data with the master station validity status obtained by the master station status monitoring module through the heartbeat signal. The out-of-band management controller is also used to, when the cross-validation results indicate that the judgment results are inconsistent, prioritize the running status data stored in the shared memory area as the judgment basis, and determine whether to output the channel switching instruction to the channel dynamic configuration unit or maintain the current master station control authority unchanged.

[0036] In this embodiment, a shared memory region is further introduced. Physically located between the first and second communication master stations, this shared memory region is a physical storage space accessible to both master stations. Read and write operations on the shared memory do not require encapsulation and decapsulation by the network protocol stack, thus exhibiting extremely low access latency and extremely high data consistency. The two master stations can continuously write their operational status data, such as current control mode, EtherCAT bus synchronization status, joint command sequence number, and internal self-test results, synchronously into this shared memory region. Each master station can also attach a timestamp when writing, allowing for timeliness verification during subsequent reads. This bidirectional synchronous write design ensures that regardless of which master station is active, the shared memory always stores the latest operational snapshot of each master station, providing the out-of-band management controller with an independent data source that does not rely on heartbeat signals or network transmission.

[0037] The out-of-band management controller is physically connected to the shared memory region via a dedicated management bus. Here, the dedicated management bus and the bus connecting the main arithmetic control unit, memory unit, and RAS bus unit can be the same physical channel; that is, the out-of-band management controller has an independent communication link for out-of-band management. It is completely isolated from the real-time channel carrying joint control commands at the physical layer. Therefore, the out-of-band management controller's read operations on the shared memory are not affected by any communication activity on the real-time channel. The out-of-band management controller periodically reads the dual-master station operating status data stored in the shared memory at a second preset period. Here, the second preset period can be the same as or different from the first preset period of the heartbeat signal. After reading the shared memory data, the out-of-band management controller can cross-verify the dual-master station status information recorded therein with the master station validity status obtained by the master station status monitoring module through the heartbeat signal. Cross-validation refers to comparing two sets of status information from different sources and with different mechanisms. If the two sets of information lead to the same conclusion, for example, if the heartbeat indicates that the first communication master station is effective and the running status data of the first communication master station in the shared memory is also normal, then they corroborate each other and the conclusion is credible. If the two sets of information are inconsistent, for example, if the heartbeat indicates that the first communication master station has been unresponsive for a continuous period of time, but the running status data of the first communication master station in the shared memory still shows that it is running normally, then it indicates that at least one source of information has a problem or a delay.

[0038] When cross-validation results indicate a discrepancy between the two determinations, the out-of-band management controller can prioritize the runtime status data stored in the shared memory area as the final determination basis, and accordingly output a channel switching command to the channel dynamic configuration unit or maintain the current master station control authority. This is because the heartbeat signal is essentially a "request-response" active probing mechanism. Its success depends not only on the health of the master station itself, but also on the integrity of the communication link between the master station and the out-of-band management controller. If only the master station's response channel or related interface circuit fails, while the master station's core processing functions remain intact, the heartbeat signal may incorrectly report that the master station has failed. In contrast, the runtime status data in the shared memory is actively written by both masters, driven by the master station's internal core logic rather than triggered by external probes. As long as the master station's core processing functions are still running, the runtime status data in the shared memory can be continuously updated. Even if the master station's response channel is damaged, the runtime status data in the shared memory can still accurately reflect the health status of its core functions. Therefore, when the two conclusions conflict, the runtime status data in the shared memory is given higher reliability.

[0039] This application's embodiments introduce a shared memory region as a source of state information independent of the heartbeat signal and explicitly establish an arbitration priority rule that "shared memory takes precedence over heartbeat signals." This eliminates the reliance on a single heartbeat detection mechanism for determining the validity of the master station. Instead, it achieves an intelligent arbitration logic through cross-validation, where "two sources mutually verify each other, and in case of conflict, the system selects the one with the highest credibility." This not only effectively overcomes the problem of erroneous switching caused by momentary link failures or local interface anomalies in traditional solutions, but also ensures that the out-of-band management controller will not erroneously deprive the master station of its control authority when the master station's actual core functions are still operating normally. This significantly improves the fault tolerance and reliability of the entire system under complex electromagnetic environments and engineering uncertainties.

