WO2020192029A1 - 一种设备主备系同步和热备方法及系统 - Google Patents

一种设备主备系同步和热备方法及系统 Download PDF

Info

Publication number
WO2020192029A1
WO2020192029A1 PCT/CN2019/105214 CN2019105214W WO2020192029A1 WO 2020192029 A1 WO2020192029 A1 WO 2020192029A1 CN 2019105214 W CN2019105214 W CN 2019105214W WO 2020192029 A1 WO2020192029 A1 WO 2020192029A1
Authority
WO
WIPO (PCT)
Prior art keywords
main
standby
synchronization
backup
main system
Prior art date
Application number
PCT/CN2019/105214
Other languages
English (en)
French (fr)
Inventor
张友兵
陈志强
王建敏
张国振
于晓娜
Original Assignee
北京全路通信信号研究设计院集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京全路通信信号研究设计院集团有限公司 filed Critical 北京全路通信信号研究设计院集团有限公司
Priority to EP19916547.3A priority Critical patent/EP3748439B1/en
Priority to EA202091840A priority patent/EA202091840A1/ru
Priority to RS20221088A priority patent/RS63768B1/sr
Priority to HRP20221374TT priority patent/HRP20221374T1/hr
Publication of WO2020192029A1 publication Critical patent/WO2020192029A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1458—Management of the backup or restore process
    • G06F11/1469—Backup restoration techniques
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L15/00—Indicators provided on the vehicle or vehicle train for signalling purposes ; On-board control or communication systems
    • B61L15/0063—Multiple on-board control systems, e.g. "2 out of 3"-systems
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B9/00—Safety arrangements
    • G05B9/02—Safety arrangements electric
    • G05B9/03—Safety arrangements electric with multiple-channel loop, i.e. redundant control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • G06F11/2023—Failover techniques
    • G06F11/2028—Failover techniques eliminating a faulty processor or activating a spare
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • G06F11/2023—Failover techniques
    • G06F11/203—Failover techniques using migration
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • G06F11/2038—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant with a single idle spare processing component
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/2097—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements maintaining the standby controller/processing unit updated
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/24—Pc safety
    • G05B2219/24186—Redundant processors are synchronised

