WO2021035867A1

WO2021035867A1 - Redundancy control method for main and standby controllers

Info

Publication number: WO2021035867A1
Application number: PCT/CN2019/108638
Authority: WO
Inventors: 滕占伟; 刘刚林
Original assignee: 北京东土科技股份有限公司
Priority date: 2019-08-27
Filing date: 2019-09-27
Publication date: 2021-03-04
Also published as: CN112445127A; CN112445127B

Abstract

A redundancy control method for main and standby controllers. In each normal synchronization cycle, the method comprising the steps: A) a main controller acquiring external input variable data, and a standby controller obtaining input variable data from the main controller; B) the main and standby controllers respectively performing a logic operation on the input variable data; and C) performing consistency determination on a result of the logic operation, and outputting the result as output data when the determination result is consistent. By means of optimizing the design of logic synchronization of the main and standby controllers and the arbitration of switching between the main controller and the standby controller, the consistency of the main and standby controllers is ensured, the disturbance caused by the switching of the main and standby controllers is reduced, system downtime is saved, and the uninterrupted and stable operation of a control system is ensured.

Description

Redundant control method of main and standby controllers

Technical field

The invention relates to the technical field of industrial automatic control, and in particular to a redundant control method for a main and standby controller.

Background technique

With the development of industrial automatic control, the industrial control field puts forward higher requirements for the reliability of the control system, so there is a dual-computer redundancy technology, a pair of redundant controllers, when the main controller fails, the standby control The controller can replace its work at the first time to ensure the sustainable operation of the control system.

In redundant control, the input variable data sources of the main and standby controllers are all from the external input variable data of the external bus. The main and standby controllers perform logical operations, consistency judgments, and switching logic judgments on these data respectively. Since the input variable data comes from external data, when the main and standby controllers have synchronization errors in their respective operation cycles, resulting in a time difference in the external data read, the main and standby controllers may read different data separately, which will cause the calculation results to be incorrect. The inconsistency causes transmission failure of the control system and affects reliability. Therefore, it is necessary to add a synchronization mechanism to maintain the operation of both the active and standby controllers to reduce the disturbance caused by the switching of the active and standby controllers and ensure the uninterrupted and stable operation of the control system.

Summary of the invention

In view of this, the main purpose of the present invention is to provide a redundant control method for the main and standby controllers, which ensures that the main and standby controllers can read the same input variable data by making the standby controller obtain input variable data from the main controller. , Output the same calculation result under normal operation, so as to ensure the consistency of the data in the main and standby controllers, and avoid the technical problems mentioned in the background art.

The technical solution adopted by the present invention is a redundant control method for the active and standby controllers. In each normal synchronization period, the method includes the following steps:

A. The main controller obtains external input variable data; the standby controller obtains the input variable data from the main controller;

B. The main controller and the backup controller respectively perform logic operations on the input variable data;

C. Perform consistency judgment on the result of logical operation, and output the result as output data when the judgment is consistent.

From the above, the present invention obtains the input variable data from the outside through the main controller, and synchronizes the input variable data to the standby controller, so that both the main and standby controllers perform synchronous logic operations on the input variable data and judge the results of the logic operations. , When the judgment is consistent, the data is output, thereby ensuring the consistency of the main and standby controllers, preventing the main and standby controllers from reading different data respectively, resulting in inconsistent calculation results, causing transmission failures of the control system, and affecting the reliability of the system.

As a further improvement, step A further includes: when the standby controller fails to obtain the input variable data from the main controller, the standby controller obtains the external input variable data, and initiates the switch arbitration logic step.

From the above, through the arbitration logic, the active and standby switching arbitration of the active and standby controllers can be realized. The active and standby controllers communicate their own status information to each other through the state communication channel for the other party to diagnose their own activity. When it is diagnosed as abnormal When the time, the status information is changed and sent to the other party as soon as possible. The two parties make active/standby switch arbitration based on the latest state information and weights, and adjust their respective active/standby states, thereby reducing the disturbance caused by the switching of the active and standby controllers, and save Eliminate system downtime to ensure uninterrupted and stable operation of the control system.

