WO2021253596A1 - 一种基于双通道安全plc的同步控制及数据表决方法 - Google Patents

一种基于双通道安全plc的同步控制及数据表决方法 Download PDF

Info

Publication number
WO2021253596A1
WO2021253596A1 PCT/CN2020/108574 CN2020108574W WO2021253596A1 WO 2021253596 A1 WO2021253596 A1 WO 2021253596A1 CN 2020108574 W CN2020108574 W CN 2020108574W WO 2021253596 A1 WO2021253596 A1 WO 2021253596A1
Authority
WO
WIPO (PCT)
Prior art keywords
control unit
cpu control
data
delay
slave
Prior art date
Application number
PCT/CN2020/108574
Other languages
English (en)
French (fr)
Inventor
程广河
孙瑞瑞
郝凤琦
张让勇
孟庆龙
郝慧娟
杜志伟
Original Assignee
山东省计算中心（国家超级计算济南中心）
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 山东省计算中心（国家超级计算济南中心） filed Critical 山东省计算中心（国家超级计算济南中心）
Publication of WO2021253596A1 publication Critical patent/WO2021253596A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0428—Safety, monitoring
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/24—Pc safety
    • G05B2219/24024—Safety, surveillance

Definitions

  • the invention discloses a synchronous control and data voting method based on a dual-channel safety PLC, which belongs to the technical field of intelligent control.
  • Safety PLC operation is a time-varying system, which requires high system real-time performance. When using a dual-channel system, it must be synchronized to ensure consistent operating data. However, only relying on the redundancy of the hardware system cannot guarantee the dual-channel System operation is synchronized. In a redundant system, there are three common synchronization methods: clock synchronization, loose synchronization and task synchronization:
  • the clock synchronization is a synchronization method based on the system clock, which is a tight synchronization.
  • each node is required to be strictly synchronized in each clock cycle, so that each node can synchronize according to the clock sequence.
  • the synchronization effect of the clock synchronization system is good, the fault can be found and resolved in time.
  • the clock synchronization hardware implementation structure of redundant systems is very complex and difficult to implement.
  • the clock synchronization cycle is often short due to clock accuracy and drift, and due to the relationship between frequency multiplication and frequency division between the internal clock and external clock of the CPU, it is often It is difficult to achieve clock synchronization.
  • the loose synchronization is a synchronization method based on a time slice period.
  • a time slice is composed of N*Tclock clock periods.
  • the redundant system will synchronize the system after the end of each time slice.
  • the redundant system does not necessarily maintain strict clock synchronization within the time slice. You only need to perform output duel operations after the time slice ends. Relative to clock synchronization, the requirements for loose synchronization are not very strict.
  • the task synchronization is the loosest one compared to the previous two synchronization methods. It is different from the first two synchronization methods based on a single or fixed number of clock cycles. Task synchronization is based on tasks. Synchronously. In the control system, the control process can be divided into different task modules, and the functions implemented by each task module are not the same. After each task module is executed, the next task module can be started after system synchronization. It can be considered that it is only necessary to ensure that in a certain period of time, the redundant system performs the same task function, but the speed of a single channel and how to perform it does not need to be strictly consistent. It is generally considered that task synchronization is a kind of relative synchronization, and it is not necessary to maintain absolute clock synchronization.
  • the traditional voting mechanism only conducts voting directly after information synchronization is completed. If the data is consistent, the system will be synchronized. When the next task cycle is started, the data inconsistency will cause a fault handling mechanism. Although this method can guarantee the security of the system, it is due to the control The system is time-varying, so even though the system is synchronized, the final decision result may also have a certain system deviation. At the same time, due to the external environment, electromagnetic interference, contact jitter and other objective factors, there is the possibility of system misjudgment. In summary, the traditional direct voting mechanism will result in lower system availability and higher false trip rate (FTR).
  • FTR false trip rate
  • the present invention discloses a synchronous control method based on a dual-channel safety PLC.
  • the synchronization control of the safety PLC needs to be realized by adopting a reasonable and efficient software mechanism, which not only can ensure the safe and stable operation of the system, but also avoid performance loss as much as possible.
  • Data exchange is carried out between the dual CPU control units through the CAN bus.
  • CAN bus communication is a half-duplex multi-master working bus structure.
  • Half-duplex means that sending and receiving data cannot be carried out at the same time, and only one node can send or receive data at the same time. When a continuous 11-bit recessive level appears on the bus, the bus is in an idle state, and the node can send a message frame to the bus.
  • the bus becomes a dominant level, and other nodes are in the receiving state.
  • the so-called multi-master work means that all nodes on the bus are not divided into master and slave, and everyone is in an equal position.
  • the response is in data transmission: in the idle state of the bus, any node can send a message to the bus, so free communication can be realized between the nodes.
  • the present invention designs a competition-based master-slave CPU control unit confirmation method, that is, a dual-channel redundant design is adopted.
  • the dual CPU control unit on the main control module is designed without prior confirmation which is the main CPU control unit and which is the slave CPU control unit, so it needs to be confirmed by software.
  • the invention also discloses a data voting method based on the dual-channel safety PLC.
  • a synchronous control method based on a dual-channel safety PLC wherein the safety PLC includes a main control module, and the main control module includes two CPU control units;
  • the synchronization control method based on the dual-channel safety PLC includes a synchronization establishment method for master and slave CPU control units, including:
  • the two CPU control units have the right to first obtain the CAN bus data exchange channel to send data to the other party.
  • the rules for obtaining this right are: the CPU control unit that completes the power-on initialization first sends the main control unit to the other CPU control unit first. Request frame, and then send data through CAN bus data exchange channel;
  • the CPU control unit that first completes the power-on initialization is the master CPU control unit, and the other CPU control unit is the slave CPU control unit;
  • the method for establishing system synchronization after confirmation by the master and slave control units includes:
  • the main CPU control unit sends a system synchronization frame Sync with fixed byte data to the slave main CPU control unit through the CAN bus data exchange channel between the two;
  • the main CPU control unit triggers a timer interrupt based on the local clock system to start the scan cycle timing, which takes 10ms;
  • the slave CPU control unit starts the scan cycle when it receives the system synchronization frame Sync sent by the master CPU control unit.
  • the master CPU control unit starts a new scan cycle based on its own local clock, and the slave CPU control unit is based on The message synchronization signal transmitted by the main CPU control unit is triggered;
  • the dual CPU control unit sends acquisition commands to the input acquisition unit of the CAN bus data exchange channel through the CAN bus.
  • the input acquisition unit transfers the collected information to the input acquisition image area of the respective CPU control unit, and the CPU control unit will collect the data.
  • the information is sent to the main CPU control unit through the CAN bus data exchange channel for "data voting": the voting is consistent, and the input collection task cycle ends;
  • the slave CPU control unit When the slave CPU control unit receives the synchronization frame Sync, it turns on the logic to execute the task;
  • the dual CPU control unit will independently call the contents of the respective input acquisition image area and the component register area to perform logical calculations according to the PLC program logic, and store the calculation results in their respective output execution image areas;
  • the slave CPU control unit sends the calculation result to the main CPU control unit for "data voting": the voting is consistent, and the user program analysis cycle ends;
  • the main CPU control unit is in the waiting state, waiting for the end of the 10ms scan of this cycle, the next timer interrupt is triggered, and repeat steps 1)-4) to start the next 10ms scan cycle.
  • the delay generated when the main CPU control unit sends the system synchronization frame Sync to the slave main CPU control unit is compensated by an error.
  • the dual CPU control unit needs to perform a system synchronization at the end of one task cycle and the beginning of the next task cycle.
  • the master CPU control unit sends a frame to the slave CPU control unit through the CAN bus data exchange channel.
  • the message synchronization frame Sync of the number of bytes, the message synchronization frame Sync has three parts of serial transmission, hardware interface, and media access delay from being sent to being received. Therefore, in order to ensure system synchronization, the main CPU control unit sends
  • the message synchronization frame Sync needs to be properly delayed in the future, and the error needs to be compensated by means of software algorithms.
  • the error compensation method includes:
  • the master CPU control unit sends a message frame Fellow_up with the same number of bytes as the synchronization message frame Sync to the slave CPU control unit, and the master CPU control unit records the sent time stamp t 1 based on its own local clock;
  • the time stamp t 2 of the received message frame Fellow_up is recorded based on its own clock system.
  • the local time stamp of the main CPU control unit is t 2a ;
  • the main CPU control unit After the main CPU control unit receives the delay request message frame Delay_Req from the CPU control unit, it records the time stamp information of the received delay request message frame Delay_Req as t 4 ;
  • the slave CPU control unit sends a delay request follow-up message Delay_Req_Fellow to the main CPU control unit again, and the follow message contains the time stamp information t 2 and t 3 recorded by the slave CPU control unit;
  • the master CPU control unit calculates the time delay between the master and slave CPU control units according to the acquired time stamp information t 1 , t 2 , t 3 and t 4;
  • the main CPU control unit sends the Fellow_up message frame and the time deviation MS_td received from the CPU control unit.
  • the MS_td is the abbreviation of Master-Slave time difference:
  • the Delay_Req message frame returned from the CPU control unit and the time difference received by the main CPU control unit Slave-Master time difference (abbreviation: SM_td) is
  • SM_delay The actual transmission delay of Delay_Req message frame between master and slave CPU control unit Slave-Master time delay, its abbreviation is SM_delay:
  • MS_td MS_delay+ ⁇ t (Formula 5)
  • SM_td SM_delay- ⁇ t (Formula 6)
  • the main control modules realize data transmission through the CAN bus of the data exchange module, and use the same data exchange channel, so it is considered that the delay of sending fixed byte data from the main CPU to the slave CPU and from the slave CPU to the main CPU is the same Denoted as t d , we can get
  • the dual CPU control unit does not need to perform clock synchronization, it only needs to delay time t d after the main CPU control unit sends the message synchronization frame Sync each time.
  • the dual CPU control unit will call the delay deviation compensation algorithm to recalculate the delay t d at regular intervals to continuously adjust the delay deviation.
  • a data voting method based on a dual-channel safety PLC The master and slave CPU control units respectively obtain collected external information from the input redundancy module, and store the collected external information in their respective input collection image area InputImage[ ]; From the CPU control unit the collected data is sent to the main CPU control unit through the data exchange channel, and vote with the data in the input acquisition image area InputImage[] of the main CPU control unit;
  • the master CPU control unit returns to the slave CPU control unit a confirmation signal that the data vote is consistent;
  • the master CPU control unit sends a system synchronization frame Sync to the slave CPU control unit. After the system is synchronized, the next task cycle will be started;
  • the main CPU control unit returns a data voting inconsistency signal to the slave CPU control unit, and the master and slave CPU control units both input the data collected this time from the input acquisition image area. Erase it from InputImage[], and set the data voting error flag position to 1 at the same time;
  • the dual CPU control unit After the system is synchronized, the dual CPU control unit sends out an input information collection command again:
  • the data voting error flag is reset to 0, and the system continues to run down.
  • the previous cycle is the first cycle
  • the current cycle is the second cycle
  • the system failure refers to a failure alarm to indicate that a "data voting error" has occurred
  • the main CPU control unit The implementation of the built-in safety output of the system, while the system will stop operation to ensure safety.
  • the dual-channel safety PLC-based synchronization control method of the present invention is realized by adopting a reasonable and efficient software mechanism, which can not only ensure the safe and stable operation of the system, but also avoid performance loss as much as possible.
  • the synchronization process adopts the method of regular time delay deviation calibration, which not only improves the calculation accuracy of experimental deviation, but also improves the working efficiency of the entire control system.
  • the data voting method proposed by the present invention improves the availability of the system and solves the problem of high trip rate (FTR) caused by misjudgment of the control system.
  • FRR high trip rate
  • Figure 1 is a flowchart of the synchronization establishment of the master and slave CPU control units in the present invention
  • FIG. 2 is a flowchart of system synchronization in the present invention
  • Figure 3 is a schematic diagram of the algorithm corresponding to the software error compensation method in the present invention.
  • FIG. 4 is a flowchart of the data voting method of the present invention.
  • a synchronous control method based on a dual-channel safety PLC wherein the safety PLC includes a main control module, and the main control module includes two CPU control units;
  • the synchronization control method based on the dual-channel safety PLC includes a synchronization establishment method for master and slave CPU control units, including:
  • the two CPU control units have the right to first obtain the CAN bus data exchange channel to send data to the other party.