Definitions

  • the present disclosure belongs to the field of automation technology, and particularly relates to a method and system for synchronization and hot standby of equipment main and standby systems.
  • High-speed railway on-board equipment is a key equipment to ensure train safety. It receives control information such as line conditions and operating permits from ground equipment, and generates a target distance continuous speed mode curve based on the traction and braking characteristics of the train to ensure that the train does not exceed the allowable speed curve. Try to ensure the safe operation of trains at the maximum operating speed, reduce train operating time, and avoid train delays.
  • the on-board equipment does not use hot backup technology, once the on-board equipment fails, the train will brake to a stop according to the failure-oriented safety principle. After stopping, if the on-board equipment is restarted, the fault can be recovered, and the train can continue to run under the supervision of the on-board equipment. The train was delayed due to the parking which reduced the operating efficiency. After stopping, restart the on-board equipment, the fault still cannot be recovered, it will seriously affect the operation efficiency, cause the train to be seriously delayed, and seriously affect the operation efficiency. Therefore, the on-board equipment is designed as a dual-system hot standby. One system fails, the other can continue to control the car, which improves the availability and safety of the system, maximizes the effect of the connection between the two systems, and ensures the continuity of the system’s operation. In turn, the operating efficiency of the entire system is improved.
  • the present disclosure provides a method for synchronization and hot backup of the main and backup systems of a device, which includes the following steps:
  • the hardware platform ensures the cycle synchronization of the main system and the standby system
  • the application software ensures that the working status of the main system and the standby system is synchronized with the external input;
  • the application software ensures that the main system outputs control commands, and the standby system does not output control commands
  • main system and the standby system use the same hardware platform and application software, and the hardware platform ensures that the main system and the standby system are powered on synchronously, and the cycles are synchronized.
  • the hardware platform ensures that the cycle numbers of the main system and the standby system are the same, so as to prevent the main system and the standby system from losing synchronization.
  • the application software of the main system and the backup system includes at least one high-priority fast task and one low-priority slow task.
  • the execution period of the fast task should be less than the execution period of the slow task, so as to ensure the timeliness of information transmission between the main system and the standby system of the fast task.
  • the fast task and the slow task of the main system share the working status and external input information of the main system
  • the fast task and the slow task of the standby system share the working status and external input information of the standby system
  • the fast tasks of the main system and the standby system are used to quickly transmit the working status and external input information, and determine the external input information received by both the main system and the standby system.
  • the slow task of the main system and the standby system executes application software logic, and the fast task is used every cycle to determine the external input information received by both the main system and the standby system, so as to realize the synchronization of the external input of the main system and the standby system.
  • both the fast task and the slow task include a waiting for synchronization phase and a synchronized phase.
  • the fast task of the main system sends a request frame or an idle frame to the fast task of the standby system, both of which include the working status of the main system and external input information.
  • the main system directly transmits the original data of the external input information to the standby system, and the standby system compares the original data received by the main system and the standby system; the situation where the external input information is too long Next, the main system transmits and compares the characteristic values of external input information to the standby system.
  • the slow task of the main system and the slow task of the standby system wait for the synchronization state: the application software main logic is suspended, and the fast task is waiting for the synchronization result of the main system and the standby system and the synchronized external input information;
  • the slow task of the main system and the slow task of the standby system are synchronized: the main logic of the application software is executed, and the synchronized external input information is used to ensure the synchronization of the external input of the main system and the standby system.
  • the fast task of the main system and the fast task of the standby system wait for the synchronization state: the fast task of the main system sends a request frame with status information and external input information to the fast task of the standby system, and the fast task of the standby system uses Status information, compare and feed back the synchronized external input information, the fast task of the standby system feeds back the synchronization judgment result to the fast task of the main system;
  • the fast task of the main system and the fast task of the backup system are in a synchronized state: the fast task of the main system sends idle frames with status information and external input information to the fast task of the backup system, and the fast task use status information of the backup system, And store external input information.
  • the present disclosure also provides a synchronization and hot backup system for the main and backup systems of the equipment, which includes a periodic module and a synchronization module.
  • the period module used to ensure period synchronization between the main system and the standby system;
  • the synchronization module is used to ensure that the working status of the main system and the standby system are synchronized with external input, and the main system outputs control commands, while the standby system does not output control commands.
  • the period module ensures that the main system and the backup system are powered on synchronously, and the period of the main system corresponds to the period number of the backup system period, and the synchronization module ensures the synchronous operation of the main system and the backup system.
  • the hardware platform of the present disclosure ensures that the main system and the backup system are powered on synchronously, and the software platform ensures that the working status of the main system and the backup system are synchronized with external input, and realizes the hot backup of the main system and the backup system, and the main system outputs control commands.
  • the standby system does not output control commands, so if the main system fails, the standby system can be upgraded to the main system when the main system and the standby system are synchronized, and seamless and safe switching can be realized.
  • Figure 1 shows the system diagram of the synchronous slow task of the main system and the standby system
  • Figure 2 shows the main system and standby system synchronous fast task system diagram.
  • the present disclosure provides a method for synchronization and hot backup of main and backup systems of equipment, which includes the following steps:
  • the hardware platform ensures the cycle synchronization of the main system and the standby system
  • the application software ensures that the working status of the main system and the standby system is synchronized with the external input;
  • the application software ensures that the main system outputs control commands, and the standby system does not output control commands
  • the main system and the standby system are synchronized, if the main system fails, the standby system is upgraded to the main system, and the train can realize seamless and safe switching without stopping and other special operations;
  • the main system and the backup system application software include at least fast tasks and slow tasks, among which fast tasks are of high priority and slow tasks are of low priority. Among them,
  • the fast tasks of the main system and the backup system are used to quickly transmit the working status information and external input information, and determine the external input information received by the main system and the backup system;
  • the slow task execution application software logic of the main system and the standby system uses the external input information received by the main system and the standby system judged by the fast task every cycle to realize the synchronization of the external input of the main system and the standby system;
  • the active and standby systems include the main system and the standby system.
  • the fast and slow tasks included in the application software of the main and standby systems are executed periodically, and the execution period of the fast task should be less than or equal to 1/10 of the execution period of the slow task. Ensure the quick effect of fast task execution.
  • the execution period of fast tasks should be less than or equal to 1/10 of the execution period of slow tasks. It is only used as an example for illustration, and is not limited to this proportional relationship.
  • Relatively slow tasks, fast tasks execute fast, ensure the timeliness of synchronization, and avoid fast task execution The cycle generates excess redundant time, so as to ensure the timeliness of information transmitted between the main system and the standby system of the fast task.
  • the fast and slow tasks of the main system share the working status information and external input information of the main system.
  • the fast and slow tasks of the standby system The work status information and external input information of the backup system are shared between tasks.
  • application software is used to ensure that the working status of the main system and the backup system are synchronized with external inputs, where the working status includes status information such as working level and working mode.
  • External input information includes data from external devices such as wireless data, DMI (Direct Media Interface) data, transponders, and track circuits.
  • the specific content of the working status and external input information is only used as an example to illustrate the operation status of the train, and is not limited to the expression of the train.
  • the working status and external input information can also indicate that it is the data of the circuit work, which is used in the way of line retrieval, and the main system and the backup system are synchronized to assist in confirming the working status of the line.
  • the main system sends status information to the standby system, and the standby system uses the status information of the main system.
  • the main system sends the received external input information to the standby system, and the standby system compares the received external input information with the external input information received by the main system, gives the judgment result, and determines the main system and the standby system respectively. Synchronized external input information.
  • the standby system is the hot standby of the main system. If the main system fails, the standby system is upgraded to the main system, and the standby system takes over the work of the main system. If the standby system fails, it does not affect the normal operation of the main system.
  • the slow task process the slow task of the main system and the slow task of the standby system are divided into the waiting synchronization phase and the synchronized phase:
  • Waiting for synchronization Each time the cycle of a slow task starts, the main system and the standby system enter the waiting for synchronization phase. In the waiting for synchronization phase, the main system and the standby system respectively suspend their respective application software logic, waiting for the fast task to give the synchronization result of the main system and the standby system and the synchronization result of the external input information.
  • the fast task of the main system sends a request frame to the fast task of the standby system, and the fast task of the standby system receives the request frame, uses the working status of the main system, and compares the external input information of the main system and the standby system.
  • the amount of external input information received by the main system and the standby system may be different.
  • the minimum amount between the two is used as the comparison range, and the comparison is performed from the beginning. If the comparison is successful, the standby system enters the synchronized state.