[0040] Optionally, in this embodiment, the out-of-band management controller integrates a safety margin control strategy execution module. This module is configured to: perform timestamp alignment and covariance-weighted fusion on first data collected by absolute encoders at each execution joint and second data collected by a six-axis IMU sensor on the robot body using an extended Kalman filter, outputting an estimated current robot posture; calculate the robot's current center of mass position based on the estimated posture; calculate the stability margin based on the minimum distance from the current center of mass position to the robot's support domain boundary; compare the stability margin with a preset posture stability margin threshold to generate a posture stability determination result; and determine if the posture stability determination result is unsatisfactory. At that time, a safety control command for adjusting the angle of each execution joint is generated according to a preset joint priority order. The safety control command is output to the second communication master station at a control cycle of not less than a preset frequency, and the attitude stability judgment result is generated again after adjustment. If the regenerated attitude stability judgment result is unsatisfactory, a center of mass offset is generated based on the deviation between the current center of mass position and the preset expected center of mass position. If the center of mass offset reaches a preset limit threshold, the system switches to emergency braking mode and outputs a safety control command containing a locking command sequence with increasing damping coefficient to each execution joint. If the center of mass offset does not reach the preset limit threshold, the system returns to continue executing the steps of generating and outputting the safety control command for adjusting the angle.

[0041] In this embodiment, the out-of-band management controller can also integrate a safety control strategy execution module. This module can fuse two types of heterogeneous sensor data using an extended Kalman filter. Specifically, one type is the first data collected by absolute encoders installed at each joint, and the other is the second data collected by a six-axis IMU sensor installed on the robot body. Here, the absolute encoder is an angle position sensor installed inside each joint, capable of directly reading the absolute angle value of the joint's current rotation, and does not require recalibration even after a power outage and restart. The six-axis IMU sensor is an inertial measurement unit installed on the robot's torso or base, capable of simultaneously measuring the robot's acceleration and angular velocity in three-dimensional space. Combining these two data allows for the calculation of the robot's overall tilt direction and degree. The extended Kalman filter can combine noisy multi-source sensor data through timestamp alignment and covariance-weighted fusion (assigning different fusion weights based on the confidence level of each sensor data) according to the system state equation and observation equation, and output the optimal estimate of the robot's current posture. This fusion process is significantly better than single sensor data because although the absolute encoder is accurate, it can only reflect a single joint angle and cannot perceive the overall posture, while the IMU can perceive the overall posture but has integral drift error. After the two are fused, they correct each other and can obtain an accurate and stable posture estimation result.

[0042] After obtaining the current posture estimate, the safety control strategy execution module can calculate the robot's current center of mass position. The center of mass refers to the equivalent concentrated point of action of the robot's overall mass. For a humanoid robot, its position is determined by the angles of each joint and the length and mass distribution of each limb segment. The posture estimate contains the current angle information of all joints, so the coordinates of the center of mass in three-dimensional space can be calculated forward based on the robot's preset dynamic model. Subsequently, the stability margin is calculated based on the minimum distance from the current center of mass position to the boundary of the robot's support domain. The support domain refers to the polygonal area enclosed by the robot's feet in contact with the ground; for example, when standing on two feet, it is the convex polygon of the bottom of both feet, and when standing on one foot, it is the shape of the foot itself. As long as the projection of the center of mass onto the horizontal plane falls within this polygon, the robot is in a statically stable state. Each boundary of the support domain polygon has a corresponding vertical distance from the center of mass. The smallest distance is the stability margin, which directly reflects how much safety margin there is before the center of mass is about to fall off the support domain boundary. The larger the stability margin, the more stable the robot; the smaller the stability margin, the closer it is to the edge of imbalance. The calculated stability margin is compared with a preset standing posture stability margin threshold (e.g., 5cm). If the actual stability margin is greater than or equal to the threshold, the posture stability is considered to be up to standard; otherwise, it is considered to be down to standard.