Wherein, the failure includes: the standby controller does not receive the input variable data sent by the main controller within a specific time.

From the above, in normal operation, when the main controller receives new input variable data, it will synchronize to the standby controller. When the standby controller does not receive it within a certain period of time, it is determined that the synchronization process is abnormal. The arbitration logic can be started, and the arbitration of the main and standby switching can be performed.

Among them, step B includes:

The main controller sends a start signal to the standby controller, and the main controller performs logic operations on the input variable data;

After receiving the start signal, the standby controller executes logic operations on the input variable data.

From the above, the start signal is used as the trigger signal for the backup controller to perform logic operations. Before the main controller executes the logic operations in this cycle, it needs to send the start signal to the backup controller to make the backup controller perform logical operations synchronously to ensure that the main and backup controllers perform logical operations. The logic operation of the controller is performed synchronously.

Wherein, the step of determining the consistency of the result of the logical operation in step C includes:

The main controller sends the data related to the logic operation result to the backup controller, and the backup controller makes the consistency judgment of the data related to the logic operation result and its own logic operation result related data.

Wherein, the data related to the result of the logical operation includes a data check value calculated according to the result of the logical operation.

From the above, after the logical operation of the same cycle is over, the main controller sends the data check value of the logical operation to the standby controller, judges the consistency with the logical operation result of the standby controller, and feeds back the comparison result to the main controller .

Wherein, the step of outputting the result in step C includes:

After the backup controller feeds back the consistency information to the main controller, the main controller outputs the result.

From the above, when the standby controller determines that the logical operation results of the main and standby controllers are consistent, the main controller outputs the calculation results as output data.

Further improvement, when the results in step C are inconsistent, it also includes:

Before executing step B of the next cycle, the main controller also synchronizes the dynamic data including the calculation process value to the standby controller, and the calculation process value is used for the logic operation.

From the above, when the results of the consistency judgment of the standby controller are inconsistent, the main controller defaults that its calculation result is the correct result and outputs it. At the same time, it can also output an alarm message to determine that the logical operation of the standby controller is wrong, and the following When a new cycle arrives, in addition to synchronizing the new input variable data to the standby controller, the calculation process variable including global variable data and process variable data will also be synchronized to the standby controller.

Further improvements, during the power-on process or the project download process also include:

Before performing step A, the main controller performs the steps of static data synchronization and dynamic data synchronization with the standby controller;

The static data includes logical engineering files and configuration files;

The dynamic data includes external input variable data and calculation process quantity.

From the above, before running the redundant control of the main and standby controllers, it is necessary to synchronize the static data such as the preset project configuration file and logic operation project file to the main controller, and synchronize the main controller to the standby controller, so that The main and standby controllers are kept consistent, and then the dynamic data is synchronized, and then the redundant control of the main and standby controllers can be run normally.

A further improvement also includes that the active and standby controllers periodically transmit their own status information, and start the switching arbitration logic step when the status information is abnormal.

From the above, when both the active and standby controllers are operating normally, the active and standby controllers periodically transmit their own status information through the status communication channel. This information is similar to a heartbeat signal for the peer computer to determine its own activity. When it is abnormal, the status information will be changed and sent to the opposite terminal as soon as possible. The two parties will make active/standby switch arbitration based on the latest status information and weight, and adjust their respective active/standby status.

Wherein, the arbitration logic is based on at least one of the following to perform active/standby switch arbitration:

Key task running status, logic task running status, communication status with HMI, communication status with IO, communication status with other control stations, communication status with peer machine;

The above-mentioned different states can set different weights and/or priorities for the arbitration judgment of the master/slave switchover.

From the above, the status information weight is mainly used to provide a mechanism to ensure that the system can make the switch arbitration of the active and standby when the active and standby controllers that are redundant with each other are faulty. The weight sequence can be adjusted according to the specific system and application.