  • the fast task of the standby system replies a response frame to the fast task of the main system to inform the main system of the synchronized external input data.
  • the fast task of the main system receives the response frame of the fast task of the standby system, and the main system also enters the synchronized state.
  • Synchronized phase In the synchronized phase, the slow tasks of the main system and the standby system start to execute their respective application software logic, and only use the external input information received by both the main system and the standby system to synchronize the external input information; In the synchronization phase, the fast task of the main system still sends idle frames periodically, and the fast task of the standby system receives the idle frame, uses the working status of the main system, and stores the external input information of the main system for waiting for the slow task in the next cycle Synchronization check of external input information of synchronization status.
  • the standby system compares key information such as the cycle number between the main system and the standby system. If the main system and the standby system are inconsistent, the standby system considers the main system and the standby system to be out of sync. When the main system and the standby system are synchronized, the main system outputs control commands, so that the entire device can be executed by the control commands issued by the main system, and the standby system does not output control commands to avoid the standby system commands from affecting the main system commands in the synchronization state. Avoid equipment failure.
  • the on-board equipment is taken as an example for illustration, and it is not limited to the on-board equipment running inside the train, but can also be used for other types of synchronization effects of main and backup systems, such as subways, computer processor operation, and other aspects. It is not limited to the way the train runs.
  • main system and the backup system are synchronized, the on-board equipment runs normally, the data of the main system and the backup system are stored and interacted normally, and the train runs normally.
  • the standby system In the state of synchronization between the main system and the standby system, if the main system fails, the standby system is upgraded to the main system to control the train operation, because when the main system and the standby system are synchronized, both the main system and the standby system receive data, that is, the main system The period of the system and the standby system are synchronized, and the input is synchronized, the main system outputs control commands, and the standby system does not output control commands. If the main system fails and the main system does not output control commands, the standby system is upgraded to the main system, and the standby system outputs control commands, so that the main system and the standby system can be seamlessly switched without stopping, which improves the availability and safety.
  • the train needs to be braked and stopped. After stopping, restart the on-board equipment. If the failure of one of the main system and the backup system can be recovered, the train can be equipped with on-board equipment If the main system and the backup system fail to recover, the operation efficiency will be seriously affected.
  • the main system and the backup system are not synchronized, the main system and the backup system work normally, and the main system is used to control the train. If the main system fails, the backup system cannot be upgraded to the main system, resulting in system failure and the main system and the backup system are not synchronized , After the main system fails, the entire system is in a fault state, and the fault needs to be eliminated.
  • the fast task process the fast task of the main system and the fast task of the standby system are divided into the waiting phase and the synchronized phase:
  • the main system can send two kinds of frames to the standby system, request frames and idle frames, both of which contain the working status information of the main system and external input information; the main system sends idle frames, and the standby system uses the main
  • the standby system stores the external input information of the main system and responds with response frames; the main system sends request frames, and the standby system uses the working status of the main system.
  • the standby system compares the external input information between the main system and the standby system. Judge the external input information received by both the main system and the standby system, and reply the response frame.
  • the fast task of the main system sends a request frame to the fast task of the standby system, and the fast task of the standby system receives the request frame, uses the working status of the main system, and compares the external input information of the main system and the standby system. If the amount of external input information received by the main system and the standby system is different or the amount of external input information received by the main system and the standby system is the same, the minimum number of the main system and the standby system is used as the range of comparison, and the comparison Start to compare sequentially. If the comparison is successful, the standby system enters the synchronized state; if the comparison fails, the primary system and the standby system are out of sync.
  • the fast task of the standby system replies a response frame to the fast task of the main system to inform the main system of the synchronized external input data.
  • the fast task of the main system receives the response frame of the fast task of the standby system, and the main system also enters the synchronized state.
  • the fast task of the standby system when the fast task of the main system sends a request frame to the fast task of the standby system, the fast task of the standby system receives the request frame and uses the working status of the main system to compare and feed back the synchronized external input information. At this time, the fast task of the standby system replies the response frame to the fast task of the main system, and the synchronization judgment result is fed back. The fast task of the main system receives the response frame of the fast task of the standby system, indicating that the main system has also entered the synchronized state, and the main system The system and the standby system change from the waiting for synchronization state to the synchronized state.
  • Synchronized state In the synchronized phase, the fast task of the main system still sends idle frames periodically, and the fast task of the standby system receives the idle frame, uses the working status of the main system, and stores the external input information of the main system for download Synchronization check of external input information waiting for synchronization state of one cycle slow task.
  • the fast task of the main system continuously sends periodic idle frames to the fast task of the standby system.
  • the idle frame contains status information and external input information.
  • the fast task of the standby system receives the idle frame and immediately uses the status information. , And store external input information.
  • the fast task of the standby system also continuously sends periodic response frames to the fast task of the main system, thereby ensuring the periodic synchronization of the fast task of the main system and the fast task of the standby system.
  • the fast task of the main system sends a request frame or idle frame to the fast task of the standby system.
  • the fast task of the main system does not receive the response frame of the fast task of the standby system within the specified time, and the main system thinks that the main system and the standby system are out of sync .
  • the standby system If the fast task of the standby system does not receive the request frame or idle frame sent by the fast task of the primary system within the specified time, the standby system considers that the primary system and the standby system are out of sync.
  • the fast task of the main system sends a request frame or an idle frame to the fast task of the standby system, and both include the working status information of the main system and external input information.
  • the original data of the external input information can be directly transmitted, and the standby system compares the original data received by the main system and the standby system;
  • both the standby system and the main system are receiving the same external input information, and the main system transmits the external input information it receives to the standby system, and the standby system will process the external input information received by the main system and the standby system respectively. Compare to determine which input data of the two systems have been synchronized, use the synchronized data, buffer the unsynchronized data, and continue to synchronize the unsynchronized data.
  • the characteristic value of the external input data can be calculated and transmitted. Including but not limited to CRC (cyclic redundancy check) check value, using characteristic value to represent external input data, improving the real-time data transmission between the main system and the backup system.
  • CRC cyclic redundancy check
  • the CRC check value is only used as a characteristic value for transferring and comparing external input information, and is not limited to the characteristic value data of the CRC check value.
  • the switch needs to be changed so that the running track can be replaced.
  • the ground interlocking device can output information to the electric switch machine, and the electric switch machine changes the switch, and then Feedback information to the ground interlocking equipment.
  • the data of external input information can be compressed and the feature value of external input information can be used, and then only a few feature value data can be used to replace external input data, reducing errors caused by data transmission, and improving the relationship between the main system and the backup system. Real-time and accuracy of data transmission.
  • the length of synchronized data ranges from tens to one hundred.
  • the synchronization data length range under normal conditions is only used as an example, and is not limited to this kind of synchronization data length range. If the synchronization data length is less than or equal to the synchronization data in the normal condition system, the original data can be directly transmitted and compared. If the length of the synchronization data is greater than the length of the normal data, the data transmission will not only consume channels, but also take up a lot of time, which will affect the real-time performance, and the characteristic values of the synchronization data can be transmitted to achieve a quick effect.
  • Periodic operation of the main and standby systems use the same hardware platform and application software.
  • the hardware platform ensures that the main and standby systems are powered on simultaneously, and the cycles are synchronized.
  • the cycle numbers of the system and the backup system are accumulated from 1 upwards, and 1 is added every cycle, as the respective cycle numbers of the main system and the backup system.
  • the hardware platform ensures that the cycle numbers of the main system and the backup system are the same, otherwise the main system and the backup system are considered out of synchronization .
  • the present disclosure also provides a synchronization and hot backup system for the primary and backup systems of equipment, including a periodic module and a synchronization module.
  • the periodic module the fast and slow tasks of the primary and backup systems are executed periodically, and the fast task execution period should be less than Slow task execution cycle to avoid cycle conflicts between fast and slow tasks;
  • Synchronization module The fast task and slow task between the main system and the standby system are carried out periodically, and the data between the main system and the standby system are mutually hot standby, the main system information and the standby system information are carried out in an interactive manner, and the main system outputs Control commands, the standby system does not output control commands.
  • the hardware platform ensures that the main system and the backup system are powered on synchronously
  • the software platform ensures that the working status of the main system and the backup system is synchronized with external input, and realizes the hot backup of the main system and the backup system, and the main system outputs control commands.
  • the standby system does not output control commands, so if the main system fails and the standby system is upgraded to the main system when the main system and the standby system are synchronized, seamless and safe switching can be realized.