  • the rules for obtaining this right are: the CPU control unit that completes the power-on initialization first sends the main control unit to the other CPU control unit first. Request frame, and then send data through CAN bus data exchange channel;
  • the CPU control unit that first completes the power-on initialization is the master CPU control unit, and the other CPU control unit is the slave CPU control unit;
  • the main control module includes two CPU control units including CPUa and CPUb.
  • CPUa After CPUa completes power-on initialization, if it judges that it has not received the main control unit request frame sent by CPUb, and at the same time CPUa detects that the data exchange channel CAN bus is in an idle state, it immediately sends the main control unit request frame to CPUb;
  • the CPUb After receiving the above-mentioned request frame from the main control unit, the CPUb replies with an agreement confirmation frame;
  • CPUa When CPUa receives the confirmation frame from CPUb, it sets itself as the main CPU control unit and enjoys the execution control right of the system: sends the execution result to the output redundancy module; at the same time, when CPUb receives the main request frame from CPUa, it defaults to It is set as the slave CPU control unit and does not enjoy the execution control right of the system.
  • a method for synchronization control based on a dual-channel safety PLC the method for establishing system synchronization after confirmation by the master and slave control units includes:
  • the main CPU control unit sends a system synchronization frame Sync with fixed byte data to the slave main CPU control unit through the CAN bus data exchange channel between the two;
  • the main CPU control unit triggers a timer interrupt based on the local clock system to start the scan cycle timing, which takes 10ms;
  • the slave CPU control unit starts the scan cycle when it receives the system synchronization frame Sync sent by the master CPU control unit;
  • the dual CPU control unit sends acquisition commands to the input acquisition unit of the CAN bus data exchange channel through the CAN bus.
  • the input acquisition unit transfers the collected information to the input acquisition image area of the respective CPU control unit, and the CPU control unit will collect the data.
  • the information is sent to the main CPU control unit through the CAN bus data exchange channel for "data voting": the voting is consistent, and the input collection task cycle ends;
  • the slave CPU control unit When the slave CPU control unit receives the synchronization frame Sync, it turns on the logic to execute the task;
  • the dual CPU control unit will independently call the contents of the respective input acquisition image area and the component register area to perform logical calculations according to the PLC program logic, and store the calculation results in their respective output execution image areas;
  • the slave CPU control unit sends the calculation result to the main CPU control unit for "data voting": the voting is consistent, and the user program analysis cycle ends;
  • the slave CPU control unit Since the main CPU control unit has the right to control the output execution and can send the data in the output execution image area of its own to the output execution unit of this channel, the slave CPU control unit does not perform this operation, so in the user program analysis cycle "data After the matchup is consistent, the main CPU control unit automatically executes the corresponding operation;
  • the main CPU control unit is in the waiting state, waiting for the end of the 10ms scan of this cycle, the next timer interrupt is triggered, and repeat steps 1)-4) to start the next 10ms scan cycle.
  • the master CPU control unit sends a system synchronization frame to the slave master CPU control unit through error compensation The delay incurred during Sync.
  • the error compensation method includes:
  • the master CPU control unit sends a message frame Fellow_up with the same number of bytes as the synchronization message frame Sync to the slave CPU control unit, and the master CPU control unit records the sent time stamp t 1 based on its own local clock;
  • the time stamp t 2 of the received message frame Fellow_up is recorded based on its own clock system.
  • the local time stamp of the main CPU control unit is t 2a ;
  • the main CPU control unit After the main CPU control unit receives the delay request message frame Delay_Req from the CPU control unit, it records the time stamp information of the received delay request message frame Delay_Req as t 4 ;
  • the slave CPU control unit sends a delay request follow-up message Delay_Req_Fellow to the main CPU control unit again, and the follow message contains the time stamp information t 2 and t 3 recorded by the slave CPU control unit;
  • the master CPU control unit calculates the time delay between the master and slave CPU control units according to the acquired time stamp information t 1 , t 2 , t 3 and t 4;
  • the main CPU control unit sends the Fellow_up message frame and the time deviation MS_td received from the CPU control unit.
  • the MS_td is the abbreviation of Master-Slave time difference:
  • the Delay_Req message frame returned from the CPU control unit and the time difference received by the main CPU control unit Slave-Master time difference (abbreviation: SM_td) is
  • SM_delay The actual transmission delay of Delay_Req message frame between master and slave CPU control unit Slave-Master time delay, its abbreviation is SM_delay:
  • MS_td MS_delay+ ⁇ t (Formula 5)
  • SM_td SM_delay- ⁇ t (Formula 6)
  • the main control modules realize data transmission through the CAN bus of the data exchange module, and use the same data exchange channel, so it is considered that the delay of sending fixed byte data from the main CPU to the slave CPU and from the slave CPU to the main CPU is the same Denoted as t d , we can get
  • the dual CPU control unit does not need to perform clock synchronization, it only needs to delay time t d after the main CPU control unit sends the message synchronization frame Sync each time.
  • the dual CPU control unit will call the delay deviation compensation algorithm to recalculate the delay t d at regular intervals to continuously adjust the delay deviation.
  • a data voting method based on a dual-channel safety PLC The master and slave CPU control units respectively obtain collected external information from the input redundancy module, and store the collected external information in their respective input collection image area InputImage[ ]; From the CPU control unit the collected data is sent to the main CPU control unit through the data exchange channel, and vote with the data in the input acquisition image area InputImage[] of the main CPU control unit;
  • the data voting method includes:
  • the master CPU control unit returns to the slave CPU control unit a confirmation signal that the data vote is consistent;
  • the master CPU control unit sends a system synchronization frame Sync to the slave CPU control unit. After the system is synchronized, the next task cycle will be started;
  • the main CPU control unit returns a data voting inconsistency signal to the slave CPU control unit, and the master and slave CPU control units both input the data collected this time from the input acquisition image area. Erase it from InputImage[], and set the data voting error flag position to 1 at the same time;
  • the system may have the following collection results as shown in Table 1:
  • the previous cycle is the first cycle, and the current cycle is the second cycle.
  • Two consecutive "data voting" inconsistencies have occurred, indicating that the system is difficult to correct itself in a certain amount of time. This situation is very dangerous when it occurs.
  • the system failure refers to a failure alarm to indicate a "data voting error"
  • the main CPU control unit executes the system's built-in safety output, and the system will shut down to ensure safety .

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Hardware Redundancy (AREA)
  • Programmable Controllers (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

一种基于双通道安全PLC的同步控制及数据表决方法，两个所述CPU控制单元具有向对方优先获取到CAN总线数据交互通道发送数据的权利，该权利的获得规则为：先完成上电初始化的CPU控制单元优先向另一CPU控制单元发送主控制单元请求帧，进而通过CAN总线数据交互通道发送数据；先完成上电初始化的CPU控制单元为主CPU控制单元，另一CPU控制单元为从CPU控制单元；主、从控制单元确认完毕后进行系统同步建立。本发明采用合理高效软件机制来实现，既能保障系统安全稳定运行，又能尽可能的避免性能损失。本发明提出的数据表决方法提高了系统可用性，解决了控制系统由于误判导致的跳闸率较高问题。

Description

一种基于双通道安全PLC的同步控制及数据表决方法 技术领域
本发明公开一种基于双通道安全PLC的同步控制及数据表决方法，属于智能控制的技术领域。
背景技术
安全PLC运行时是一个时变的系统，要求具有较高的系统实时性，当运用双通道系统运行时要保持同步，以保证运行数据一致，但是仅仅依靠硬件系统的冗余是无法保障双通道系统运行同步，在冗余系统中，常见的同步方式有三种，分别是：时钟同步、松散同步和任务同步：
所述时钟同步，是一种基于系统时钟的同步方式，是一种紧同步。用于早期冗余系统同步，要求各节点在每个时钟周期做到严格的同步，从而使每个节点都能按照时钟顺序进行同步。时钟同步系统同步效果虽好，因此能够及时的发现故障并解决。但是冗余系统的时钟同步硬件实现结构十分复杂，实现难度很高，由于时钟精度和漂移常常会导致时钟同步周期很短，而且由于CPU内部时钟和外部时钟存在倍频和分频的关系，常常导致时钟同步难以实现。
所述松散同步，是一种基于时间片周期的同步方式，在冗余系统中，一个时间片由N*Tclock个时钟周期组成。冗余系统会在每个时间片结束以后进行系统同步，在时间片内冗余系统并不一定要保持严格的时钟同步。只需要在时间片结束以后进行输出对决操作即可。相对时钟同步来讲，松散同步的要求并不十分严格。
所述任务同步，相较于前面两种同步方式是最为松散的一种，和前两种以单个或者固定多个时钟周期数为基准的同步方式不同，任务同步是以任务为基准的一种同步方式。控制系统中，控制流程可以划分为不同的任务模块，每个任务模块实现的功能不尽相同，当每个任务模块执行完毕，进行系统同步以后才能开启下一个任务模块。可以认为只需要保证在某一个时间段内，冗余系统执行的是相同的任务功能，但是具备单个通道执行的快慢以及如何执行不需要严格的一致。通常认为任务同步是一种相对同步，并不是需要保持绝对的时钟同步。
通过以上的分析得知，时钟同步和松散同步硬件上需要有严格时钟系统来保障，设计难度较大，同时由于还会导致系统高度耦合，同时又由于误差和时钟飘移等因素的相应，常常使系统出现同步错误，降低系统的无故障使用时间。任务 同步是一种能够允许误差出现的同步方式，对于系统硬件上的要求不是特别的严格，同时也能将对安全控制系统的共模错误降低到最低。
除此之外，在双CPU主控单元在运行过程中，要不断地进行自身状态和运行数据表决，在保证数据一致性的前提下，才能进行下一步操作。在不影响系统安全稳定性的前提下，需要采用合理高效的数据表决机制，尽可能的延长系统无故障运行时间，保障运行效率。
传统的表决机制仅仅在进行完信息同步以后直接进行表决，数据一致就进行系统同步，开启下一个任务周期，数据不一致就会进行故障处理机制，此方法虽然能够保障系统的安全性，但是由于控制系统具有时变性，因此尽管进行了系统同步，其最终决策结果也可能存在一定的系统偏差，同时由于外界环境，电磁干扰，触点抖动等客观因素的存在，存在系统误判的可能性。综上可知，传统的直接表决机制会造成系统可用性较低、误跳闸率(FTR)较高。
发明内容
针对现有技术的不足，本发明公开一种基于双通道安全PLC的同步控制方法。对于安全PLC的同步控制需要采用合理高效软件机制来实现，既要能保障系统安全稳定运行，又能尽可能的避免性能损失。双CPU控制单元之间通过CAN总线进行数据交互。CAN总线通信是一种半双工多主工作式总线结构，半双工指的是发送和接收数据不能够同时进行，在同一时刻只能有一个节点发送或者接收数据。当总线上出现连续的11位隐性电平，那么总线就处于空闲状态，节点便可以向总线发送报文帧，同时总线变成显性电平，其他节点便处于接收状态。所谓多主工作指的是总线上的所有节点没有主从之分，大家都处于平等的地位。反应在数据传输上即：在总线空闲状态，任意节点都可以向总线上发送消息，因此可在各节点之间实现自由通信。本发明根据CAN总线的特性，设计一种基于竞争式的主从CPU控制单元确认方法，即采用的是双通道冗余设计，系统在上电以后首先要进行同步建立工作，确定哪一个CPU为主控单元：主控模块上的双CPU控制单元在设计时并没有事先确认哪一个是主CPU控制单元，哪个是从CPU控制单元，因此需要通过软件的方式进行确认。
本发明还公开一种基于双通道安全PLC的数据表决方法。
本发明的技术方案如下：
一种基于双通道安全PLC的同步控制方法，其特征在于，其中安全PLC中包 括主控模块，所述主控模块包括两个CPU控制单元；
所述基于双通道安全PLC的同步控制方法包括主、从CPU控制单元同步建立方法，包括：
两个所述CPU控制单元具有向对方优先获取到CAN总线数据交互通道发送数据的权利，该权利的获得规则为：先完成上电初始化的CPU控制单元优先向另一CPU控制单元发送主控制单元请求帧，进而通过CAN总线数据交互通道发送数据；
先完成上电初始化的CPU控制单元为主CPU控制单元，另一CPU控制单元为从CPU控制单元；
主、从控制单元确认完毕后进行系统同步建立。
根据本发明优选的，所述主、从控制单元确认完毕后进行系统同步建立的方法，包括：
1)主CPU控制单元向从主CPU控制单元通过两者之间的CAN总线数据交互通道发送一帧具有固定字节数据的系统同步帧Sync；
同时主CPU控制单元基于本地时钟系统触发定时器中断，开始扫描周期计时，时间为10ms；
从CPU控制单元在收到主CPU控制单元发送的系统同步帧Sync时开启扫描周期，此设计中，所述主CPU控制单元开启一个新的扫描周期是基于自身本地时钟，从CPU控制单元是基于主CPU控制单元传递的消息同步信号触发；
2)扫描周期开始以后，开始输入采集任务周期：
双CPU控制单元通过CAN总线分别向CAN总线数据交互通道的输入采集单元发出采集命令，输入采集单元将采集到的信息传递给各自CPU控制单元的输入采集映像区中，从CPU控制单元将采集到的信息通过CAN总线数据交互通道发送给主CPU控制单元用于“数据表决”：表决一致，输入采集任务周期结束；
3)主CPU控制单元将再次向从CPU控制单元发起系统同步帧Sync，开启用户程序解析任务周期：
从CPU控制单元在接收到同步帧Sync时，开启逻辑执行任务；
双CPU控制单元将分别独立的按照PLC程序逻辑，调用各自输入采集映像区和元件寄存区的内容进行逻辑计算，将运算结果存储在各自的输出执行映像区中；
从CPU控制单元将运算结果发送给主CPU控制单元用于“数据表决”：表决 一致，用户程序解析周期结束；
4)在用户程序解析周期“数据对决”一致后，主CPU控制单元自动对应执行操作；
5)主CPU控制单元处于等待状态，等待本周期10ms扫描结束，下一次定时器中断触发，重复步骤1)-4)开启下一个10ms的扫描周期。
根据本发明优选的，在所述步骤1)中，通过误差弥补主CPU控制单元向从主CPU控制单元发送系统同步帧Sync时产生的延迟。上述设计中，所述双CPU控制单元在一个任务周期结束下一个任务周期开始的时候，需要进行一个系统同步，由主CPU控制单元通过CAN总线数据交互通道向从CPU控制单元发送一帧具有固定字节数的消息同步帧Sync，消息同步帧Sync从发送到被接收的过程中存在串行发送、硬件接口、媒体访问三部分延时，因此为了保证系统同步，主CPU控制单元在每次发送消息同步帧Sync以后要进行适当延时，需要通过软件算法的方式进行误差弥补。
根据本发明优选的，所述误差弥补方法包括：
1-1)主CPU控制单元向从CPU控制单元发送和同步消息帧Sync具有相同字节数的消息帧Fellow_up，主CPU控制单元基于自己本地时钟记录下发送的时间戳t 1；
1-2)当从CPU控制单元接收到消息帧Fellow_Up以后，基于自己的时钟系统记录下接收到消息帧Fellow_up的时间戳t 2，此时，主CPU控制单元的本地时间戳为t 2a；
1-3)从CPU控制单元接收到消息帧Fellow_up以后，通过CAN总线数据交互通道回复主CPU控制单元同样字节数的延时请求消息帧Delay_Req；同样从CPU控制单元记录下发送该消息帧的时间戳信息为t 3，此时，主CPU控制单元的本地时间戳为t 3a；
1-4)主CPU控制单元接收到从CPU控制单元的延时请求消息帧Delay_Req以后，记录下接收到的延时请求消息帧Delay_Req的时间戳信息为t 4；
1-5)从CPU控制单元向主CPU控制单元再发送延时请求跟随报文Delay_Req_Fellow，所述跟随报文中包含从CPU控制单元记录的时间戳信息t 2和t 3；
1-6)主CPU控制单元根据获取到的时间戳信息t 1、t 2、t 3和t 4计算所述主、从CPU控制单元之间的时延；
主CPU控制单元发送Fellow_up消息帧和从CPU控制单元接收到的时间偏差MS_td，所述MS_td为Master-Slave time difference的简称：
MS_td＝t 2-t 1        (公式1)
Fellow_up消息帧在主从CPU控制单元之间实际传输时延Master-Slave time delay(简称：MS_delay)为
MS_delay＝t 2a-t 1       (公式2)
从CPU控制单元回复Delay_Req消息帧和主CPU控制单元接收到的时间偏差Slave-Master time difference(简称：SM_td)为
SM_td＝t 4-t 3        (公式3)
Delay_Req消息帧在主从CPU控制单元之间实际传输时延Slave-Master time delay，其简称围SM_delay：
SM_delay＝t 4-t 3a        (公式4)
由于双CPU控制单元使用不同的时钟系统，在同一时主、从CPU控制单元之间的实际时钟偏差记做Δt，得
MS_td＝MS_delay+Δt    (公式5)
SM_td＝SM_delay-Δt     (公式6)
将式公式5和式公式6联立得
MS_delay+SM_delay＝MS_td+SM_td      (公式7)
Figure PCTCN2020108574-appb-000001
主控模块之间通过数据交互模块CAN总线实现数据传输，并且使用的是同一个数据交互通道，因此认为固定字节数据从主CPU发送到从CPU和从从CPU到主CPU的时延是一致的记做t d，可得
t d＝MS_delay＝SM_delay         (公式9)
将公式1、公式3、公式7、公式8和公式9进行联立计算，得：
Figure PCTCN2020108574-appb-000002
Figure PCTCN2020108574-appb-000003
由于双CPU控制单元不需要进行时钟同步，因此只需要在主CPU控制单元每次发送完消息同步帧Sync以后进行时间为t d的延时。
为了保障时延偏差计算精度，双CPU控制单元会每隔一段时间，调用一次时延偏差弥补算法重新计算延时t d，来不断的进行时延偏差调整。
一种基于双通道安全PLC的数据表决方法，所述主、从CPU控制单元分别从输入冗余模块获取采集到的外部信息，并将采集到的外部信息存储在各自的输入采集映像区InputImage[]中；从CPU控制单元将采集到的数据经过数据交互通道发送给主CPU控制单元，并与主CPU控制单元的输入采集映像区InputImage[]中的数据进行表决；
其特征在于，所述数据表决方法包括：
6)如数据表决一致，则认为输入采集数据为安全数据：
6-1)此时数据表决错误标志位置为0，表明未发生数据表决不一致的情况；
6-2)主CPU控制单元返回给从CPU控制单元一个数据表决一致的确认信号；
6-3)数据表决一致，输入采集任务周期完成；
6-4)主CPU控制单元向从CPU控制单元发出系统同步帧Sync，在系统同步以后，将开启下一个任务周期；
7)如数据表决不一致时，处理方法如下：
当发生第一次数据表决不一致时，不直接进行故障处理，主CPU控制单元返回给从CPU控制单元一个数据表决不一致信号，主、从CPU控制单元均将本次采集的数据从输入采集映像区InputImage[]中擦除掉，同时将数据表决错误标志位置设置为1；
双CPU控制单元在系统同步以后，再次发出一次输入信息采集命令：
如当前周期中，所述主CPU控制单元采集结果与从CPU控制单元采集结果一致时，则认为前一周期中数据表决不一致的原因是偶发性的原因，导致出现系统 误判；
如当前周期中，所述主CPU控制单元采集结果与从CPU控制单元采集结果依然不一致时，则认为系统故障。
根据本发明优选的，当认为前一周期中数据表决不一致的原因是偶发性的原因时，数据表决错误标志位重新置位为0，系统继续向下运行。
根据本发明优选的，所述前一周期为第一周期，所述当前周期为第二周期，所述系统故障是指进行故障报警提示发生“数据表决错误”，且所述主CPU控制单元便执行系统内置安全输出，同时系统将进行停机操作保障安全。
本发明的技术优势在于：
1)本发明所述基于双通道安全PLC的同步控制方法，采用合理高效软件机制来实现，既能保障系统安全稳定运行，又能尽可能的避免性能损失。同步过程采用定期时延偏差校准的方法，既提高了实验偏差的计算精度，又提高了整个控制系统的工作效率。
2)本发明提出的数据表决方法提高了系统可用性，解决了控制系统由于误判导致的跳闸率(FTR)较高问题。
附图说明
图1是本发明中主、从CPU控制单元同步建立流程图；
图2是本发明中系统同步的流程图；
图3是本发明中软件误差弥补方法对应的算法示意图；
图4是本发明中数据表决方法的流程图。
具体实施方式
下面结合实施例和说明书附图对本发明做详细的说明，但不限于此。
实施例1、
如图1所示，一种基于双通道安全PLC的同步控制方法，其中安全PLC中包括主控模块，所述主控模块包括两个CPU控制单元；
所述基于双通道安全PLC的同步控制方法包括主、从CPU控制单元同步建立 方法，包括：
两个所述CPU控制单元具有向对方优先获取到CAN总线数据交互通道发送数据的权利，该权利的获得规则为：先完成上电初始化的CPU控制单元优先向另一CPU控制单元发送主控制单元请求帧，进而通过CAN总线数据交互通道发送数据；
先完成上电初始化的CPU控制单元为主CPU控制单元，另一CPU控制单元为从CPU控制单元；
主、从控制单元确认完毕后进行系统同步建立。
具体为：所述主控模块包括两个CPU控制单元包括CPUa和CPUb。
当CPUa完成上电初始化以后，如判断未收到CPUb发送的主控制单元请求帧，同时CPUa监测到数据交互通道CAN总线处于空闲状态，则立即向CPUb发送主控制单元请求帧；
CPUb收到上述主控制单元请求帧以后回复同意确认帧；
当CPUa收到CPUb回复的确认帧以后，将自身置为主CPU控制单元，享有系统的执行控制权：对输出冗余模块发送执行结果；同时CPUb当收到CPUa的主请求帧时，默认将自身置为从CPU控制单元，不享有系统的执行控制权。
实施例2、
如图2所示，如实施例1所述的一种基于双通道安全PLC的同步控制方法，所述主、从控制单元确认完毕后进行系统同步建立的方法，包括：
1)主CPU控制单元向从主CPU控制单元通过两者之间的CAN总线数据交互通道发送一帧具有固定字节数据的系统同步帧Sync；
同时主CPU控制单元基于本地时钟系统触发定时器中断，开始扫描周期计时，时间为10ms；
从CPU控制单元在收到主CPU控制单元发送的系统同步帧Sync时开启扫描周期；
2)扫描周期开始以后，开始输入采集任务周期：
双CPU控制单元通过CAN总线分别向CAN总线数据交互通道的输入采集单元发出采集命令，输入采集单元将采集到的信息传递给各自CPU控制单元的输入采集映像区中，从CPU控制单元将采集到的信息通过CAN总线数据交互通道发送给 主CPU控制单元用于“数据表决”：表决一致，输入采集任务周期结束；
3)主CPU控制单元将再次向从CPU控制单元发起系统同步帧Sync，开启用户程序解析任务周期：
从CPU控制单元在接收到同步帧Sync时，开启逻辑执行任务；
双CPU控制单元将分别独立的按照PLC程序逻辑，调用各自输入采集映像区和元件寄存区的内容进行逻辑计算，将运算结果存储在各自的输出执行映像区中；
从CPU控制单元将运算结果发送给主CPU控制单元用于“数据表决”：表决一致，用户程序解析周期结束；
4)由于主CPU控制单元享有输出执行控制权能够将自身输出执行映像区中的数据发送给本通道的输出执行单元，从CPU控制单元则不进行此项操作，因此在用户程序解析周期“数据对决”一致后，主CPU控制单元自动对应执行操作；
5)主CPU控制单元处于等待状态，等待本周期10ms扫描结束，下一次定时器中断触发，重复步骤1)-4)开启下一个10ms的扫描周期。
实施例3、
如图3所示，如实施例2所述的一种基于双通道安全PLC的同步控制方法，在所述步骤1)中，通过误差弥补主CPU控制单元向从主CPU控制单元发送系统同步帧Sync时产生的延迟。
所述误差弥补方法包括：
1-1)主CPU控制单元向从CPU控制单元发送和同步消息帧Sync具有相同字节数的消息帧Fellow_up，主CPU控制单元基于自己本地时钟记录下发送的时间戳t 1；
1-2)当从CPU控制单元接收到消息帧Fellow_Up以后，基于自己的时钟系统记录下接收到消息帧Fellow_up的时间戳t 2，此时，主CPU控制单元的本地时间戳为t 2a；
1-3)从CPU控制单元接收到消息帧Fellow_up以后，通过CAN总线数据交互通道回复主CPU控制单元同样字节数的延时请求消息帧Delay_Req；同样从CPU控制单元记录下发送该消息帧的时间戳信息为t 3，此时，主CPU控制单元的本地时间戳为t 3a；
1-4)主CPU控制单元接收到从CPU控制单元的延时请求消息帧Delay_Req以后，记录下接收到的延时请求消息帧Delay_Req的时间戳信息为t 4；
1-5)从CPU控制单元向主CPU控制单元再发送延时请求跟随报文Delay_Req_Fellow，所述跟随报文中包含从CPU控制单元记录的时间戳信息t 2和t 3；
1-6)主CPU控制单元根据获取到的时间戳信息t 1、t 2、t 3和t 4计算所述主、从CPU控制单元之间的时延；
主CPU控制单元发送Fellow_up消息帧和从CPU控制单元接收到的时间偏差MS_td，所述MS_td为Master-Slave time difference的简称：
MS_td＝t 2-t 1                      (公式1)
Fellow_up消息帧在主从CPU控制单元之间实际传输时延Master-Slave time delay(简称：MS_delay)为
MS_delay＝t 2a-t 1                      (公式2)
从CPU控制单元回复Delay_Req消息帧和主CPU控制单元接收到的时间偏差Slave-Master time difference(简称：SM_td)为
SM_td＝t 4-t 3                      (公式3)
Delay_Req消息帧在主从CPU控制单元之间实际传输时延Slave-Master time delay，其简称围SM_delay：
SM_delay＝t 4-t 3a                      (公式4)
由于双CPU控制单元使用不同的时钟系统，在同一时主、从CPU控制单元之间的实际时钟偏差记做Δt，得
MS_td＝MS_delay+Δt                 (公式5)
SM_td＝SM_delay-Δt                 (公式6)
将式公式5和式公式6联立得
MS_delay+SM_delay＝MS_td+SM_td            (公式7)
Figure PCTCN2020108574-appb-000004
主控模块之间通过数据交互模块CAN总线实现数据传输，并且使用的是同一个数据交互通道，因此认为固定字节数据从主CPU发送到从CPU和从从CPU到主 CPU的时延是一致的记做t d，可得
t d＝MS_delay＝SM_delay                  (公式9)
将公式1、公式3、公式7、公式8和公式9进行联立计算，得：
Figure PCTCN2020108574-appb-000005
Figure PCTCN2020108574-appb-000006
由于双CPU控制单元不需要进行时钟同步，因此只需要在主CPU控制单元每次发送完消息同步帧Sync以后进行时间为t d的延时。
为了保障时延偏差计算精度，双CPU控制单元会每隔一段时间，调用一次时延偏差弥补算法重新计算延时t d，来不断的进行时延偏差调整。
实施例4、
如图4所示。一种基于双通道安全PLC的数据表决方法，所述主、从CPU控制单元分别从输入冗余模块获取采集到的外部信息，并将采集到的外部信息存储在各自的输入采集映像区InputImage[]中；从CPU控制单元将采集到的数据经过数据交互通道发送给主CPU控制单元，并与主CPU控制单元的输入采集映像区InputImage[]中的数据进行表决；
所述数据表决方法包括：
7)如数据表决一致，则认为输入采集数据为安全数据：
6-1)此时数据表决错误标志位置为0，表明未发生数据表决不一致的情况；
6-2)主CPU控制单元返回给从CPU控制单元一个数据表决一致的确认信号；
6-3)数据表决一致，输入采集任务周期完成；
6-4)主CPU控制单元向从CPU控制单元发出系统同步帧Sync，在系统同步以后，将开启下一个任务周期；
7)如数据表决不一致时，处理方法如下：
当发生第一次数据表决不一致时，不直接进行故障处理，主CPU控制单元返回给从CPU控制单元一个数据表决不一致信号，主、从CPU控制单元均将本次采 集的数据从输入采集映像区InputImage[]中擦除掉，同时将数据表决错误标志位置设置为1；
双CPU控制单元在系统同步以后，再次发出一次输入信息采集命令，则系统可能会出现以下几种采集结果如表1所示：
表1可能出现采集结果表
Figure PCTCN2020108574-appb-000007
如当前周期中，所述主CPU采集结果与从CPU采集结果一致时，则认为前一周期中数据表决不一致的原因是偶发性的原因，导致出现系统误判；
如当前周期中，所述主CPU采集结果与从CPU采集结果依然不一致时，则认为系统故障，认为是系统故障可能性大于系统误判，系统在一定系统宽裕时间无法进行了自我纠正。
当认为前一周期中数据表决不一致的原因是偶发性的原因时，通过一定系统宽裕时间进行了自我纠正，系统误判可能性大于系统故障，数据表决错误标志位重新置位为0，系统继续向下运行。
所述前一周期为第一周期，所述当前周期为第二周期，连续两次发生“数据表决”不一致，表明系统在一定宽裕时间难以进行了自我纠正，发生这种情况时十分危险的，因为系统无法判断哪个是正确的安全数据，所述系统故障是指进行故障报警提示发生“数据表决错误”，且所述主CPU控制单元便执行系统内置安全输出，同时系统将进行停机操作保障安全。

Claims (7)

  1. 一种基于双通道安全PLC的同步控制方法，其特征在于，其中安全PLC中包括主控模块，所述主控模块包括两个CPU控制单元；
    所述基于双通道安全PLC的同步控制方法包括主、从CPU控制单元同步建立方法，包括：
    两个所述CPU控制单元具有向对方优先获取到CAN总线数据交互通道发送数据的权利，该权利的获得规则为：先完成上电初始化的CPU控制单元优先向另一CPU控制单元发送主控制单元请求帧，进而通过CAN总线数据交互通道发送数据；
    先完成上电初始化的CPU控制单元为主CPU控制单元，另一CPU控制单元为从CPU控制单元；
    主、从控制单元确认完毕后进行系统同步建立。
  2. 根据权利要求1所述的一种基于双通道安全PLC的同步控制方法，其特征在于，所述主、从控制单元确认完毕后进行系统同步建立的方法，包括：
    1)主CPU控制单元向从主CPU控制单元通过两者之间的CAN总线数据交互通道发送一帧具有固定字节数据的系统同步帧Sync；
    同时主CPU控制单元基于本地时钟系统触发定时器中断，开始扫描周期计时，时间为10ms；
    从CPU控制单元在收到主CPU控制单元发送的系统同步帧Sync时开启扫描周期，此设计中，所述主CPU控制单元开启一个新的扫描周期是基于自身本地时钟，从CPU控制单元是基于主CPU控制单元传递的消息同步信号触发；
    2)扫描周期开始以后，开始输入采集任务周期：
    双CPU控制单元通过CAN总线分别向CAN总线数据交互通道的输入采集单元发出采集命令，输入采集单元将采集到的信息传递给各自CPU控制单元的输入采集映像区中，从CPU控制单元将采集到的信息通过CAN总线数据交互通道发送给主CPU控制单元用于“数据表决”：表决一致，输入采集任务周期结束；
    3)主CPU控制单元将再次向从CPU控制单元发起系统同步帧Sync，开启用户程序解析任务周期：
    从CPU控制单元在接收到同步帧Sync时，开启逻辑执行任务；
    双CPU控制单元将分别独立的按照PLC程序逻辑，调用各自输入采集映像区和元件寄存区的内容进行逻辑计算，将运算结果存储在各自的输出执行映像区中；
    从CPU控制单元将运算结果发送给主CPU控制单元用于“数据表决”：表决一致，用户程序解析周期结束；
    4)在用户程序解析周期“数据对决”一致后，主CPU控制单元自动对应执行操作；
    5)主CPU控制单元处于等待状态，等待本周期10ms扫描结束，下一次定时器中断触发，重复步骤1)-4)开启下一个10ms的扫描周期。
  3. 根据权利要求2所述的一种基于双通道安全PLC的同步控制方法，其特征在于，在所述步骤1)中，通过误差弥补主CPU控制单元向从主CPU控制单元发送系统同步帧Sync时产生的延迟；主CPU控制单元在每次发送消息同步帧Sync以后进行适当延时，通过软件算法的方式进行误差弥补。
  4. 根据权利要求3所述的一种基于双通道安全PLC的同步控制方法，其特征在于，所述误差弥补方法包括：
    1-1)主CPU控制单元向从CPU控制单元发送和同步消息帧Sync具有相同字节数的消息帧Fellow_up，主CPU控制单元基于自己本地时钟记录下发送的时间戳t 1；
    1-2)当从CPU控制单元接收到消息帧Fellow_Up以后，基于自己的时钟系统记录下接收到消息帧Fellow_up的时间戳t 2，此时，主CPU控制单元的本地时间戳为t 2a；
    1-3)从CPU控制单元接收到消息帧Fellow_up以后，通过CAN总线数据交互通道回复主CPU控制单元同样字节数的延时请求消息帧Delay_Req；同样从CPU控制单元记录下发送该消息帧的时间戳信息为t 3，此时，主CPU控制单元的本地时间戳为t 3a；
    1-4)主CPU控制单元接收到从CPU控制单元的延时请求消息帧Delay_Req以后，记录下接收到的延时请求消息帧Delay_Req的时间戳信息为t 4；
    1-5)从CPU控制单元向主CPU控制单元再发送延时请求跟随报文Delay_Req_Fellow，所述跟随报文中包含从CPU控制单元记录的时间戳信息t 2和t 3；
    1-6)主CPU控制单元根据获取到的时间戳信息t 1、t 2、t 3和t 4计算所述主、 从CPU控制单元之间的时延；
    主CPU控制单元发送Fellow_up消息帧和从CPU控制单元接收到的时间偏差MS_td，所述MS_td为Master-Slave time difference的简称：
    MS_td＝t 2-t 1  (公式1)
    Fellow_up消息帧在主从CPU控制单元之间实际传输时延Master-Slave time delay(简称：MS_delay)为
    MS_delay＝t 2a-t 1  (公式2)
    从CPU控制单元回复Delay_Req消息帧和主CPU控制单元接收到的时间偏差Slave-Master time difference(简称：SM_td)为
    SM_td＝t 4-t 3  (公式3)
    Delay_Req消息帧在主从CPU控制单元之间实际传输时延Slave-Master time delay，其简称围SM_delay：
    SM_delay＝t 4-t 3a  (公式4)
    由于双CPU控制单元使用不同的时钟系统，在同一时主、从CPU控制单元之间的实际时钟偏差记做Δt，得
    MS_td＝MS_delay+Δt  (公式5)
    SM_td＝SM_delay-Δt  (公式6)
    将式公式5和式公式6联立得
    MS_delay+SM_delay＝MS_td+SM_td  (公式7)
    Figure PCTCN2020108574-appb-100001
    主控模块之间通过数据交互模块CAN总线实现数据传输，并且使用的是同一个数据交互通道，因此认为固定字节数据从主CPU发送到从CPU和从从CPU到主CPU的时延是一致的记做t d，可得
    t d＝MS_delay＝SM_delay  (公式9)
    将公式1、公式3、公式7、公式8和公式9进行联立计算，得：
    Figure PCTCN2020108574-appb-100002
    Figure PCTCN2020108574-appb-100003
    由于双CPU控制单元不需要进行时钟同步，因此只需要在主CPU控制单元每次发送完消息同步帧Sync以后进行时间为t d的延时。
  5. 一种基于双通道安全PLC的数据表决方法，所述主、从CPU控制单元分别从输入冗余模块获取采集到的外部信息，并将采集到的外部信息存储在各自的输入采集映像区InputImage[]中；从CPU控制单元将采集到的数据经过数据交互通道发送给主CPU控制单元，并与主CPU控制单元的输入采集映像区InputImage[]中的数据进行表决；
    其特征在于，所述数据表决方法包括：
    6)如数据表决一致，则认为输入采集数据为安全数据：
    6-1)此时数据表决错误标志位置为0，表明未发生数据表决不一致的情况；
    6-2)主CPU控制单元返回给从CPU控制单元一个数据表决一致的确认信号；
    6-3)数据表决一致，输入采集任务周期完成；
    6-4)主CPU控制单元向从CPU控制单元发出系统同步帧Sync，在系统同步以后，将开启下一个任务周期；
    7)如数据表决不一致时，处理方法如下：
    当发生第一次数据表决不一致时，主CPU控制单元返回给从CPU控制单元一个数据表决不一致信号，主、从CPU控制单元均将本次采集的数据从输入采集映像区InputImage[]中擦除掉，同时将数据表决错误标志位置设置为1；
    双CPU控制单元在系统同步以后，再次发出一次输入信息采集命令：
    如当前周期中，所述主CPU控制单元采集结果与从CPU控制单元采集结果一致时，则认为前一周期中数据表决不一致的原因是偶发性的原因，导致出现系统误判；
    如当前周期中，所述主CPU控制单元采集结果与从CPU控制单元采集结果依然不一致时，则认为系统故障。
  6. 根据权利要求5所述的一种基于双通道安全PLC的数据表决方法，其特征在于，当认为前一周期中数据表决不一致的原因是偶发性的原因时，数据表决错误标志位重新置位为0，系统继续向下运行。
  7. 根据权利要求5或6所述的一种基于双通道安全PLC的数据表决方法，其特征在于，所述前一周期为第一周期，所述当前周期为第二周期，所述系统故障是指进行故障报警提示发生“数据表决错误”，且所述主CPU控制单元便执行系统内置安全输出，同时系统将进行停机操作保障安全。
PCT/CN2020/108574 2020-06-16 2020-08-12 一种基于双通道安全plc的同步控制及数据表决方法 WO2021253596A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010550207.1 2020-06-16
CN202010550207.1A CN111708296A (zh) 2020-06-16 2020-06-16 一种基于双通道安全plc的同步控制及数据表决方法