Description of the drawings

Fig. 1 is a flow chart of the redundant control method of the main and standby controllers of the present invention;

2 is a schematic diagram of the data synchronization process of the active and standby controllers during the power-on and startup stage of the present invention;

Figure 3 is a schematic diagram of the data synchronization process of the main and standby controllers in the download stage of the project of the present invention;

4 is a schematic diagram of the data synchronization process of the active and standby controllers in the normal cycle of the present invention;

FIG. 5 is a schematic diagram of the arbitration process of the master/backup switch of the present invention;

6 is a schematic diagram of an embodiment of the data synchronization process of the active and standby controllers in the normal cycle of the present invention;

FIG. 7 is a schematic diagram of an embodiment of the data synchronization process of the active and standby controllers in the download stage of the project of the present invention.

detailed description

Hereinafter, specific implementations of the redundant control method of the active and standby controllers of the present invention will be described in detail with reference to FIGS. 1 to 6.

The redundant control method of the main and standby controllers provided by the present invention is applied to a pair of redundant controllers, one of which is the main controller (local machine), which performs the collection of external data (ie, external data) and The control command (which is the result of the calculation, which belongs to a kind of output data) is sent, and the other is the standby controller (the opposite machine), which receives the data synchronized by the main controller. There is a high-speed data channel between the main and standby controllers. In order to synchronize logical data with each other, a reliable state communication channel is also provided to transfer state information to each other, and the main and standby controllers and the communication bus of the IO are all communicatively connected.

The flow chart of the redundancy control method of the active and standby controllers as shown in Fig. 1, when applied to the above-mentioned active and standby controllers for redundant control, includes the following steps:

S100: When the power is started or the project download starts, the main controller obtains external static data and dynamic data, and the standby controller obtains the static data and dynamic data from the main controller;

This step is the step at the beginning of the power-on startup phase or the project download phase, is the step before the redundancy control enters the normal cycle, and is the preparation phase before the normal synchronization logic operation of the main and standby controllers.

Refer to the schematic diagram of the data synchronization process of the active and standby controllers during the power-on startup phase shown in Figure 2. When the active and standby controllers are powered on, the consistency of the static data between the active and standby controllers needs to be ensured, and the main controller reads its own flash The static data on the memory, the static data includes a logic project file and a configuration file, and then when a static data synchronization request from the standby controller is received, the static data is synchronized to the standby controller;

It should be noted that after the main controller obtains static data from the outside through the bus or network, it will store the static data in its own memory, and will read the static data in its own memory every time it is normally powered on. If it cannot be read, the static data will be retrieved from the outside;

In addition to static data, the main controller also synchronizes dynamic data to the standby controller. The dynamic data includes input variable data, global variable data, and process variable data. The input variable data is obtained by the main controller from external devices (IO, etc.) through the bus. The global variable data is generally system attribute variables and clock count variables, etc., and the process variable data is an intermediate variable in the logic operation process. When the synchronization work of the main and standby controllers is completed, the logical operation of step S200 may be executed. It should be noted that during the power-on startup process, if the result data (such as the operation data generated after processing, the instruction data, etc.) needs to be output externally, the result data to be output generated by the main controller shall prevail. .

Refer to the schematic diagram of the data synchronization process of the active and standby controllers in the download stage of the project as shown in Figure 3. When the active and standby controllers need to be replaced with a new control project (such as upgrade, or version replacement, etc.), in the download stage of the new project , It is also necessary to ensure the consistency of the logic project file and configuration file between the active and standby controllers. It can be downloaded to the active and standby controllers at the same time, or downloaded to one of the controllers, and then through the high-speed data between the active and standby controllers. The channel is synchronized to the opposite terminal. In the preferred embodiment of the present invention, the logical project file and configuration file are still selected to be downloaded to the main controller, and then the main controller is synchronized to the standby controller to ensure the main and standby controllers. Consistency of static data;

After the synchronization of the above static data is completed, the main controller will synchronize the acquired dynamic data (input variable data and calculation process data) to the standby controller, so that the preparation work for the main and standby controllers is completed, and the steps can be performed S200 logic operation. The process of downloading the project shown in Figure 3 will be described in further detail later.

The calculation process data (global variable data, process variable data) in the above static data and dynamic data needs to be synchronized between the main and standby controllers during the power-on and start-up phase or the project download phase to ensure the main and standby control The consistency of the device data.