Abstract

一种设备主备系同步和热备方法及系统，在主系和备系同步情况下，如果主系故障，备系升级为主系，列车无需停车和其他特殊操作，即可实现无缝安全切换；当备系进入故障状态，从而主系和备系失去同步。通过硬件平台保证主系和备系同步上电，软件平台保证主系和备系的工作状态和外部输入同步，实现主系和备系热备，且主系输出控制命令的状况下，备系不输出控制命令，从而在主系和备系同步情况下，如果主系故障，备系升级为主系，即可实现无缝安全切换。

Description

一种设备主备系同步和热备方法及系统
本申请要求在2019年03月27日在中国专利局递交的、申请号为“2019102368665”、发明名称为“一种设备主备系同步和热备方法及系统”，的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开属于自动化技术领域，特别涉及一种设备主备系同步和热备方法及系统。
背景技术
高速铁路车载设备是保证列车行车安全的关键设备，从地面设备接收线路条件、行车许可等控制信息，并依据列车牵引制动特性，生成目标距离连续速度模式曲线，保证列车不超过允许速度曲线，尽量在最大运行速度时，保证列车安全运行，减小列车运行时间，避免出现列车晚点的状况。
如果车载设备没有采用热备技术，一旦车载设备故障，依据故障导向安全原则，列车将制动停车，停车后，如果重启车载设备，故障能够恢复，列车可以在车载设备的监督下继续运行，只是由于停车降低了运行效率，导致列车晚点。停车后，重启车载设备，故障依旧不能恢复，将严重影响运行效率，导致列车严重晚点，严重影响运行效率。因此，车载设备设计成双系热备，一系发生故障，另一个可以继续控车，提高了系统的可用性和安全性，尽量增加两系之间的联系效果，保证系统的运行的持续性，进而提高了整个系统的运行效率。
现有的车载设备如果出现故障，对故障进行排除的话，则需要耗费大量时间，进而导致列车晚点的状况，从而影响列车运行效率。
发明内容
针对上述问题，本公开提供一种设备主备系同步和热备方法，包括以下步骤：
硬件平台保证主系和备系的周期同步；
应用软件保证主系和备系的工作状态和外部输入同步；
应用软件保证主系输出控制命令，备系不输出控制命令；
在主系和备系同步情况下，主系故障，备系升级为主系；
在备系进入故障状态，主系和备系失去同步。
进一步地，所述主系和备系使用相同的硬件平台和应用软件，硬件平台保证主系和备系同步上电，且周期同步。
进一步地，所述硬件平台保证主系和备系的周期号相同，避免主系和备系失去同步。
进一步地，所述主系和备系的应用软件至少包含一个高优先级的快任务，以及一个低优先级的慢任务。
进一步地，所述快任务执行周期应小于慢任务执行周期，保证快任务在主系和备系之间传递信息的及时性。
进一步地，所述主系的快任务和慢任务之间共享主系的工作状态和外部输入信息，所述备系的快任务和慢任务之间共享备系的工作状态和外部输入信息。
进一步地，所述主系和备系的快任务用于快速传递工作状态和外部输入信息，并判断出主系和备系均收到的外部输入信息。
进一步地，所述主系和备系的慢任务执行应用软件逻辑，每周期使用快任务判断出主系和备系均收到的外部输入信息，实现主系和备系外部输入同步。
进一步地，所述快任务和慢任务均包括等待同步阶段和已同步阶段。
进一步地，所述主系的快任务向备系的快任务发送请求帧或空闲帧均包含主系的工作状态和外部输入信息。
进一步地，所述外部输入信息较短的状况下，主系向备系直接传递外部输入信息原始数据，备系对比主系和备系收到的原始数据；所述外部输入信息过长的状况下，主系向备系传递和对比外部输入信息的特征值。
进一步地，所述主系的慢任务和备系的慢任务等待同步状态：挂起应用软件主逻辑，等待快任务给出主系和备系的同步结果以及已同步的外部输入信息；
所述主系的慢任务和备系的慢任务已同步状态：执行应用软件主逻辑，并使用已同步的外部输入信息，保证主系和备系外部输入同步。
进一步地，所述主系的快任务和备系的快任务等待同步状态：主系的快任务向备系的快任务发送带有状态信息和外部输入信息的请求帧，备系的快任务使用状态信息，对比并反馈已同步的外部输入信息，备系的快任务向主系的快任务反馈同步判断结果；
所述主系的快任务和备系的快任务已同步状态：主系的快任务向备系的快任 务发送带有状态信息和外部输入信息的空闲帧，备系的快任务使用状态信息，并存储外部输入信息。
本公开还提供一种设备主备系同步和热备系统，包括周期模块和同步模块，其中，
所述周期模块：用于保证主系和备系的周期同步；
所述同步模块：用于保证主系和备系的工作状态和外部输入同步，并且主系输出控制命令，备系不输出控制命令。
进一步地，所述周期模块保证主系和备系同步上电，且主系周期与备系周期的周期号对应同步，所述同步模块保证主系和备系的同步运行。
本公开的硬件平台保证主系和备系同步上电，软件平台保证主系和备系的工作状态和外部输入同步，实现主系和备系热备，且主系输出控制命令的状况下，备系不输出控制命令，从而在主系和备系同步情况下，如果主系故障，备系升级为主系，即可实现无缝安全切换。
本公开的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本公开而了解。本公开的目的和其他优点可通过在说明书、权利要求书以及附图中所指出的结构来实现和获得。
附图说明
为了更清楚地说明本公开实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了主系和备系同步慢任务系统图；