[0043] When the posture stability assessment result is unsatisfactory, the minimum control strategy execution module can prioritize attempting to restore posture stability by actively adjusting joint angles, following a preset joint priority order. For humanoid robots, the hip joint, due to its proximity to the center of mass and strong torque output capability, has the highest leverage efficiency in posture adjustment and is therefore given the highest adjustment priority. The ankle joint is next, as it directly connects the foot to the ground, and adjusting the ankle joint angle can change the shape and position of the support domain, but its response speed to dynamic balance is slightly slower than that of the hip joint. Other joints, such as the knee and lumbar joints, are assigned lower adjustment priorities or used as auxiliary adjustment nodes depending on the specific robot configuration. Next, minimum control commands for each executed joint are generated according to this priority order, and these commands are continuously output to the second communication master station at a control cycle of no less than a preset frequency (e.g., 100Hz). Here, the high-frequency control cycle ensures the smoothness and continuity of joint adjustment actions, avoiding step-like jitter in the robot due to excessively long command intervals. After completing one round of angle adjustment, the preceding steps of calculating the centroid position and determining the stability margin can be executed again to re-evaluate the effectiveness of the adjustment. This closed-loop iterative mechanism of "adjustment-evaluation-re-adjustment" ensures that the adjustment actions are always guided by the actual improvement effect, rather than blindly executing preset actions.

[0044] If the regenerated attitude stability judgment result is still unsatisfactory, a centroid offset can be generated based on the deviation between the current centroid position and the preset expected centroid position. The preset expected centroid position refers to the target position where the robot's centroid should be in the ideal standing posture. Based on this, it is further determined whether the centroid offset has reached a preset limit threshold (e.g., 10cm): If it has not yet reached the preset limit threshold, it means that although the stability margin is insufficient, the degree of centroid deviation is still within a controllable range. At this time, the process of generating and outputting the minimum control command for angle adjustment is resumed. Through continuous iterative adjustment, the centroid is gradually pulled back to the stable region. However, if the centroid offset has reached the preset limit threshold, it means that the centroid has seriously deviated from the ideal position. Simply continuing to adjust the joint angle is not only difficult to recover, but may also cause the joint drive motor to oscillate repeatedly at the limit position or even overheat and be damaged due to the continuous sending of these commands. At this time, the emergency braking mode is switched decisively, and a sequence of locking commands with increasing damping coefficients is output to each joint. The damping coefficient refers to the magnitude of the internal resistance during joint movement. An increasing damping coefficient indicates that the joint locking process is a gradual application of force and slow tightening, rather than an instantaneous lock-up. This gradual braking method can effectively absorb the robot's residual kinetic energy and avoid rigid impacts caused by sudden braking. At the same time, the force sensors built into each joint monitor the reverse drive torque in real time to ensure that it does not exceed the preset human safety contact force threshold. Ultimately, the robot can fall smoothly or maintain a low-position safe posture under controlled conditions, minimizing the risk of equipment damage and personnel injury.

[0045] The guaranteed control strategy execution module of this application embodiment achieves accurate attitude estimation by fusing multi-source sensor data through extended Kalman filtering. It uses stability margin as the core judgment index and performs active attitude correction in conjunction with hierarchical joint priority adjustment logic. Only when the adjustment fails and the centroid offset reaches the preset limit threshold is a progressive emergency braking with increasing damping triggered. Even after the main system is completely paralyzed, the robot can still independently maintain attitude stability and controlled response by relying on the lightweight algorithm embedded in the out-of-band management controller. Through progressive braking, the inevitable fall process is controlled within the range of human safety impact force, fundamentally ensuring the safety of the humanoid robot in extreme failure scenarios.