Publications (1)

Publication Number Publication Date
WO2021253596A1 true WO2021253596A1 (zh) 2021-12-23

Family

ID=72540798

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/108574 WO2021253596A1 (zh) 2020-06-16 2020-08-12 一种基于双通道安全plc的同步控制及数据表决方法

Country Status (2)

Country Link
CN (1) CN111708296A (zh)
WO (1) WO2021253596A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116800545A (zh) * 2023-08-24 2023-09-22 天津致新轨道交通运营有限公司 一种地铁通讯数据传输方法及系统

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112379981A (zh) * 2020-11-12 2021-02-19 中国人民解放军海军工程大学 面向分布式实时仿真任务的无锁同步方法
CN114115091B (zh) * 2021-01-12 2024-05-17 无锡信捷电气股份有限公司 Plc基于时间同步及有限数据元交互的数据冗余方法
CN113225151B (zh) * 2021-04-19 2023-08-25 杭州康吉森自动化科技有限公司 一种基于can总线的时钟同步系统、方法和装置
CN116880339B (zh) * 2023-09-07 2023-11-28 北京控达科技有限公司 基于双mcu的数据周期同步方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110161538A1 (en) * 2009-12-31 2011-06-30 Schneider Electric USA, Inc. Method and System for Implementing Redundant Network Interface Modules in a Distributed I/O System
CN102636988A (zh) * 2012-04-13 2012-08-15 山东省计算中心 一种基于plc的冗余系统实现方法
CN104898620A (zh) * 2015-05-19 2015-09-09 西安晨宇环境工程有限公司 一种基于以太网的冗余控制系统及控制方法
KR20190107786A (ko) * 2018-03-13 2019-09-23 엘에스산전 주식회사 Ｐｌｃ시스템의 유닛 증설방법

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1099638C (zh) * 2000-06-07 2003-01-22 北京和利时系统工程股份有限公司 一种实现计算机系统容错的方法
CN101997671B (zh) * 2010-11-25 2014-12-10 中兴通讯股份有限公司 一种主从时钟设备的时钟同步方法及系统
CN102103532B (zh) * 2011-01-26 2013-08-14 中国铁道科学研究院通信信号研究所 列控车载设备的安全冗余计算机系统
CN102833062B (zh) * 2012-09-25 2015-08-12 广东电网公司珠海供电局 智能变电站ieee1588主从时钟同步报文对时方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110161538A1 (en) * 2009-12-31 2011-06-30 Schneider Electric USA, Inc. Method and System for Implementing Redundant Network Interface Modules in a Distributed I/O System
CN102636988A (zh) * 2012-04-13 2012-08-15 山东省计算中心 一种基于plc的冗余系统实现方法
CN104898620A (zh) * 2015-05-19 2015-09-09 西安晨宇环境工程有限公司 一种基于以太网的冗余控制系统及控制方法
KR20190107786A (ko) * 2018-03-13 2019-09-23 엘에스산전 주식회사 Ｐｌｃ시스템의 유닛 증설방법

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HU WEN, XU CLOTH WORKER: "Implementation of a PLC Expansion Board Addressing Method", MANUFACTURING AUTOMATION, BEIJING INSTITUTE OF MACHINERY INDUSTRY AUTOMATION, MINISTRY OF MACHINERY, CN, vol. 25, no. 11, 30 November 2003 (2003-11-30), CN , pages 36 - 38, XP055881394, ISSN: 1009-0134 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116800545A (zh) * 2023-08-24 2023-09-22 天津致新轨道交通运营有限公司 一种地铁通讯数据传输方法及系统
CN116800545B (zh) * 2023-08-24 2023-10-20 天津致新轨道交通运营有限公司 一种地铁通讯数据传输方法及系统

Also Published As

Publication number Publication date
CN111708296A (zh) 2020-09-25

Similar Documents

Publication Publication Date Title
WO2021253596A1 (zh) 一种基于双通道安全plc的同步控制及数据表决方法
CN103377083B (zh) 用于运行冗余的自动化系统的方法
JP5080448B2 (ja) ２つのバスシステムを同期する方法および装置、並びに２つのバスシステムから成る構成
US7549072B2 (en) Method and device for synchronizing the global time of a plurality of buses and a corresponding bus system
CN103580770B (zh) 测量带有独立硅时钟的设备之间的时间偏差
JP5891086B2 (ja) 通信制御システム、通信制御装置、および被制御装置
CN108279597A (zh) 一种基于有限状态机的计算机联锁平台控制方法
CN105471622A (zh) 一种基于Galera的控制节点主备切换的高可用方法及系统
WO2019011063A1 (zh) 二乘二取二系统同步方法及计算机设备
CN102891762A (zh) 连续处理网络数据的系统及方法
CN109471588A (zh) 一种同步方法及设备
CN113791937B (zh) 一种数据同步冗余系统及其控制方法
CN109306875B (zh) 一种汽轮机deh双控制器同步热备冗余切换装置及方法
JP2004038785A (ja) 統合シミュレーションシステム及びプログラム
CN101588266B (zh) 一种热备份冗余系统的通讯与同步数据交互方法
JPS6057082B2 (ja) 複数の計算機間の同期方法
CN112118305B (zh) 一种减少区块链共识系统中无效请求的方法
CN106712887A (zh) 一种基于网络时钟协议的主从双机状态同步方法
CN106656437A (zh) 冗余热备平台
JP3166552B2 (ja) Ｃｐｕ監視方法及びｃｐｕ監視装置
JPH0462081B2 (zh)
CN107710165A (zh) 用于存储节点同步业务请求的方法和装置
JPH0736720A (ja) 二重化コンピュータ装置
JP2000148563A (ja) 複数サーバ計算機システム
CN116157786A (zh) 同步数据处理方法及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20940989

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20940989

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 20940989

Country of ref document: EP

Kind code of ref document: A1