图2示出了主系和备系同步快任务系统图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地说明，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
本公开提供了一种设备主备系同步和热备方法，包括以下步骤：
硬件平台保证主系和备系的周期同步；
应用软件保证主系和备系的工作状态和外部输入同步；
应用软件保证主系输出控制命令，备系不输出控制命令；
在主系和备系同步情况下，如果主系故障，备系升级为主系，列车无需停车和其他特殊操作，即可实现无缝安全切换；
当备系进入故障状态，从而主系和备系失去同步。
主系和备系应用软件至少包括快任务和慢任务，其中快任务为高优先级的，慢任务为低优先级的，其中，
主系和备系的快任务用于快速传递工作状态信息和外部输入信息，并判断出主系和备系均收到的外部输入信息；
主系和备系的慢任务执行应用软件逻辑，每周期使用快任务判断出的主系和备系均收到的外部输入信息，实现主系和备系外部输入同步；
示例性的，主备系包括主系和备系，主系和备系应用软件包括的快任务和慢任务均为周期执行，且快任务执行周期应小于等于慢任务执行周期的1/10，保证快任务执行的迅捷效果。快任务执行周期应小于等于慢任务执行周期的1/10仅仅作为示例进行说明，并不仅限于这一种比例关系，相对慢任务，快任务执行速度快速，保证同步的及时性，避免快任务执行周期产生多余的冗余时间，从而保证快任务在主系和备系之间传递信息的及时性。对于主系和备系之间的快任务和慢任务的周期同步，其中主系的快任务和慢任务之间共享主系的工作状态信息和外部输入信息，同样，备系的快任务和慢任务之间共享备系的工作状态信息和外部输入信息。
示例性的，在高速铁路车载设备中，利用应用软件来保证主系和备系的工作状态和外部输入同步，其中工作状态包括工作等级、工作模式等状态信息。外部输入信息包括无线数据、DMI(直接媒体接口)数据、应答器、轨道电路等来自外部设备的数据。其中工作状态和外部输入信息的具体内容仅作为举例来说明列车的运行状况，并不仅限于列车这一种表述方式。
例如，工作状态和外部输入信息也能说明是电路工作的数据，用于线路检索的方式，通过主系和备系同步来辅助确认线路的工作状态。
示例性的，若主系和备系同步，主系和备系之间的快任务和慢任务周期进行，主系把状态信息发送给备系，备系使用主系的状态信息。主系将收到的外部输入信息发送给备系，备系将收到的外部输入信息同主系收到的外部输入信息进行对比，给出判断结果，确定主系和备系分别执行的主要已同步的外部输入信息。备系是主系的热备，若主系故障，备系升级为主系，备系接替主系工作，若备系故障，并不影响主系正常工作。
若主系和备系不同步，如果主系故障，备系又无法升级为主系，两系都无法控制系统正常工作，从而造成系统故障。
如图1所示，慢任务流程：主系的慢任务和备系的慢任务分为等待同步阶段和已同步阶段：
等待同步状态：每一次慢任务的周期开始，主系和备系均进入等待同步阶段。在等待同步阶段，主系和备系分别挂起各自的应用软件逻辑，等待快任务给出主系和备系是否同步结果和外部输入信息的同步结果。主系的快任务向备系的快任务发送请求帧，备系的快任务收到请求帧，使用主系的工作状态，并对比主系和备系的外部输入信息。主系和备系分别收到的外部输入信息的数量有可能不相同，以两者之间的最小数量作为对比的范围，从头开始依次进行对比，如果对比成功，备系进入已同步状态。备系的快任务向主系的快任务回复应答帧，告知主系已经同步的外部输入数据，主系的快任务收到备系的快任务的应答帧，主系也进入已同步状态。
已同步阶段：在已同步阶段，主系和备系的慢任务开始执行各自的应用软件逻辑，并只使用主系和备系都收到的外部输入信息，实现外部输入信息的同步；在已同步阶段，主系的快任务依旧按周期发送空闲帧，备系的快任务收到空闲帧，使用主系的工作状态，并存储主系的外部输入信息，用于下一周期慢任务的等待同步状态的外部输入信息的同步检查。
此外，备系对比主系和备系之间的周期号等关键信息，若主系和备系不一致，则备系认为主系和备系不同步。主系和备系同步时，主系输出控制命令，从而整个设备能够通过主系发出的控制命令进行执行，备系不输出控制命令，避免在同步状态下，备系命令影响到主系命令，避免设备出现故障的状况。
示例性的，车载设备作为举例来进行说明，并不仅限于列车内部运行的车载 设备，也能用于其它类型的主系和备系同步效果，例如地铁、电脑处理器运行以及其它方面的，并不仅限于列车运行的方式。列车行驶时，主系和备系同步，则车载设备运行正常，主系和备系数据正常存储交互，列车正常行驶。在主系和备系同步的状态下，如果主系故障，备系升级为主系，控制列车运行，因为在主系和备系同步的情况下，主系和备系均接收数据，即主系和备系周期同步，且输入同步，主系输出控制命令，备系不输出控制命令。若主系出现故障，主系不输出控制命令时，备系升级为主系，备系输出控制命令，从而能够在不停车状态下实现主系和备系无缝切换，提高了系统的可用性和安全性。若在主系故障的状况下，备系也出现故障，则需要对列车进行制动停车处理，停车后，重启车载设备，如果主系和备系当中一个故障能够恢复，则列车能够在车载设备的监督下继续运行，如果主系和备系的故障都不能恢复，则会严重影响运行效率。
主系和备系不同步，主系和备系正常工作，以主系来控制列车，若主系出现故障，则备系无法升级为主系，从而导致系统故障，主系和备系不同步，主系故障后，整个系统处于故障状态，需要对故障进行排除。
如图2所示，快任务流程：主系的快任务和备系的快任务分为等待同步阶段和已同步阶段：
