The utility model content
The purpose of this utility model is the defective at above-mentioned prior art, and a kind of 2 * 2 redundancy control systems of getting 2 redundancy structures are provided.
The redundancy control system that the utility model provides comprises the first system, computer system, the second system, computer system and is an arbitration modules, is that an arbitration modules is connected with the first system, computer system and the second system, computer system respectively; Every system, computer system comprises the first cover computer subsystem, the second cover computer subsystem and is interior arbitration modules, be in arbitration modules be connected with the first cover computer subsystem and the second cover computer subsystem respectively; Wherein, described redundancy control system also comprises synchronous device, and synchronous device comprises four sync cards, the corresponding cover computer subsystem that connects of each sync card, and four sync cards are interconnected successively.
Four sync cards adopt differential signal to connect successively.
Sync card comprises the Synchronization timeout interrupt module, be used for according to the Synchronization timeout time that is preset in computer subsystem, judging needs synchronous computer subsystem whether to have Synchronization timeout, if there is Synchronization timeout, sends Synchronization timeout to the synchronous computer subsystem of these needs and interrupts.
Sync card comprises synchronous enabled module, when being used for the computer subsystem that is connected with this sync card and arriving the synchronous synchronous points of needs, and startup sync card synchronous enabled.
Described sync card comprises finishes interrupt module synchronously, is used to judge whether the synchronous computer subsystem of needs is finished synchronously, if finish synchronously, sends to the synchronous computer subsystem of these needs and to finish interruption synchronously.
Four preferential assurances of sync card respectively be in two covers between the computer subsystems synchronously.
Every cover computer subsystem comprises CPU control module, digital quantity I/O module, serial communication module, synchronization module.
Arbitration modules also comprises from calculation amount output voting module in the system, be used for judging the whether consistent of these two cover computer subsystem digital quantity I/O modules in being from calculation amount output result, if consistent, select then that this is from calculation amount output exporting as system from the calculation amount; If inconsistent, then to being arbitration modules report fault, be that an arbitration modules will be outputted to another from the calculation amount and be, select that another is from calculation amount output exporting as system from the calculation amount.
Arbitration modules also comprises serial communication voting module in the system, is used for judging whether the Frame that these two cover computer subsystem serial communication modules in being send is consistent, if consistent, then selects the serial communication output of this serial communication that is output as system; If inconsistent, then to being arbitration modules report fault, would be that serial communication is outputted to another is to select the serial communication output of another serial communication that is output as system to an arbitration modules.
Arbitration modules also comprises the serial ports monitoring modular between system, is that arbitration modules needs serial communication is outputted to another when being, when the serial ports monitoring module monitors to the normal serial ports that is sending is arranged, switch again after then needing by the time whole frame data transmission to finish.
The redundancy control system that the utility model provides, the method of synchronization is by an independently sync card is set for every suit computer subsystem, four sync cards are interconnected successively, guaranteed between the two system, computer systems be synchronously and respectively in two covers between the computer subsystems synchronously; Because this method of synchronization has adopted hardware synchronization, does not need the too many interference of software, has reduced taking of system resource, hardware synchronization has improved the precision of system synchronization in addition, has reduced application program simultaneously to synchronous interference, has improved synchronous reliability.
Embodiment
The utility model is described in further detail below in conjunction with the drawings and specific embodiments, but not as to qualification of the present utility model.
Fig. 1 is a kind of structural representation of redundancy control system.This redundancy control system system comprises I system, computer system, II system, computer system and is an arbitration modules; Arbitration modules is connected with I system, computer system and II system, computer system respectively between system.Every system, computer system comprises the first cover computer subsystem (being the A machine among the figure), the second cover computer subsystem (being the B machine among the figure) and is interior arbitration modules; Arbitration modules is connected with first cover computer subsystem (being the A machine among the figure) and the second cover computer subsystem (being the B machine among the figure) respectively in the system.This redundancy control system also comprises synchronous device, and synchronous device comprises four sync cards in Fig. 1, the corresponding cover computer subsystem that connects of each sync card, and four sync cards are interconnected successively.