It should be noted that when the standby controller does not receive the static data and dynamic data sent by the main controller within a certain period of time, the standby controller needs to obtain relevant data from the outside by itself, and initiate the switch arbitration logic step.

S200: The main controller and the standby controller respectively perform logic operations on the input variable data;

Refer to the schematic diagram of the data synchronization process of the master and backup controllers in the normal cycle as shown in Figure 4. When the master and backup redundancy control is in the normal cycle phase, at the beginning of each same cycle, the master controller obtains it through the bus Input variable data from an external device, and synchronize the input variable data to the standby controller, so that the main and standby controllers perform logical operations on the input variable data respectively.

S300: Perform consistency judgment on the results of the respective logic operations of the main and standby controllers. When the judgment is consistent, the main controller outputs the result data to the outside, and returns to step S200 to enter the next cycle.

The data synchronization process of the active and standby controllers in the normal cycle shown in FIG. 4 (that is, the steps described in steps S200-S300) will be described in further detail below.

It can be seen from the above that the present invention enables the standby controller to obtain external input variable data from the main controller, and synchronize the logic operation and the consistency determination of the logic operation result to ensure that the main and standby controllers read the same input variable. Data, so as to ensure the consistency of the main and standby controllers and avoid the technical problems mentioned in the background art.

The above mainly describes the data synchronization method between the main and standby controllers of the present invention, and the arbitration logic of the main and standby switching of the present invention is introduced below. In the above-mentioned power-on start phase, project download phase or normal cycle phase, when the standby controller does not receive the data (static data or dynamic data) synchronized by the main controller within a certain period of time, at this time, the standby controller loads The data (static data and dynamic data) obtained from the bus, and start the switch arbitration logic step; and between the main and standby controllers will periodically transmit their own status information to the other party through the status communication channel, and start when the status information is abnormal Switch the arbitration logic.

Wherein, the status information includes key task running status, logical task running status, communication status with HMI, communication status with IO, communication status with other control stations, communication status with peer machine, etc., and the status information is used as the main The basis for the standby handover arbitration, and the status information can be customized according to the specific system. In the embodiment of the present invention, the weight of the status information is as follows:

Communication with the peer machine>Logic task>Communication with IO>Communication with other control stations>Communication status with HMI; In addition, in addition to the weight, each status information can also be set with different priorities.

The weight of the above status information is mainly used to provide a mechanism to ensure that the system can make the switch arbitration when the active and standby controllers that are redundant with each other are faulty. The above weight sequence is only the recommended sequence of the general system, and can be based on the specific System and application adjustments.

Among them, when the active and standby controllers are in normal operation, the active and standby controllers transmit their own state information through the state communication channel in a cycle and change synchronization manner. This information is similar to a heartbeat signal for the peer computer to determine its own activity. When it is diagnosed that its own status information has changed, the status information is changed and sent to the opposite terminal as soon as possible. The two parties make the master/backup switch arbitration according to the latest status information and weight, and adjust their respective master/backup status; The state communication channel between the standby controllers must be reliable. When the state information of the peer machine is not obtained in multiple cycles, it is determined that the peer machine is running abnormally. If the machine is the master controller, the standby controller will alarm if the machine is abnormal. As the standby controller, it sends a message to the peer machine to become the master controller through the status communication channel and the master/backup high-speed data channel, and then becomes the master controller, and the peer machine becomes the backup controller to complete the master/backup switch.

The active-standby switching arbitration mode in this embodiment supports single-machine mode, dual-master mode, and dual-standby mode, which can be selected according to the specific system. In addition, the detection during the main-standby switching arbitration process does not obtain the peer machine The number of times of status information and the time delay from sending the host upgrade message to the host performing the host upgrade action need to be set according to the time endurance of the specific system.