通过快任务，主系向备系可以发送两种帧，分别是请求帧和空闲帧，这两种帧均包含主系的工作状态信息和外部输入信息；主系发送空闲帧，备系使用主系的工作状态，备系存储主系的外部输入信息，并回复应答帧；主系发送请求帧，备系使用主系的工作状态，备系对比主系和备系之间的外部输入信息，判断主系和备系都收到的外部输入信息，并回复应答帧。
等待同步状态：主系的快任务向备系的快任务发送请求帧，备系的快任务收到请求帧，使用主系的工作状态，并对比主系和备系的外部输入信息。若主系和备系分别收到的外部输入信息的数量不相同或主系和备系分别收到的外部输入信息的数量相同，以主系和备系中的最小数量作为对比的范围，从头开始依次进行对比，若对比成功，备系进入已同步状态；若对比失败，则主系和备系不同步。备系的快任务向主系的快任务回复应答帧，告知主系已经同步的外部输入数据，主系的快任务收到备系的快任务的应答帧，主系也进入已同步状态。
如图2所示，当主系的快任务向备系的快任务发送请求帧，备系的快任务收 到请求帧，使用主系的工作状态，对比并反馈已同步的外部输入信息。此时备系的快任务向主系的快任务回复应答帧，同时反馈同步判断结果，主系的快任务收到备系的快任务的应答帧，表明主系也进入已同步状态，从而主系和备系由等待同步状态变成已同步状态。
已同步状态：在已同步阶段，主系的快任务依旧按周期发送空闲帧，备系的快任务收到空闲帧，使用主系的工作状态，并存储主系的外部输入信息，用于下一周期慢任务的等待同步状态的外部输入信息的同步检查。
如图2所示，主系的快任务不断的向备系的快任务发送周期性的空闲帧，空闲帧包含状态信息和外部输入信息，备系的快任务收到空闲帧，立即使用状态信息，并存储外部输入信息。此时备系的快任务也不断的向主系的快任务发送周期性的应答帧，从而保证主系的快任务和备系的快任务的周期同步。
主系的快任务向备系的快任务发送请求帧或空闲帧，在规定时间内，主系的快任务没有收到备系的快任务的应答帧，主系认为主系和备系不同步。
在规定时间内，备系的快任务没有收到主系的快任务发送的请求帧或空闲帧，备系认为主系和备系不同步。
示例性的，主系的快任务向备系的快任务发送请求帧或空闲帧均包含主系的工作状态信息和外部输入信息。
如果外部输入信息长度很短，可以直接传递外部输入信息的原始数据，备系对比主系和备系收到的原始数据；
示例性的，备系和主系都在接收同样的外部输入信息，主系将自己收到的外部输入信息传递给备系，备系会将主系和备系分别收到的外部输入信息进行对比，以确定两系哪些输入数据已同步，使用已同步的数据，缓冲未同步数据，并对未同步的数据继续进行同步判断。
如果外部输入信息长度过长，直接传递外部输入信息的原始数据，必然会耗费很多时间，影响系统功能的正确执行和实时性；在这种情况下，可以计算并传递外部输入数据的特征值，包括但不局限于CRC(循环冗余校验)校验值，用特征值表示外部输入数据，提高主系和备系之间数据传输的实时。
示例性的，其中CRC校验值仅仅是作为传递和对比外部输入信息的一种特征值，并不仅限于CRC校验值这一种特征值数据。
当外部输入信息数据长度过长时，若直接传递外部输入信息的原始数据时，则会耗费太长的时间，而且在信息交互时，信息传递和反馈就会在传递过程中耗费时间，进而影响系统功能的正确执行和实时性。示例性的，当列车需要解体或编组时，需要改变道岔，从而能够更换运行路轨，需要对路轨进行变化时，地面联锁设备能够输出信息到电动转辙机，电动转辙机更改道岔，然后反馈信息到地面联锁设备上，若信息过长导致信息输出和反馈失败，则会导致无法控制列车变道的状况，进而进一步影响列车驼峰解体或编尾编组的状况，列车驼峰解体和编尾编组仅作为举例进行示例性说明，并不仅限于列车联锁这一种方式。并且外部输入信息长度过长时，浪费时间的同时很有可能造成信息错误的状况，可能导致列车出轨的状况发生。因此，可以将外部输入信息的数据进行压缩以及使用外部输入信息的特征值，进而仅仅通过很少特征值数据来代替外部输入数据，减小数据传输产生的误差，提高主系和备系之间数据传输的实时和准确性。
示例性的，同步数据正常状况下，同步数据的长度范围在几十到一百之间。正常状况下的同步数据长度范围仅仅作为举例件说明，并不仅限于这一种同步数据长度范围，若同步数据长度小于等于正常状况系的同步数据，那么可以直接传递和对比原始数据。若同步数据有长度大于正常数据的长度时，则传递数据传输不仅耗费通道，而且占用很多时间，会影响实时性，进而通过传输同步数据的特征值，达到快捷效果。
主系和备系周期运行：主系和备系使用相同的硬件平台和应用软件，硬件平台保证主系和备系同步上电，且周期同步，即主系和备系上电运行后，主系和备系周期号从1依次向上累加，每周期加1，作为主系和备系各自的周期号，硬件平台保证主系和备系的周期号相同，否则认为主系和备系失去同步。
本公开还提供了一种设备主备系同步和热备系统，包括周期模块和同步模块，周期模块：主系和备系的快任务和慢任务均为周期执行，且快任务执行周期应小于慢任务执行周期，避免快任务与慢任务产生周期冲突的状况；
同步模块：主系和备系之间的快任务和慢任务周期进行，并且主系和备系之间的数据相互热备进行，主系信息与备系信息通过交互的方式进行，主系输出控制命令，备系不输出控制命令。
示例性的，硬件平台保证主系和备系同步上电，软件平台保证主系和备系的 工作状态和外部输入同步，实现主系和备系热备，且主系输出控制命令的状况下，备系不输出控制命令，从而在主系和备系同步情况下，如果主系故障，备系升级为主系，即可实现无缝安全切换。
尽管参照前述实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本公开各实施例技术方案的精神和范围。