[0046] Furthermore, as Figure 1 In terms of specific implementation of the device, this application provides a fault protection method for a robot control system based on an out-of-band management controller, such as... Figure 2 As shown, the method includes: Step 101: The out-of-band management controller collects the operating status parameters of each unit and performs fault classification judgment based on the operating status parameters. Each unit includes a main computing control unit, a memory unit, and a bus RAS unit. Step 102: When the out-of-band management controller determines that a fatal fault has occurred, it sends a channel switching command to the channel dynamic configuration unit and simultaneously generates a backup control command according to the internally preset backup control strategy. Step 103: In response to the channel switching command of the out-of-band management controller, the channel dynamic configuration unit transfers the control authority of the real-time channel from the first communication master station to the second communication master station, and only a single master station is allowed to occupy the real-time channel at the same time. Step 104: After obtaining the control authority, the second communication master station receives the backup control command sent by the out-of-band management controller and forwards the backup control command to each execution joint of the robot through the real-time channel; Step 105: When the out-of-band management controller determines that the fault has been eliminated, it sends a switchback command to the channel dynamic configuration unit. Step 106: In response to the switchback command, the channel dynamic configuration unit returns control of the real-time channel from the second communication master station to the first communication master station.

[0047] Optionally, the step of "collecting the operating status parameters of each unit and determining the fault classification based on the operating status parameters" includes: If the operating status parameters exceed a preset fatal fault threshold, a fatal fault determination result will be output. If the operating status parameter does not exceed the preset fatal fault threshold, but the rate of change of the operating status parameter within the preset time window exceeds the preset rate of change threshold, output the potential fault determination result; Accordingly, the method further includes: When outputting the potential fault determination result, a warning signal is sent to the target receiving terminal through a non-real-time channel, and the second communication master station is simultaneously woken up to enter the state synchronization preparation mode; the state synchronization preparation mode is a mode in which the current system state data is synchronized with the first communication master station in advance before the second communication master station obtains the real-time channel control authority; and, When outputting the fatal fault determination result, the channel switching command is output to the channel dynamic configuration unit.

[0048] Optionally, the out-of-band management controller integrates a master station status monitoring module; the method further includes: The master station status monitoring module broadcasts heartbeat signals to the first communication master station and the second communication master station at a first preset period, and updates the validity status of the master station in real time according to the survival confirmation frames returned by each master station. When the number of times the master station status monitoring module fails to receive a liveness confirmation frame from any master station reaches a preset threshold, it shortens the broadcast period of the heartbeat signal to a preset encryption period to accelerate the confirmation of the validity status of any master station. If the number of times the liveness confirmation frame fails to be received within the preset encryption period reaches a preset fault confirmation threshold, the master station is determined to be faulty, and the channel switching command is output to the channel dynamic configuration unit. In response to the channel switching command, the channel dynamic configuration unit interrupts the connection between the first communication master station and the real-time channel at the physical layer, forcibly releasing the physical signal occupation of the real-time channel; after a silence interval associated with the first preset period of the heartbeat signal, it establishes the connection between the second communication master station and the real-time channel, and restores the heartbeat signal to the first preset period; During the silent interval, the channel dynamic configuration unit performs offline detection on the first communication master station through a dedicated diagnostic link independent of the real-time channel. If the validity status of the first communication master station is determined to be normal, the current switching process is terminated and the control authority of the first communication master station over the real-time channel is maintained.

[0049] Optionally, the redundant communication master station unit further includes a shared memory region; the shared memory region is located between the first communication master station and the second communication master station, and is used to store the respective operating status data synchronously written by the first communication master station and the second communication master station; the method further includes: The out-of-band management controller reads the operating status data of the first communication master station and the second communication master station stored in the shared memory area at a second preset period, and cross-verifies the read operating status data with the master station validity status obtained by the master station status monitoring module through the heartbeat signal; When the cross-validation results indicate that the judgment results are inconsistent, the out-of-band management controller shall give priority to the running status data stored in the shared memory area as the judgment basis and determine whether to output the channel switching instruction to the channel dynamic configuration unit or maintain the current master station control authority unchanged.