Every cover computer subsystem A machine/B machine can comprise CPU control module, digital quantity I/O module, serial communication module, synchronization module.Wherein the serial communication module can comprise high speed serial communication module, 8 serial communication modules again.
The redundancy control system that the utility model provides, the method of synchronization is by an independently sync card is set for every suit computer subsystem, four sync cards are interconnected successively, guaranteed between the two system, computer systems be synchronously and respectively in two covers between the computer subsystems synchronously, the differentiation of all synchronous needed communications and synchronous points, and the processing of midway inserting is synchronously all finished by sync card; Because this method of synchronization has adopted hardware synchronization, does not need the too many interference of software, has reduced taking of system resource; Hardware synchronization has improved the precision of system synchronization simultaneously, has reduced application program simultaneously to synchronous interference, has improved synchronous reliability; The method of synchronization does not rely on the software and hardware that respectively overlaps in the computer subsystem simultaneously in addition, as CPU processor or operating system, can support the isomery of CPU processor or operating system, and can support to reach higher security and reliability by different isomeries.
In addition, by to computer subsystem and the setting further of arbitration modules in being, fault diagnosis that can the plate level makes localization of fault in the total system to the plate level, has improved the maintenanceability of total system, has reduced and has safeguarded and time of maintenance.
To the technique effect that the utility model can reach be described by the following aspects below, and the concrete setting of each module in the corresponding technique effect system that reaches.
A) between each computer subsystem synchronously
In total system, in order to ensure the safety of system output, the output of system must be the output of A, the B machine result after through the comparison of arbitration modules in the system.Promptly the output when A, B machine is that consistent then arbitration modules will be exported the output as system, if inconsistent then could be to being that an arbitration modules is reported a fault, by being that an arbitration modules is with being outputted to of system other.But A, B machine are owing to the difference on hardware or the software, and the discrete magnitude of output and communication data have temporal difference.And if arbitration modules has received the output of A machine, in the comparison time of regulation, do not receive the output of B machine, then can be more inconsistent, will cause system unavailable.Therefore need a kind of mode and allow the computing of A, B machine and output be consistent in time, promptly synchronous.
The concrete scheme that sync card is set in this practical type redundancy control system is as follows:
1) adopt highly reliable differential signal to connect between the sync card;
2) be set by the user Synchronization timeout time of computer subsystem, sync card comprises the Synchronization timeout interrupt module, be used for according to the Synchronization timeout time that is preset in computer subsystem, judging needs synchronous computer subsystem whether to have Synchronization timeout, if there is Synchronization timeout, sends Synchronization timeout to the synchronous computer subsystem of these needs and interrupt.
3) sync card comprises and finishes interrupt module synchronously, is used to judge whether the synchronous computer subsystem of needs is finished synchronously, if finish synchronously, sends to the synchronous computer subsystem of these needs and to finish interruption synchronously.
4) sync card comprises synchronous enabled module, is used for when the computer subsystem that is connected with this sync card arrives the synchronous synchronous points of needs, can be by the invoke synchronous function or the mode by software switch start the synchronous enabled of sync card.
5) four preferential assurances of sync card respectively be in two covers between the computer subsystems synchronously.
B) An Quan discrete input and output
In the track traffic, the external control of all keys all is discrete input and output, and therefore discrete input and output are particularly important in system, are exactly so-called safe input and output in track traffic.In the utility model, adopted reliably with safety is laid equal stress on and 2 * 2 got 2 redundancy control systems, discrete magnitude has been carried out multiple isolation and strict arbitration, and in order to guarantee the reliability of system, the another one heat that switches to that can be seamless is fully.Thereby the security and the reliability of the discrete magnitude input and output of total system have been guaranteed.
The discrete magnitude input and output that realize safety in the utility model redundancy control system can be taked following scheme:
1) outside input inserts two system, computers after adopting input to isolate simultaneously, has guaranteed that two is can not interfere with each other.