Figure 5 shows a specific embodiment of the master-slave handover arbitration, which includes the following steps:

S501-502: The local machine and the peer machine periodically transmit their own state information through the state communication channel. When either party diagnoses that its state information has changed, it first determines whether the peer machine is offline, and if it goes offline, go to step S503; If it is not offline, execute step S508;

S503-504: For the case where the peer machine goes offline, reset the handover lock flag, network connection status label and other status flags;

S505-507: Determine the role of the local machine. If the machine is the standby controller, switch the standby controller to the main controller to work, and end the arbitration task of the main-standby switchover; if the local machine is the main controller, then Standby controller abnormal alarm prompt, and end the arbitration task of this master/standby switchover;

S508-511: For the case that the peer machine is not offline, determine whether there is a heartbeat data packet on the current heartbeat data queue. If there is a heartbeat data packet, read the soft heartbeat data packet on the heartbeat data queue and update the peer machine If there is no heartbeat data packet, check the switching lock status of the peer machine and the local machine, if one of the parties is in the locked state, end the current master-slave switching arbitration task, otherwise go to step S512;

S512-513: In the case that both the local machine and the peer machine are not locked, calculate the health value of its own and the health value of the peer machine according to the algorithm, and perform the subsequent steps according to the status of the two machines;

S514-516: If the dual-standby mode is adopted, determine the value of the IP status of the local machine. If it is a small IP state, switch the local machine to the main controller, reset the judgment flag, and end the current main-standby switchover Arbitration task, if the machine is in the big IP state, there is no need to switch, and the arbitration task of this master-slave switchover is ended;

S517: If the one-master one-standby mode is adopted, the health status of the machine needs to be judged;

S518-521: When the health status of the local machine is worse than that of the peer machine, if the machine is the master controller, it will send a switch command to switch to the backup controller, and the original backup controller will be upgraded to the master; if the machine is the backup controller , It will be used as a warning reminder of the abnormality of the standby controller, and the arbitration task of this master/standby switchover will be ended;

S522-525: When the health status of the local machine is better than that of the peer machine, if the machine is the standby controller, it will receive the switching instruction, switch the standby controller to the main controller, and end the arbitration task of the main-standby switchover. If this machine is the main controller, it will alert the abnormal alarm of the standby controller, and end the arbitration task of the main/standby switchover;

S526-530: If the dual-master mode is adopted, first judge the health status of the local machine. If it is worse than the peer machine, switch the machine to the standby controller and end the arbitration task of the master-standby switchover; if it is equal to the peer end If it is a small IP, then no need to switch, and end the arbitration task of the master/backup switch; if it is a large IP, switch to the backup controller and end the current master/backup switch Arbitration task; if it is better than the peer machine, keep the host state unchanged.

Fig. 6 shows a specific embodiment of the data synchronization process of the active and standby controllers in the normal cycle period, which includes the following steps:

S601-602: At the beginning of a cycle, the main controller reads the input variable data from the external device from the bus and stores it in its buffer;

At this time, the standby controller waits for the data and starts timing. If it times out, it will read the input variable data from the external device from the bus and store it in its buffer. The device will receive the data sent by the main controller in the subsequent step S605 and reset the timer;

S603-605: The main controller determines the data to be synchronized to the standby controller according to the check result from the standby controller received in the previous cycle. When the check result is consistent, the main controller sets the input variable The data is sent to the standby controller; when it is inconsistent, the main controller sends all dynamic data, namely global variables, process variables, and the input variable data to the standby controller in turn; among them, the global variable data and the process variable data are The current calculation process volume data.

S606-607: The main controller sends a start signal to the standby controller, and the main controller performs logic operations on the input variable data;

S608: After the standby controller receives the start signal sent by the main controller, it also executes logic operation on the input variable data; the above start signal is used as the trigger signal for the standby controller to start the logic operation, so that the logic operation process of the main and standby controller Execute in the same cycle.

S609: After the main controller performs the logical operation on the input variable data, calculates the data check value of the logical operation result and sends it to the standby controller;

S610: The standby controller judges the consistency between the received data check value and its own data check value calculated by the logical operation result;

S611: The standby controller feeds back the comparison result to the main controller,

S612-613: When the consistency of the logic operation result is judged to be consistent, the main controller outputs the result of the logic operation; when it is inconsistent, the main controller defaults the result of its own logic operation to the correct result, and the result of the logic operation Perform output and issue an alarm message that the results of the main and standby operations are inconsistent;

Then, return to step S601 to execute the next cycle.

It is worth noting that when the consistency judgments of the logic operation results of one or more cycles are inconsistent, when it is judged that the redundant control of the main and standby controllers is abnormal, when appropriate measures are taken to deal with the abnormality, the specific abnormal period can be accommodated. The number of times can be set according to the specific system.

Figure 7 shows a specific embodiment of the data synchronization process of the active and standby controllers in the project download stage, including the following steps:

S701: During the power-on phase, the main controller obtains the files required by the project of the external device, and the standby controller obtains the files required by the project from the main controller;

After the synchronization of the files required by the main and standby controllers is completed, the subsequent synchronization of dynamic data and execution of logic operations can be carried out;

S702-705: When the new project is downloaded, the external device releases the signal of the new project to the main controller. At this time, the main control needs to be switched to the locked state, and the current dynamic data (hot data) acquisition and synchronization should be stopped;

S706: The main controller downloads a new project file from the external device, and when the download is completed, sends a signal of completion of the download to the standby controller;

S707-709: After the standby controller receives the signal that the download is complete, it switches to the locked state and obtains a new project file from the main controller. After synchronization is completed, it sends a synchronization completion response signal to the main controller;

S710: After receiving the synchronization completion response signal, the main controller releases the switching lock state and prepares to enter the next stage of dynamic data synchronization;

S711: The standby controller is started, the switching lock state is released, and the dynamic data of the main controller is waited for.

The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the present invention. Within the scope of protection.

Claims

A redundant control method for active and standby controllers is characterized in that, in each normal synchronization period, the method includes the following steps:

A. The main controller obtains external input variable data; the standby controller obtains the input variable data from the main controller;

B. The main controller and the backup controller respectively perform logic operations on the input variable data;

C. Perform consistency judgment on the result of logical operation, and output the result as output data when the judgment is consistent.
The method of claim 1, wherein:

Step A also includes: when the standby controller fails to obtain the input variable data from the main controller, the standby controller obtains the external input variable data, and initiates the switch arbitration logic step.
The method of claim 2, wherein:

The failure includes: the standby controller does not receive the input variable data sent by the main controller within a specific time.
The method according to claim 1, wherein step B comprises:

The main controller sends a start signal to the standby controller, and the main controller performs logic operations on the input variable data;

After receiving the start signal, the standby controller executes logic operations on the input variable data.
The method according to claim 1, wherein the step of determining the consistency of the result of the logical operation in step C comprises:

The main controller sends the data related to the logic operation result to the backup controller, and the backup controller makes the consistency judgment of the data related to the logic operation result and its own logic operation result related data.
The method of claim 5, wherein:

The data related to the result of the logical operation includes a data check value calculated according to the result of the logical operation.
The method according to claim 1, wherein the step of outputting the result in step C comprises:

After the backup controller feeds back the consistency information to the main controller, the main controller outputs the result.
The method according to claim 1, wherein when the results of step C are inconsistent, the method further comprises:

Before executing step B of the next cycle, the main controller also synchronizes the dynamic data including the calculation process value to the standby controller, and the calculation process value is used for the logic operation.
The method according to claim 1, characterized in that, during the power-on process or the engineering download process, the method further comprises:

Before performing step A, the main controller performs the steps of static data synchronization and dynamic data synchronization with the standby controller;

The static data includes logical engineering files and configuration files;

The dynamic data includes external input variable data and calculation process quantity.
The method according to claim 1, further comprising: the active and standby controllers periodically transmit their own status information, and start the switch arbitration logic step when the status information is abnormal.
The method according to claim 2 or 10, wherein:

The arbitration logic is based on at least one of the following to perform active/standby switch arbitration:

Key task running status, logic task running status, communication status with HMI, communication status with IO, communication status with other control stations, communication status with peer machine;

The above-mentioned different states can set different weights and/or priorities for the arbitration judgment of the master/slave switchover.