[0050] Optionally, the out-of-band management controller integrates a safety net control strategy execution module; the "generating safety net control instructions according to the internally preset safety net control strategy" includes: The guaranteed control strategy execution module uses an extended Kalman filter to perform timestamp alignment and covariance weighted fusion on the first data collected by the absolute encoders set at each execution joint and the second data collected by the six-axis IMU sensor set on the robot body, and outputs the robot's current posture estimate. The robot's current center of mass position is calculated based on the current posture estimate; the stability margin is calculated based on the minimum distance from the current center of mass position to the robot's support domain boundary; the stability margin is compared with a preset posture stability margin threshold to generate a posture stability determination result. When the attitude stability determination result is unsatisfactory, a backup control command for adjusting the angle of each joint is generated according to the preset joint priority order. The backup control command is output to the second communication master station at a control cycle of not less than the preset frequency, and the attitude stability determination result is generated again after adjustment. If the regenerated attitude stability determination result is unsatisfactory, a centroid offset is generated based on the deviation between the current centroid position and the preset desired centroid position. If the centroid offset reaches a preset limit threshold, the system switches to emergency braking mode and outputs a safety control command containing a locking command sequence with increasing damping coefficient to each execution joint. If the centroid offset does not reach the preset limit threshold, the system returns to continue executing the steps of generating and outputting the safety control command for angle adjustment.

[0051] Furthermore, as a refinement and extension of the specific implementation methods of the above embodiments, and to fully illustrate the specific implementation process of this embodiment, another fault protection method for a robot control system based on an out-of-band management controller is provided, such as... Figure 3 As shown, the method includes: First, the out-of-band management controller (BMC) continuously collects operational status parameters from the robot's main computing control unit, memory unit, and bus RAS unit. The BMC is a dedicated management chip independent of the main CPU and with its own power supply. Even if the main system completely loses power or crashes, it can continue to operate using its own power supply. The bus RAS unit is specifically responsible for detecting error frames and communication delays during data transmission, providing real-time feedback on the communication link quality to the BMC. The BMC simultaneously sends the collected operational status parameters to two parallel decision paths: threshold verification and trend analysis. Threshold verification uses absolute value comparison; for example, when hard indicators such as CPU or NPU temperature reaching 85°C or above, or memory ECC error count reaching 100 times per second or above, are exceeded, a fatal fault is directly determined. Trend analysis, however, does not focus on whether the current value has exceeded the limit, but rather monitors the rate of change of parameters within a preset time window. For example, if the CPU temperature rises by more than 10°C within 10 seconds, even if the current temperature is only 70°C, the system will identify this abnormal trend and issue a potential fault warning.

[0052] When trend analysis identifies a potential fault, the BMC sends an early warning signal through a non-real-time channel, notifying the remote maintenance platform or on-site operators to pay attention to the system status in advance. Simultaneously, it wakes up the second communication master station in hot standby mode, allowing it to synchronize system status data with the currently active first communication master station in advance. This includes key context information such as the latest joint position commands, robot posture estimates, and EtherCAT bus configuration parameters, thus completing the data preparation process required for switching before the fault actually worsens. When the threshold check determines a fatal fault, the BMC immediately activates the internally preset simplified balance control algorithm and sends a master station switching command (a type of channel switching command) to the channel dynamic configuration unit. The channel dynamic configuration unit corresponds to the SDN controller, which is responsible for managing the access rights of the real-time communication channel. Its core responsibility is to ensure that only one master station can occupy the channel to issue control commands at any given time.