2) electrical isolation is carried out in output, has guaranteed the security of output I/O.
3) effectively anti-twitter circuit has all been adopted in input and output.
4) adopt arbitration system that the discrete magnitude output of A, B machine is arbitrated, just allow the output of system as a result under the situation of unanimity, guarantee the security that total system is exported in the discrete magnitude output of A, B machine.
5) exporting when inconsistent when A, B machine discrete magnitude, is switching that an arbitration modules can be seamless, and has guaranteed the reliability of system.Can in being, the arbitration modules setting decide by vote module particularly from the output of calculation amount, be used for judging the whether consistent of these two cover computer subsystem digital quantity I/O modules in being from calculation amount output result, if consistent, select then that this is from calculation amount output exporting as system from the calculation amount; If inconsistent, then to being arbitration modules report fault, be that an arbitration modules will be outputted to another from the calculation amount and be, select that another is from calculation amount output exporting as system from the calculation amount.
C) An Quan communication arbitration interface
In a lot of each system communication interface is not arbitrated and switched, if like this get in 2 redundancy control systems 2 * 2 communication failure takes place, system can not guarantee correctness and its reliability of communication.And in the utility model, in the discrete input and output of considering safety, can also consider safe communication arbitration interface further, therefore 2 asynchronous communications are got by 2 * 2 in the system has also carried out corresponding arbitration and switching.Realization safe communication arbitration interface can be taked following scheme in the utility model redundancy control system:
1) all 2 * 2 gets 2 asynchronous communication interfaces and all carry out electrical isolation at output terminal.
2) all 2 * 2 get 22 asynchronous communication interfaces and all adopt whole frame arbitration law (be after A, B machine send frame data, arbitration sticking into relatively arbitration of row).
3) A, the bottom function of B machine adds corresponding frame head postamble to the Frame that application layer sends, and sticks into the complete Frame of row with convenient arbitration and detects.Can in being, serial communication voting module be set arbitration modules particularly, be used for judging whether the Frame that these two cover computer subsystem serial communication modules in being send is consistent, if consistent, then select the serial communication output of this serial communication that is output as system; If inconsistent, then to being arbitration modules report fault, would be that serial communication is outputted to another is to select the serial communication output of another serial communication that is output as system to an arbitration modules.
4) for the time-out time of serial ports arbitration for setting.
5) be responsible for reporting the result that serial ports is arbitrated by the serial ports moderator to system.
6) be the final output enable of interior arbitration modules may command serial ports moderator.
D) two seamless switchings between being
2 * 2 get in 2 redundancy control systems, two are equipped with relation for heat each other between being, if work at present is I is II system then be in the state of Hot Spare so, all consistent with I system with action but II is all calculating, and the output that is total system is by being that an arbitration modules has switched to I system.But the A in I system when fault has taken place any machine in B two machines, or the A in the I system, when the comparative result of B two machines output is inconsistent, is that all systems will to be outputted to heat be to be II system to an arbitration modules fully.But in this process, if two be asynchronous then can cause losing the step or repeating the process of flow process in the handoff procedure; Even and two be synchronously, but owing in a system a plurality of serial ports work are arranged, when a serial ports relatively mistake occurs, and another serial ports is sending data when switching, and then causes the disconnected frame of Frame easily.Realize in the utility model redundancy control system that two seamless switchings between being take following scheme:
1) for ensure two between being synchronously, guarantee again simultaneously in being synchronously, then carried out the synchronous processing of all intrasystem computer subsystems, promptly 4 computer subsystems are all synchronous.
2) A in respectively being, B two facility have real time monitoring function, monitor A at any time, and the state of all integrated circuit boards in B two machines is guaranteed A, the health status of B two machines, if unusual, can in time carry out two switchings that are.
3) A in respectively being, B two machines arbitration modules in being provides heartbeat message, avoids A, B two machines occur crashing and fail be in arbitration modules detect.Particularly can be at A, real-time monitoring modular is set respectively in the B machine, be used for monitoring in real time the health status of these all integrated circuit boards of cover computer subsystem, arbitration modules provides the health status of all integrated circuit boards in this cover computer subsystem in being; Arbitration modules also is used for to being the health status of respectively overlapping all integrated circuit boards in the computer subsystem that an arbitration modules provides this system, computer system in the system.
4) be in arbitration modules to being that an arbitration modules provides this A in being, B two machine health status.
5) be in arbitration modules to be an arbitration modules provide be in the health status and the heartbeat message of arbitration modules.
6) be an arbitration modules in the process of switch operating system and backup system according to two be that result that the arbitration card reports analyzes and switches,, just can switch after then needing by the time whole frame data to send to finish when finding that the normal serial ports that is sending is arranged.Ensured that like this Frame and the disconnected frame of mistake can not appear in total system.Concrete can be that the serial ports monitoring modular is set in the arbitration modules, arbitration modules needs serial communication is outputted to another when being between system, when the serial ports monitoring module monitors to the normal serial ports that is sending is arranged, switch again after then needing by the time whole frame data to send to finish.
E) plate level automatic trouble diagnosis
In order to improve the security of system, the malfunction that arbitration modules takes place in must discovery system in time.Therefore system must have stronger real time monitoring function, the fault that can real-time discovery originally is, and avoid nonserviceabling output discrete magnitude and data communication down, thus cause the dangerous of system.And the angle from safeguarding and keeping in repair needs after system breaks down localization of fault is arrived the plate level, is more conducive to the maintenance of fault and the maintenance of system.With the track traffic is example, this redundancy control system in track traffic is full-automatic control system, belong to unmanned, and carry out work, therefore when fault takes place when the another one backup system that switches to that fault can be seamless has taken place job family, if do not carry out record, easily fault is ignored,, needed a complete relatively fault logging function in order can better to safeguard and to monitor to redundancy control system, fault accurately can be navigated to the plate level, make things convenient for the maintenance of system.Following scheme is taked in the automatic trouble diagnosis of realization plate level in the utility model redundancy control system:
1) A in every system, the CPU control module separately of B machine is arbitration modules report health status in being by house dog and heartbeat message.Particularly can be at A, real-time monitoring modular is set respectively in the B machine, be used for monitoring in real time the health status of these all integrated circuit boards of cover computer subsystem, determine the health status of this cover computer subsystem, arbitration modules provides the health status of this cover computer subsystem in being.
2) A in respectively being, the sync card of B machine start real-time monitoring of software by the CPU control module, and its health status is detected.
3) the serial communication module of the A in respectively being, B machine is by monitoring in real time from closed loop.
4) the data volume I/O module of the A in respectively being, B machine is by monitoring in real time from closed loop.
5) A, B two machines carry out real time record and Realtime Alerts to malfunction separately respectively; Can carry out record too to another fault that is.
Further, the utility model also will consider some reality factors when actual design, selection aspect as device, consider the adaptability of its temperature environment, and fully in circuit design considered the remaining design, thereby total system is satisfied-40-+85 degree environmental work; The pattern of connector has adopted the CPCI connector of standard, adopts the relevant design requirement of war products in global design, has guaranteed the shock resistance of total system; The technology of integrated circuit board, all integrated circuit boards in the system all adopt three special anti-technologies to guarantee the salt fog resistance requirement in some special cities.
It should be noted that at last: above embodiment only in order to the explanation the technical solution of the utility model, is not intended to limit; Although the utility model is had been described in detail with reference to previous embodiment, those of ordinary skill in the art is to be understood that: it still can be made amendment to the technical scheme that aforementioned each embodiment put down in writing, and perhaps part technical characterictic wherein is equal to replacement; And these modifications or replacement do not make the essence of appropriate technical solution break away from the spirit and scope of each embodiment technical scheme of the utility model.