Claims (15)

  1. 一种设备主备系同步和热备方法，其中，包括以下步骤：
    硬件平台保证主系和备系的周期同步；
    应用软件保证主系和备系的工作状态和外部输入同步；
    应用软件保证主系输出控制命令，备系不输出控制命令；
    在主系和备系同步情况下，主系故障，备系升级为主系；
    在备系进入故障状态，主系和备系失去同步。
  2. 根据权利要求1所述的设备主备系同步和热备方法，其中，所述主系和备系使用相同的硬件平台和应用软件，硬件平台保证主系和备系同步上电，且周期同步。
  3. 根据权利要求2所述的设备主备系同步和热备方法，其中，所述硬件平台保证主系和备系的周期号相同，避免主系和备系失去同步。
  4. 根据权利要求1-3任意一项所述的设备主备系同步和热备方法，其中，所述主系和备系的应用软件至少包含一个高优先级的快任务，以及一个低优先级的慢任务。
  5. 根据权利要求4所述的设备主备系同步和热备方法，其中，所述快任务执行周期应小于慢任务执行周期，保证快任务在主系和备系之间传递信息的及时性。
  6. 根据权利要求5所述的设备主备系同步和热备方法，其中，所述主系的快任务和慢任务之间共享主系的工作状态和外部输入信息，所述备系的快任务和慢任务之间共享备系的工作状态和外部输入信息。
  7. 根据权利要求6所述的设备主备系同步和热备方法，其中，所述主系和备系的快任务用于快速传递工作状态和外部输入信息，并判断出主系和备系均收到的外部输入信息。
  8. 根据权利要求6所述的设备主备系同步和热备方法，其中，所述主系和备系的慢任务执行应用软件逻辑，每周期使用快任务判断出的主系和备系均收到的外部输入信息，实现主系和备系外部输入同步。
  9. 根据权利要求5-8任意一个所述的设备主备系同步和热备方法，其中，所述快任务和慢任务均包括等待同步阶段和已同步阶段。
  10. 根据权利要求9所述的设备主备系同步和热备方法，其中，所述主系的 快任务向备系的快任务发送请求帧或空闲帧均包含主系的工作状态和外部输入信息。
  11. 根据权利要求10所述的设备主备系同步和热备方法，其中，所述外部输入信息较短的状况下，主系向备系直接传递外部输入信息原始数据，备系对比主系和备系收到的原始数据；所述外部输入信息过长的状况下，主系向备系传递和对比外部输入信息的特征值。
  12. 根据权利要求9所述的设备主备系同步和热备方法，其中，所述主系的慢任务和备系的慢任务等待同步状态：挂起应用软件主逻辑，等待快任务给出主系和备系的同步结果以及已同步的外部输入信息；
    所述主系的慢任务和备系的慢任务已同步状态：执行应用软件主逻辑，并使用已同步的外部输入信息，保证主系和备系外部输入同步。
  13. 根据权利要求9所述的设备主备系同步和热备方法，其中，所述主系的快任务和备系的快任务等待同步状态：主系的快任务向备系的快任务发送带有状态信息和外部输入信息的请求帧，备系的快任务使用状态信息，对比并反馈已同步的外部输入信息，备系的快任务向主系的快任务反馈同步判断结果；
    所述主系的快任务和备系的快任务已同步状态：主系的快任务向备系的快任务发送带有状态信息和外部输入信息的空闲帧，备系的快任务使用状态信息，并存储外部输入信息。
  14. 一种设备主备系同步和热备系统，其中，包括周期模块和同步模块，其中，
    所述周期模块：用于保证主系和备系的周期同步；
    所述同步模块：用于保证主系和备系的工作状态和外部输入同步，并且主系输出控制命令，备系不输出控制命令。
  15. 根据权利要求14所述的设备主备系同步和热备系统，其中，所述周期模块保证主系和备系同步上电，且主系周期与备系周期的周期号对应同步，所述同步模块保证主系和备系的同步运行。
PCT/CN2019/105214 2019-03-27 2019-09-10 一种设备主备系同步和热备方法及系统 WO2020192029A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP19916547.3A EP3748439B1 (en) 2019-03-27 2019-09-10 Synchronization and hot standby method and system for primary system and standby system of apparatus
EA202091840A EA202091840A1 (ru) 2019-03-27 2019-09-10 Способ и система синхронизации и горячего резервирования для основной системы и резервной системы оборудования
RS20221088A RS63768B1 (sr) 2019-03-27 2019-09-10 Postupak i sistem za sinhronizaciju i vruću rezervu za primarni sistem i pomoćni sistem uređaja
HRP20221374TT HRP20221374T1 (hr) 2019-03-27 2019-09-10 Metoda za sinkronizaciju i „hot standby“ i sustav za primarni i „standby“ sustav uređaja

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910236866.5A CN109946956B (zh) 2019-03-27 2019-03-27 一种设备主备系同步和热备方法
CN201910236866.5 2019-03-27

Publications (1)

Publication Number Publication Date
WO2020192029A1 true WO2020192029A1 (zh) 2020-10-01

Family

ID=67011077

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/105214 WO2020192029A1 (zh) 2019-03-27 2019-09-10 一种设备主备系同步和热备方法及系统

Country Status (7)

Country Link
EP (1) EP3748439B1 (zh)
CN (1) CN109946956B (zh)
EA (1) EA202091840A1 (zh)
HR (1) HRP20221374T1 (zh)
HU (1) HUE061141T2 (zh)
RS (1) RS63768B1 (zh)
WO (1) WO2020192029A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114407975A (zh) * 2021-12-21 2022-04-29 合肥工大高科信息科技股份有限公司 一种全电子联锁系统执行单元的热备方法及热备联锁系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109946956B (zh) * 2019-03-27 2020-11-24 北京全路通信信号研究设计院集团有限公司 一种设备主备系同步和热备方法
CN110789569B (zh) * 2019-10-17 2022-04-22 北京全路通信信号研究设计院集团有限公司 一种列控dmi数据冗余控制方法和系统
CN111003024B (zh) * 2020-03-06 2020-07-31 北京全路通信信号研究设计院集团有限公司 一种用于热备车载设备的列车接口数据的处理方法
CN111400111B (zh) * 2020-03-12 2024-02-27 北京交大思诺科技股份有限公司 一种具有备机失步状态的安全计算机平台
CN113721503A (zh) * 2021-08-16 2021-11-30 北京超星未来科技有限公司 一种车载计算平台、无人驾驶系统及车辆
CN115378557B (zh) * 2022-10-25 2023-02-17 成都星联芯通科技有限公司 热备实现方法、装置、系统、电子设备及存储介质

Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6618628B1 (en) * 2000-10-05 2003-09-09 Karl A. Davlin Distributed input/output control systems and methods
CN101030073A (zh) * 2007-03-30 2007-09-05 哈尔滨工程大学 发动机冗余电控系统切换电路及控制方法
CN202372803U (zh) * 2011-10-27 2012-08-08 北京航天发射技术研究所 一种热备冗余控制系统
CN103048920A (zh) * 2012-12-31 2013-04-17 广东申菱空调设备有限公司 一种用于集装箱冷水机组的双机热备冗余控制方法及系统
CN103941633A (zh) * 2014-04-29 2014-07-23 北京依雷特科技有限公司 可编程控制器冗余控制方法和系统
CN204856062U (zh) * 2015-07-21 2015-12-09 上海英硕自动化科技有限公司 一种对称式双机热备冗余系统
CN205158001U (zh) * 2015-11-05 2016-04-13 上海科泰电源股份有限公司 一种数据中心专用高压柴油发电机组冗余控制系统
CN105824273A (zh) * 2016-03-15 2016-08-03 北京交通大学 列车运行控制系统中的地面目标控制器
CN106527116A (zh) * 2016-12-15 2017-03-22 重庆川仪自动化股份有限公司 冗余控制系统及其方法
CN108153144A (zh) * 2017-11-29 2018-06-12 中核控制系统工程有限公司 一种dcs冗余控制器无扰切换方法
CN108459496A (zh) * 2018-05-17 2018-08-28 兰州大成铁路信号有限公司 用于铁路信号系统的安全冗余系统
CN109188895A (zh) * 2018-09-13 2019-01-11 杭州和利时自动化有限公司 一种基于冗余设计的伺服控制系统
CN109946956A (zh) * 2019-03-27 2019-06-28 北京全路通信信号研究设计院集团有限公司 一种设备主备系同步和热备方法