[0053] After responding to the master station switching command, the channel dynamic configuration unit interrupts the connection between the first communication master station and the real-time channel at the physical layer, forcibly releasing the physical signal occupation on the bus. After a silent interval associated with the heartbeat cycle, the connection between the second communication master station and the real-time channel is established, allowing the backup master station to officially take over the authority to issue joint control commands. The entire switching process is strictly controlled to be completed within 30 milliseconds. Subsequently, the BMC transmits the joint angle adjustment commands generated by the balance algorithm to the second communication master station, which forwards these commands to each execution joint through the real-time channel. The control commands executed by the BMC adopt a hierarchical priority order. The hip joint is given the highest adjustment priority because it is close to the robot's center of mass and has the strongest torque output capability. The ankle joint is next, and other joints are used as auxiliary adjustment nodes. The adjustment frequency is not less than 100Hz to ensure smooth and continuous movement. After each adjustment, the BMC recalculates the robot's center of mass position and calculates the stability margin by the minimum distance from the center of mass to the foot support domain boundary. This margin is compared with the preset standing posture stability margin threshold of 5cm to evaluate the adjustment effect.

[0054] During the balance adjustment process, the BMC simultaneously monitors the center of gravity offset. If the offset has not yet reached the preset limit threshold of 10cm, it means that the robot's center of gravity is still within the range that can be corrected by joint adjustment, and the BMC continues to execute normal balance adjustment commands to maintain the robot's posture stability. However, if the offset reaches or exceeds 10cm, it means that simply adjusting the joint angles is no longer sufficient to pull the center of gravity back to the stability margin range. At this time, the BMC immediately interrupts the normal balance adjustment process, switches to emergency braking mode, and outputs a sequence of locking commands with increasing damping coefficients to each joint. Within 500 milliseconds, the joints are gradually and slowly locked, and the impact force generated during the braking process is controlled to within 20N to ensure that even if the robot inevitably squats or falls, it will not suffer hardware damage or personal injury due to rigid impact. Once the BMC continuously monitors and finds that the operating status parameters of the main computing control unit have returned to the normal range and have been running stably for a preset period of time, it determines that the fault has been eliminated. At this time, the BMC sends a switchback command to the channel dynamic configuration unit, returning the control authority of the real-time channel from the second communication master station to the first communication master station. At the same time, it stops the execution of the backup control strategy, so that the entire system returns to the normal initial operating mode and completes the automated closed loop of the entire fault protection process.

[0055] It should be noted that other corresponding descriptions of the functional units involved in the fault protection method for a robot control system based on an out-of-band management controller provided in this application embodiment can be found in the following references. Figure 1 The corresponding description of the device will not be repeated here.

[0056] This application also provides a computer device, which may specifically be a personal computer, a server, a network device, etc. Figure 4 As shown, the computer device includes a bus, a processor, memory, and a communication interface, and may also include an input / output interface and a display device. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores location information. The network interface allows communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0057] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0058] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0059] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0060] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0061] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0062] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0063] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A fault protection device for a robot control system based on an out-of-band management controller, characterized in that, include: The redundant communication master station unit includes a first communication master station associated with the robot's main computing control unit, and a second communication master station serving as a hot standby redundant master station; An external management controller, set independently of the main computing control unit, is physically connected to the main computing control unit, memory unit, and bus RAS unit via a dedicated management bus. It is used to collect the operating status parameters of each unit and to perform fault classification judgment based on the operating status parameters. In addition, when a fatal fault is determined, it sends a channel switching command to the channel dynamic configuration unit and simultaneously generates a backup control command based on the internally preset backup control strategy. The channel dynamic configuration unit is connected to the out-of-band management controller, the first communication master station, and the second communication master station respectively. It is used to transfer the control authority of the real-time channel from the first communication master station to the second communication master station in response to the channel switching command of the out-of-band management controller, and only a single master station is allowed to occupy the real-time channel at the same time. The second communication master station is used to receive the backup control command sent by the out-of-band management controller after obtaining the control authority, and to forward the backup control command to each execution joint of the robot through the real-time channel; The out-of-band management controller is also used to send a switchback command to the channel dynamic configuration unit when it is determined that the fault has been eliminated. The channel dynamic configuration unit is also used to, in response to the switchback command, return the control authority of the real-time channel from the second communication master station to the first communication master station.

2. The apparatus according to claim 1, characterized in that, The out-of-band management controller integrates a fault classification and determination module; the fault classification and determination module is used for: If the operating status parameters exceed a preset fatal fault threshold, a fatal fault determination result will be output. If the operating status parameter does not exceed the preset fatal fault threshold, but the rate of change of the operating status parameter within the preset time window exceeds the preset rate of change threshold, output the potential fault determination result; The fault classification and determination module is also used for: When outputting the potential fault determination result, a warning signal is sent to the target receiving terminal through a non-real-time channel, and the second communication master station is simultaneously woken up to enter the state synchronization preparation mode. The state synchronization preparation mode is a mode in which the current system state data is synchronized with the first communication master station in advance before the second communication master station obtains the real-time channel control authority; and... When outputting the fatal fault determination result, the channel switching command is output to the channel dynamic configuration unit.

3. The apparatus according to claim 1, characterized in that, The out-of-band management controller integrates a master station status monitoring module. The master station status monitoring module is used to broadcast heartbeat signals to the first communication master station and the second communication master station at a first preset period, and update the validity status of the master station in real time according to the survival confirmation frames returned by each master station. The master station status monitoring module is also used to shorten the broadcast period of the heartbeat signal to a preset encryption period when the number of times the liveness confirmation frame of any master station is not received reaches a preset threshold, so as to accelerate the confirmation of the validity status of any master station. If the number of times a liveness confirmation frame is not received within the preset encryption period reaches the preset fault confirmation threshold, then any master station is determined to be faulty, and the channel switching instruction is output to the channel dynamic configuration unit. The channel dynamic configuration unit is also used to respond to the channel switching command by interrupting the connection between the first communication master station and the real-time channel at the physical layer, forcibly releasing the physical signal occupation of the real-time channel; after a silence interval associated with the first preset period of the heartbeat signal, establishing the connection between the second communication master station and the real-time channel, and restoring the heartbeat signal to the first preset period; The channel dynamic configuration unit is also used to perform offline detection on the first communication master station through a dedicated diagnostic link independent of the real-time channel during the silent interval. If the validity status of the first communication master station is determined to be normal, the current switching process is terminated and the control authority of the first communication master station over the real-time channel is maintained.

4. The apparatus according to claim 3, characterized in that, The redundant communication master station unit also includes a shared memory area; The shared memory area is located between the first communication master station and the second communication master station, and is used to store the respective running status data synchronously written by the first communication master station and the second communication master station. The out-of-band management controller is physically connected to the shared memory region via a dedicated management bus. It is also used to read the running status data of the first communication master station and the second communication master station stored in the shared memory region at a second preset period, and to cross-verify the read running status data with the master station validity status obtained by the master station status monitoring module through the heartbeat signal. The out-of-band management controller is also used to, when the cross-validation results indicate that the judgment results are inconsistent, prioritize the running status data stored in the shared memory area as the judgment basis, and determine whether to output the channel switching instruction to the channel dynamic configuration unit or maintain the current master station control authority unchanged.

5. The apparatus according to claim 1, characterized in that, The out-of-band management controller integrates a safety net control strategy execution module; the safety net control strategy execution module is used for: By using an extended Kalman filter, the first data collected by the absolute encoders set at each execution joint and the second data collected by the six-axis IMU sensor set on the robot body are time-stamp aligned and covariance-weighted fused to output the robot's current posture estimate. The robot's current center of mass position is calculated based on the current posture estimate; the stability margin is calculated based on the minimum distance from the current center of mass position to the robot's support domain boundary; the stability margin is compared with a preset posture stability margin threshold to generate a posture stability determination result. When the attitude stability determination result is unsatisfactory, a backup control command for adjusting the angle of each joint is generated according to the preset joint priority order. The backup control command is output to the second communication master station at a control cycle of not less than the preset frequency, and the attitude stability determination result is generated again after adjustment. If the regenerated attitude stability determination result is unsatisfactory, a center of mass offset is generated based on the deviation between the current center of mass position and the preset desired center of mass position. If the center of mass offset reaches a preset limit threshold, the system switches to emergency braking mode and outputs a safety control command containing a locking command sequence with increasing damping coefficient to each execution joint. If the center of mass offset does not reach the preset limit threshold, the system returns to continue executing the steps of generating and outputting the safety control command for angle adjustment.

6. A fault protection method for a robot control system based on an out-of-band management controller, characterized in that, include: The out-of-band management controller collects the operating status parameters of each unit and performs fault classification judgment based on the operating status parameters. Each unit includes a main computing control unit, a memory unit, and a bus RAS unit. When the out-of-band management controller determines that a fatal fault has occurred, it sends a channel switching command to the channel dynamic configuration unit and simultaneously generates a backup control command based on the internally preset backup control strategy. The channel dynamic configuration unit responds to the channel switching command of the out-of-band management controller by transferring the control authority of the real-time channel from the first communication master station to the second communication master station, and only a single master station is allowed to occupy the real-time channel at any given time. After obtaining the control authority, the second communication master station receives the backup control command sent by the out-of-band management controller and forwards the backup control command to each execution joint of the robot through the real-time channel; When the out-of-band management controller determines that the fault has been eliminated, it sends a switchback command to the channel dynamic configuration unit. In response to the switchback command, the channel dynamic configuration unit returns control of the real-time channel from the second communication master station to the first communication master station.

7. The method according to claim 6, characterized in that, The process of collecting the operating status parameters of each unit and determining the fault classification based on these parameters includes: If the operating status parameters exceed a preset fatal fault threshold, a fatal fault determination result will be output. If the operating status parameter does not exceed the preset fatal fault threshold, but the rate of change of the operating status parameter within the preset time window exceeds the preset rate of change threshold, output the potential fault determination result; Accordingly, the method further includes: When outputting the potential fault determination result, a warning signal is sent to the target receiving terminal through a non-real-time channel, and the second communication master station is simultaneously woken up to enter the state synchronization preparation mode; the state synchronization preparation mode is a mode in which the current system state data is synchronized with the first communication master station in advance before the second communication master station obtains the real-time channel control authority; and, When outputting the fatal fault determination result, the channel switching command is output to the channel dynamic configuration unit.

8. The method according to claim 6, characterized in that, The out-of-band management controller integrates a master station status monitoring module; the method further includes: The master station status monitoring module broadcasts heartbeat signals to the first communication master station and the second communication master station at a first preset period, and updates the validity status of the master station in real time according to the survival confirmation frames returned by each master station. When the number of times the master station status monitoring module fails to receive a liveness confirmation frame from any master station reaches a preset threshold, it shortens the broadcast period of the heartbeat signal to a preset encryption period to accelerate the confirmation of the validity status of any master station. If the number of times the liveness confirmation frame fails to be received within the preset encryption period reaches a preset fault confirmation threshold, the master station is determined to be faulty, and the channel switching command is output to the channel dynamic configuration unit. In response to the channel switching command, the channel dynamic configuration unit interrupts the connection between the first communication master station and the real-time channel at the physical layer, forcibly releasing the physical signal occupation of the real-time channel; after a silence interval associated with the first preset period of the heartbeat signal, it establishes the connection between the second communication master station and the real-time channel, and restores the heartbeat signal to the first preset period; During the silent interval, the channel dynamic configuration unit performs offline detection on the first communication master station through a dedicated diagnostic link independent of the real-time channel. If the validity status of the first communication master station is determined to be normal, the current switching process is terminated and the control authority of the first communication master station over the real-time channel is maintained.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 6 to 8.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 6 to 8.

Images