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100049717A1 (en) * 2008-08-20 2010-02-25 Ryan Michael F Method and systems for sychronization of process control servers
US8516355B2 (en) * 2011-02-16 2013-08-20 Invensys Systems, Inc. System and method for fault tolerant computing using generic hardware
CN102412997B (zh) * 2011-11-29 2014-12-17 深信服网络科技（深圳）有限公司 主备环境下传递链路通断状态的方法及系统
EP2667269B1 (de) * 2012-05-25 2014-12-17 Siemens Aktiengesellschaft Verfahren zum Betreiben eines redundanten Automatisierungssystems
JP5660096B2 (ja) * 2012-09-18 2015-01-28 横河電機株式会社 フォールトトレラントシステム
US9858052B2 (en) * 2013-03-21 2018-01-02 Razer (Asia-Pacific) Pte. Ltd. Decentralized operating system
CN109032235A (zh) * 2017-06-09 2018-12-18 许继电气股份有限公司 一种高压statcom控保系统及其主备系统的切换方法
CN108279597A (zh) * 2018-01-23 2018-07-13 上海亨钧科技股份有限公司 一种基于有限状态机的计算机联锁平台控制方法
CN109240074B (zh) * 2018-08-02 2021-07-16 中国航空工业集团公司西安飞行自动控制研究所 一种双余度控制方式的作动器主备工作切换方法

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6618628B1 (en) * 2000-10-05 2003-09-09 Karl A. Davlin Distributed input/output control systems and methods
CN101030073A (zh) * 2007-03-30 2007-09-05 哈尔滨工程大学 发动机冗余电控系统切换电路及控制方法
CN202372803U (zh) * 2011-10-27 2012-08-08 北京航天发射技术研究所 一种热备冗余控制系统
CN103048920A (zh) * 2012-12-31 2013-04-17 广东申菱空调设备有限公司 一种用于集装箱冷水机组的双机热备冗余控制方法及系统
CN103941633A (zh) * 2014-04-29 2014-07-23 北京依雷特科技有限公司 可编程控制器冗余控制方法和系统
CN204856062U (zh) * 2015-07-21 2015-12-09 上海英硕自动化科技有限公司 一种对称式双机热备冗余系统
CN205158001U (zh) * 2015-11-05 2016-04-13 上海科泰电源股份有限公司 一种数据中心专用高压柴油发电机组冗余控制系统
CN105824273A (zh) * 2016-03-15 2016-08-03 北京交通大学 列车运行控制系统中的地面目标控制器
CN106527116A (zh) * 2016-12-15 2017-03-22 重庆川仪自动化股份有限公司 冗余控制系统及其方法
CN108153144A (zh) * 2017-11-29 2018-06-12 中核控制系统工程有限公司 一种dcs冗余控制器无扰切换方法
CN108459496A (zh) * 2018-05-17 2018-08-28 兰州大成铁路信号有限公司 用于铁路信号系统的安全冗余系统
CN109188895A (zh) * 2018-09-13 2019-01-11 杭州和利时自动化有限公司 一种基于冗余设计的伺服控制系统
CN109946956A (zh) * 2019-03-27 2019-06-28 北京全路通信信号研究设计院集团有限公司 一种设备主备系同步和热备方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114407975A (zh) * 2021-12-21 2022-04-29 合肥工大高科信息科技股份有限公司 一种全电子联锁系统执行单元的热备方法及热备联锁系统
CN114407975B (zh) * 2021-12-21 2024-04-19 合肥工大高科信息科技股份有限公司 一种全电子联锁系统执行单元的热备方法及热备联锁系统

Also Published As

Publication number Publication date
HRP20221374T1 (hr) 2023-01-06
EP3748439A4 (en) 2021-05-05
EP3748439B1 (en) 2022-11-09
HUE061141T2 (hu) 2023-05-28
EA202091840A1 (ru) 2021-06-30
CN109946956B (zh) 2020-11-24
RS63768B1 (sr) 2022-12-30
EP3748439A1 (en) 2020-12-09
CN109946956A (zh) 2019-06-28

Similar Documents

Publication Publication Date Title
WO2020192029A1 (zh) 一种设备主备系同步和热备方法及系统
WO2017107665A1 (zh) 一种用于列车控制的安全计算机系统
US4198678A (en) Vehicle control unit
CN111003023B (zh) 一种双系首尾双重冗余的列车专用自动唤醒自动休眠设备
AU2003208108A1 (en) Fault-tolerant Computer System, Re-synchronization Method Thereof and Re-synchronization Program Thereof
US9323823B2 (en) Method for operating a redundant automation system
US20240040435A1 (en) Bandwidth adjustment method, service transmission method, network device and readable storage medium
US20060149903A1 (en) Fault tolerant computer system and a synchronization method for the same
JP3574233B2 (ja) 列車運転時隔制御方法及び装置
CN110488597B (zh) 机车主处理单元双冗余控制方法
CN108848197B (zh) 一种文件传输的方法与系统
WO2024011906A1 (zh) 一种主从冗余控制系统及控制方法
CN108082219B (zh) 一种2乘2取2冗余结构数据处理方法
CN103744753A (zh) 一种双机系统的数据交互方法与装置
CA2794058C (en) Method of providing high integrity processing
CN202142052U (zh) 列控车载设备的安全冗余计算机系统
CN109991899A (zh) 轨道交通系统的主备控制器间的数据半动态同步方法
WO2019200671A1 (zh) 一种用于铁路调度集中系统的主备机数据同步方法
CN109367586B (zh) 一种城市轨道交通信号系统时钟同步系统及方法
WO2019095647A1 (zh) 主控单元热备份的方法及装置、计算机存储介质
CN108616591B (zh) 一种用于进行数据交换的接口设备及方法
CN114148385B (zh) 一种城市轨道交通临时限速冗余存储和管理方法
US9311212B2 (en) Task based voting for fault-tolerant fail safe computer systems
US20140058533A1 (en) Method for Operating a Redundant Automation System
JP2013254333A (ja) 多重系制御システム及びその制御方法

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2019916547

Country of ref document: EP

Effective date: 20200903

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19916547

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE