WO2024011906A1 - 一种主从冗余控制系统及控制方法 - Google Patents

一种主从冗余控制系统及控制方法 Download PDF

Info

Publication number
WO2024011906A1
WO2024011906A1 PCT/CN2023/077134 CN2023077134W WO2024011906A1 WO 2024011906 A1 WO2024011906 A1 WO 2024011906A1 CN 2023077134 W CN2023077134 W CN 2023077134W WO 2024011906 A1 WO2024011906 A1 WO 2024011906A1
Authority
WO
WIPO (PCT)
Prior art keywords
status
controller
master
redundancy
processor
Prior art date
Application number
PCT/CN2023/077134
Other languages
English (en)
French (fr)
Inventor
辛克廷
刘铭皓
祖利辉
陈闯
Original Assignee
南京科远智慧科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 南京科远智慧科技集团股份有限公司 filed Critical 南京科远智慧科技集团股份有限公司
Publication of WO2024011906A1 publication Critical patent/WO2024011906A1/zh

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B9/00—Safety arrangements
    • G05B9/02—Safety arrangements electric
    • G05B9/03—Safety arrangements electric with multiple-channel loop, i.e. redundant control systems
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

  • This application relates to a method of redundant communication and master-slave switching applied to a master-slave redundant control system.
  • controller hot standby redundancy to improve the reliability of the entire system.
  • the control system adopts controller redundancy, module redundancy, communication link redundancy, power supply redundancy, network equipment redundancy and other methods to improve the reliability of the system.
  • controller redundancy means that two or more redundant controllers need to control data synchronization and master-slave control switching.
  • the master controller In the event of failure, the master controller must switch to the slave controller in time and serve as a redundant controller.
  • the backup slave controller must be switched to the master controller in time.
  • the main methods currently used are: 1. Redundant switching circuit composed of hardware circuits.
  • the main advantage of this method is that the circuit is simple and reliable.
  • the disadvantage is poor scalability.
  • the information for the master-slave switching of the controller is simple and cannot be added according to the expansion of the system.
  • Judgment logic of redundant switching 2.
  • the advantages of this method are simple circuit and scalable communication information.
  • the disadvantage is that the real-time performance is poor, especially as the load of the controller increases. , the cycle of redundant communication is uncertain, there is switching cycle jitter, and it is difficult to achieve microsecond-level master-slave switching; 3.
  • Use dedicated logic devices to build communication links. This method combines the advantages of the above solutions and is scalable.
  • the circuit is simplified, the communication data can be verified, the real-time performance is high, the communication cycle reaches the microsecond level, the switching jitter is small, the controller compliance is reduced, and the redundant switching cycle does not increase as the load of the controller increases. It is suitable for use in some fast applications. Applications for bumpless switching.
  • This application is to reduce the master-slave switching cycle of the hot standby redundant controller, reduce the jitter of the switching cycle, decouple the redundant switching process from the load of the controller, increase the verification of communication data, thereby improving the redundancy rate.
  • the redundant switching cycle reaches microsecond level accuracy, which makes the control system more suitable for different industrial applications.
  • a master-slave redundant control system including two controllers that can perform master-slave switching according to the working status; one controller works in the master status, and the other controller works in the slave status as a redundant backup, and performs switching according to the working status. Master-slave switching.
  • Each controller includes:
  • Processor implements the control logic of the master-slave controller
  • the communication interface serves as the transmission interface for the controller’s synchronization status messages
  • the Ethernet interface serves as the transmission interface for the controller's synchronous data messages
  • Logic device implements master-slave switching and master-slave synchronization logic transceiver control.
  • Logic devices use programmable logic devices to build redundant switching links.
  • the main purpose is to solve the problem of the controller directly participating in building communication links for redundant switching.
  • the direct communication link method of the controller whether it is the periodic query method or the interrupt method, will increase the load of the controller.
  • the peripheral control logic of the controller increases, the cycle of redundancy switching will also increase, and the redundancy switching period will also increase.
  • the switching jitter will also increase.
  • Programmable logic devices can achieve efficient communication between master and slave controllers without the participation of the controller, and will not increase the redundant switching cycle as the controller load increases.
  • the switching jitter is small, and the communication scalability is at the same time. High, after adding communication data verification, communication reliability increases, and the redundancy switching cycle can reach microsecond level.
  • redundant hot standby controllers distribute and transmit redundant switching messages and redundant data messages through communication interfaces and Ethernet interfaces to ensure the real-time nature of redundant switching.
  • the processor provides an SPI interface to communicate with the logic device.
  • the SPI interface provided by the processor implements bidirectional data transmission and reception, including writing and reading status information to the logic device.
  • the SPI interface provided by the processor only implements the writing and reading of the master-slave switching logic.
  • the processor writes the status of the local machine during the control cycle.
  • the processor reads the redundant status through interrupts. Interrupts can reduce the load on the processor and increase the speed at which the processor obtains the redundant status. .
  • the processor's acquisition of redundancy status not only supports interrupt mode, but the full-duplex communication method of SPI also supports acquisition of redundancy status while the processor is delivering local status.
  • logic devices include:
  • the SPI interface connected to the processor, receives the local status information sent by the processor and updates it to the local status. At the same time, it responds to the processor's command to read the redundant status and sends the redundant status to the processor;
  • the serial transceiver module includes serial transmission and serial reception to form full-duplex communication of the serial transceiver module. This module sends the local status and receives the redundant status at the same time;
  • the redundancy status change module issues an interrupt to the processor when a redundancy status change is detected.
  • This application uses a redundant state changing module to reduce the load of the processor and improve the speed of the processor acquiring the redundant state.
  • the serial receiving module is used to transmit and receive data, which does not occupy the processing time of the processor. It sends the local machine status to the redundant controller in a calculable time and cycle, and at the same time obtains the status of the redundant controller to the local machine.
  • the serial transceiver module constructs a communication message. The message sent by the serial sending module contains the local status and verification information; at the same time, the serial receiving module receives the message and needs to verify the received message. If the message has no errors, the redundant information is updated. In the redundant state, an error mark is sent to the processor in the event of a message verification error.
  • This application also provides a master-slave redundancy control method, which adopts the following redundancy switching logic: the processor sends the local status to the logic device according to the status of the controller, and the logic device obtains the local status, adds verification information, and fixes Messages are sent within the cycle; the logic device receives the message at the same time, verifies the received message data, updates the redundancy status if there are no errors in the verification message, and detects a change in the redundancy status. Send an interrupt to the processor, and the processor reads the redundancy status; the logic device sends an error flag to the processor in case of error in the verification message.
  • the logical control message of the redundant switching is transmitted in the communication interface, and the interface only transmits the message of the redundant switching, thereby improving the real-time performance of the redundant switching.
  • the processor does not directly participate in the sending and receiving of data, so the level of processor load does not affect the data sending and receiving cycle. This method solves the jitter of the redundant switching cycle caused by different processor loads.
  • the master-slave redundancy control method includes the following steps:
  • the processor sends the local status to the SPI interface of the logic device according to the status cycle of the controller;
  • serial sending module After the serial sending module obtains the local status, it adds CRC8 check information and sends the message;
  • Communication interface receives status messages sent by the redundant controller
  • the redundancy status change module updates the redundancy status based on the reception of status messages from the redundant controller; when the redundancy status changes, it sends an interrupt to the processor;
  • the processor reads the redundancy status in an interrupt manner. After the reading is completed, the redundancy status change module clears the interrupt and proceeds to the next monitoring redundancy status cycle.
  • the master-slave redundancy control method also uses the Ethernet interface to send and receive control data messages between the master and slave controllers.
  • This Ethernet interface is mainly used as a communication interface for redundant switching data messages, and its main function is to synchronize control data between the master controller and the slave controller.
  • the communication interface does not receive the status message sent by the redundant controller within a communication cycle, it is judged that the redundant controller does not exist, the redundant status is cleared, and the processor is notified, and the local controller enters a single machine. Running state. In this state, it continues to wait for the message data received by the communication interface. When the data is received, it exits the stand-alone mode; when the communication interface receives the status message sent by the redundant controller, there is no error after data verification. , update the redundancy status, and the control system enters the dual-machine redundancy control state.
  • the redundant hot standby controllers in the control system of this application transmit redundant switching messages and redundant data messages respectively through the communication interface and the Ethernet interface to ensure the real-time nature of the redundant switching.
  • programmable logic devices are used to send and receive redundant switching messages, and the length of redundant switching messages can be extended.
  • the messages include network diagnostic information, power supply diagnostic information, and modules of the controller. Diagnostic information allows the controller to support more complex redundancy switching logic, and adds verification information to messages to make communication more reliable.
  • the logic device transmits the redundant switching message, and the processor does not participate in the sending and receiving of the message.
  • the logic device sends an interrupt to the processor after detecting the status change, which reduces the load of the processor.
  • the logic device sends messages at a fixed period, which reduces the switching jitter of the redundant controller.
  • the communication cycle of the entire redundancy switching message is 7.52us, the message processing cycle is within 50us, and the redundancy switching cycle is within 100us.
  • the redundancy switching speed is increased by 10 times. above.
  • Figure 1 shows the topology of the control system according to the embodiment of this application.
  • Figure 2 is a block diagram of a redundant switching module of a controller according to an embodiment of the present application.
  • Figure 3 is a state machine jump diagram of a logic device in this embodiment of the application.
  • This embodiment provides a method for redundant communication and redundant switching applied to a master-slave redundant control system.
  • the method is applied to master-slave synchronization and master-slave switching between redundant controllers.
  • the main purpose is to achieve fast switching of the master-slave controller, reduce the cycle jitter of the master-slave switching, and at the same time make the master-slave switching feature scalability and high reliability.
  • the state transition control of the master-slave controller is realized through programmable logic devices, which solves the problem of switching speed changes caused by the direct redundant switching of the CPU, reduces the impact of the controller communication cycle on the redundant switching cycle, and also reduces the Controller switching cycle jitter.
  • the master and slave controllers send the status of the slave controller to the master controller in the form of messages within a fixed period, and at the same time send the status of the master controller to the slave controller.
  • the message contains the status of the master and slave controllers. and data verification information.
  • the communication messages are sent and received by programmable logic devices in the form of messages, which solves the scalability problem of master-slave switching caused by fixed connection lines. At the same time, verification information can be added to ensure the reliability of communication.
  • the system in this embodiment includes two identical controllers 1 and 2.
  • the controller 1 and the controller 2 serve as redundant backups for each other.
  • One of the controllers 1 or 2 works as the master.
  • the controller status is responsible for the processing of the entire control logic, communication of monitoring equipment, and control of field equipment.
  • it actively transmits control data to the redundant controller through the Ethernet interface 14.
  • the other controller is in the redundant backup state and receives the main
  • the control data sent by the controller through the Ethernet interface 14 is completely synchronized with the main controller.
  • Two processing logics are generated under the condition that the master controller sends a fault.
  • the master controller actively sends the fault information of the master controller to the slave controller through the communication interface 13, and the slave controller switches the local machine to the master controller.
  • the state transition message will be sent to switch the master controller to the slave controller; in another case, the master controller fails and cannot send the status message, and the slave control will send the status message to the master controller through the communication interface 13 within the time , does not receive the status message sent by the main controller, determines that the main controller is offline, and actively switches from the slave controller to the main controller.
  • the logic device 12 is responsible for the implementation of the data link layer of redundant data communication and redundant status communication, connects the communication interface 13 and the Ethernet interface 14 for external communication, and connects the processor 11 for internal communication to decouple internal communication and external communication. , to prevent the increased load on the processor 11 from affecting the redundant data communication and redundant status communication cycles, and at the same time to prevent external data communication from increasing the load on the processor 11 .
  • the logic device actively sends and receives redundant status data without the participation of the processor 11, receives status information sent by the processor 11, and actively sends status information to the processor 11 when the redundant status changes.
  • the processor 11 includes a peripheral that can be used as an SPI master device.
  • SPI can support full-duplex communication, and a single byte has a communication cycle under a 25MHz clock. is 320ns, and the interface can receive redundant status 124 while sending native status 123.
  • the processor 11 periodically sends the local status 123 to the SPI 121 of the logic device 12 through the SPI peripheral according to the status of the controller (network status, power status, device communication status, etc.). Due to the full-duplex communication mode of SPI 121, The processor 11 can receive the redundancy status 124 while sending. This method is that the processor 11 actively queries the redundancy status 124 when the redundancy status 124 does not change. At the same time, the processor 11 supports the redundancy status 124 in the redundancy status. When 124 changes, the redundant status is read in an interrupt manner. These two methods ensure that the processor 11 performs periodic diagnosis of the controller's working status and responds immediately to changes in the master-slave controller status. The task cycle of the processor's cycle diagnosis is 50us.
  • the logic device 12 includes an SPI 121, which is a slave device in SPI master-slave communication.
  • the slave device cannot send a communication clock and can only respond to the communication command of the SPI master device of the processor 11. Therefore, the SPI 121 of the logic device 12 It cannot actively initiate communication and can only wait for commands from the processor 11.
  • the logic device 12 includes a serial transceiver module 122, which includes serial transmitting and serial receiving parts. This module sends parallel data at a baud rate of 2.5MHz.
  • serial sending module After the serial sending module obtains the local status 123, it adds CRC8 check information, constructs a sending message, and hands the sending message to the serial sending module for sending;
  • the serial receiving module receives the message, which contains redundant status information and CRC8 verification information. After the serial receiving module converts the serial data into parallel data and temporarily stores it, it verifies the received data. If the message is verified to be free of errors, the redundancy status 124 is updated, and if the message is verified to be incorrect, an error mark is sent to the processor 11.
  • the logic device 12 includes a redundant state change module 125, which can effectively reduce the load of the processor 11 and increase the corresponding speed of the processor 11, thereby increasing the master-slave switching speed of the redundant control system.
  • a redundant state change module 125 detects a change in the redundancy status 124, it generates an interrupt to the processor 11. After the processor 11 quickly responds to the interrupt, it reads the redundancy status 124 through the SPI interface.
  • FIG. 3 it is a state machine jump diagram of the logic device 12.
  • the functional requirements of the logic device 12 are: 1 respond to the data sent by the processor 11; 2 send the local state 123 within a fixed period; 3 Waiting to receive data, preliminarily judging the status of the redundant controller based on the received data, and sending the data to the processor 11 under specific circumstances.
  • the status jump of the logic device 12 in Figure 3 is as follows. After controller 1 and controller 2 are started, the logic device 12 creates four functional modules at the same time, which are respectively responsible for SPI reception, sending local status, receiving redundant status and redundant status changes. , four functional modules are executed in parallel.
  • controller 1 or controller 2 After receiving data (local status 123), it enters the next waiting cycle.
  • controller 1 or controller 2 After controller 1 or controller 2 is powered on, it has been sending the local status 123 received by SPI.
  • the local status 123 is all 0 status. This status is sent to the redundant server.
  • the redundant controller can determine that the local controller exists but is starting up, so the periodic transmission of the local status module cannot be interrupted. After the interruption, the redundant controller determines that the local controller does not exist and will replace the redundant controller. Switch to master controller state. After controller 1 or controller 2 starts normally, SPI will receive the local status 123 information sent by the processor 11, and this information will be updated to the sending local status module.
  • controller 1 or controller 2 To receive the redundant state (executed by the serial transceiver module), after controller 1 or controller 2 is powered on, it waits for data input from the communication interface 13. As shown in Figure 3, the data input by the communication interface 13 is divided into two different situations. In one case, if the data sent by the redundant controller is not received within a communication cycle, it is judged that the redundant controller does not exist, and the redundant controller is After the remaining status 124 is cleared, the processor 11 is notified that the controller 1 or the controller 2 enters the stand-alone running state. In the stand-alone running state, the serial transceiver module is also waiting for the data input by the communication interface 13.
  • the communication interface 13 receives the data sent by the redundant controller, and after data verification, there is no error, the redundancy status 124 is updated, and the control system enters the dual-machine redundancy control state.
  • the redundancy status changes (executed by the redundancy status change module). After the controller 1 or controller 2 is powered on, it has been monitoring the redundancy status 124. After the redundancy status 124 changes, an interrupt is sent to the processor 11 and waits for processing. The processor 11 reads the redundancy status 124, and the processor 11 sends a read command through the SPI peripheral. After the reading is completed, the redundancy status change module needs to clear the interrupt and proceed to the next monitoring redundancy status 124 cycle.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Hardware Redundancy (AREA)

Abstract

一种主从冗余控制系统，包括两个可根据工作状态进行主从切换的控制器；一个控制器工作在主状态，另一个控制器作为冗余备份工作在从状态，并根据工作状态进行主从切换；各控制器包括：处理器，实现主从控制器的控制逻辑；通信接口，作为控制器的同步状态报文的传输接口；以太网接口，作为控制器的同步数据报文的传输接口；逻辑器件，实现主从切换和主从同步逻辑的收发控制；该系统采用逻辑器件传输冗余切换报文，处理器不参与报文的收发，一方面逻辑器件在检查到状态改变后向处理器发送中断，降低了处理器的负荷，提高主从切换速度，另一方面逻辑器件发送报文的周期固定，降低了冗余控制器的切换抖动

Description

一种主从冗余控制系统及控制方法 技术领域
    本申请涉及一种应用于主从冗余控制系统的冗余通信以及主从切换的方法。
 背景技术
    高可靠性要求的工业自动化的领域会采用控制器热备冗余的方式提高整个系统的可靠性。目前控制系统采用控制器冗余，模件冗余，通信链路冗余，电源冗余，网络设备冗余等方式提高系统的可靠性。
其中控制器冗余，冗余的两个或者更多个控制器需要控制数据的同步和主从控制的切换，主控制器在发生故障的情况下要及时切换为从控制器，同时作为冗余备份的从控制器要及时切换为主控制器。
目前主要采用的方式有：1、硬件电路构成的冗余切换电路，该方式的优点主要是电路简单可靠，缺点是可扩展性差，对控制器主从切换的信息简单，不能根据系统的扩展增加冗余切换的判断逻辑；2、采用专用的通信链路进行冗余切换通信，该方式的优点，电路简单，通信信息可扩展，缺点是实时性较差，特别是随着控制器的负荷增加，冗余通信的周期不确定，存在切换周期抖动，也很难达到微秒级的主从切换；3、采用专用的逻辑器件构建通信链路，该方式结合上述方案的优点，具备可扩展性，电路简化，通信数据可校验，实时性高，达到微秒级通信周期，切换抖动小，降低控制器符合，不随着控制器的负荷增加冗余切换周期增加等特点，适合用在一些快速无扰切换的应用场合。
 发明内容
    本申请是为了减小热备冗余的控制器的主从切换周期，降低切换周期的抖动，使冗余切换的过程与控制器的负荷解耦，增加通信数据的校验，从而提高增加冗余控制系统的可靠性。冗余切换的周期达到微秒级精度是控制系统对不同的工业应用场合具有更高的适用性。
本发明所采用的技术方案如下：
一种主从冗余控制系统，包括两个可根据工作状态进行主从切换的控制器；一个控制器工作在主状态，另一个控制器作为冗余备份工作在从状态，并根据工作状态进行主从切换。各控制器包括：
处理器，实现主从控制器的控制逻辑；
通信接口，作为控制器的同步状态报文的传输接口；
以太网接口，作为控制器的同步数据报文的传输接口；
逻辑器件，实现主从切换和主从同步逻辑的收发控制。
逻辑器件采用可编程逻辑器件，以其构建冗余切换链路，主要目的是解决由控制器直接参与构建通信链路进行冗余切换的问题。控制器直接通信链路的方式，不论是采用周期查询方式或者中断的方式，都会增加控制器负荷，同时控制器随着外围控制逻辑的增加，会导致冗余切换的周期也会跟随增加，冗余切换的抖动也会增加。可编程逻辑器件可以在不需要控制器参与的情况下，实现在主从控制器的高效通信，并且不会随着控制器负荷的增加而增加冗余切换周期，切换抖动小，同时通信扩展性高，增加通信数据校验后，通信可靠性增加，并且冗余切换的周期可以达到微秒级。
本申请冗余热备控制器之间通过通信接口和以太网接口分布传输冗余切换报文和冗余数据报文，保证冗余切换的实时性。
其中，处理器提供一个SPI接口与逻辑器件进行通信。处理器提供的SPI接口实现双向数据的收发，包括向逻辑器件写入状态信息和读取状态信息，处理器提供的SPI接口只实现主从切换逻辑的写入和读取。处理器在控制周期内写入本机的状态，处理器对冗余状态的读取是通过中断的方式，通过中断的方式可以降低处理器的负荷，另外可以提高处理器获取冗余状态的速度。处理器获取冗余状态并不仅仅支持中断模式，SPI的全双工的通信方式同时支持在处理器在下发本机状态的同时获取冗余状态。
进一步的，上述逻辑器件包括：
SPI接口，与处理器相连，接收处理器下发的本机状态信息并更新到本机状态中，同时响应处理器的读取冗余状态的命令，向处理器发送冗余状态；
串行收发模块，包含串行发送和串行接收构成串行收发模块的全双工通信，该模块在发送本机状态的同时接收冗余状态；
冗余状态改变模块，在检测到冗余状态改变的情况下向处理器发出中断。
本申请通过冗余状态改变模块降低处理器的负荷并提高处理器获取冗余状态的速度。在冗余状态未改变的情况下，不产生中断，处理器不会读取冗余状态；在冗余状态改变的情况下，产生中断，处理器读取冗余状态。并采用串行收到模块进行数据收发，不占用处理器的处理时间，以可以计算的时间和周期将本机状态发送给冗余控制器，同时获取冗余控制器的状态到本机。串行收发模块构造通信报文，串行发送模块的发送报文包含本机状态和校验信息；同时串行接收模块接收报文，需要校验接收报文，报文没有错误情况下更新冗余状态，在报文检验错误情况下发送错误标记为给处理器。
本申请还提供了一种主从冗余控制方法，采用以下冗余切换逻辑：处理器根据本控制器的状态向逻辑器件发送本机状态，逻辑器件获取本机状态，添加校验信息，固定周期内发送报文；逻辑器件同时接收报文，对接收的报文数据进行校验，校验报文没有错误的情况下更新冗余状态，并在检测到冗余状态发生改变的情况下，向处理器发送中断，处理器读取冗余状态；逻辑器件在校验报文错误情况下发送错误标记给处理器。
本申请冗余切换的逻辑控制报文在通信接口中传输，该接口只传输冗余切换的报文，提高冗余切换的实时性。处理器并不直接参与数据的收发，因此处理器负荷的高低并不能影响数据的收发周期，该方式解决了由于处理器负荷的不同导致的冗余切换周期的抖动。
更为具体的，所述主从冗余控制方法包括以下步骤：
处理器根据本控制器的状态周期向逻辑器件的SPI接口发送本机状态；
SPI接口接收到本机状态后，进入下一个等待周期；
串行发送模块获取本机状态后，添加CRC8校验信息，发送报文；
通信接口，接收冗余控制器发送的状态报文；
冗余状态改变模块，根据冗余控制器的状态报文的接收情况，更新冗余状态；在冗余状态发生改变的情况下，向处理器发出中断；
处理器以中断的方式读取冗余状态，读取完成后，冗余状态改变模块清除该中断，进行下一个监控冗余状态周期。
进一步的，主从冗余控制方法还采用以太网接口进行主从控制器的控制数据报文收发。该以太网接口主要作为冗余切换的数据报文的通信接口，主要作用是主控制器和从控制器的控制数据同步。
进一步的，当通信接口在一个通信周期内未收到冗余控制器发送过来的状态报文，判断冗余控制器不存在，将冗余状态清零，通知处理器，本机控制器进入单机运行状态，在此状态下，持续等待通信接口接收的报文数据，当收到数据即退出单机模式；当通信接口收到冗余控制器发送过来的状态报文，进行数据校验后没有错误，更新冗余状态，控制系统进入双机冗余控制状态。
本申请相比现有技术具有以下优点：
1）本申请控制系统中冗余热备控制器之间通过通信接口和以太网接口分别传输冗余切换报文和冗余数据报文，保证冗余切换的实时性。
2）本申请的实施例中，冗余切换报文的收发采用可编程逻辑器件，冗余切换报文长度可扩展，报文中包含本控制器的网络诊断信息，电源诊断信息，以及模件诊断信息，以便于控制器支持更加复杂的冗余切换逻辑，并且在报文中添加校验信息，通信更加可靠。
3）本申请的实施例中，逻辑器件传输冗余切换报文，处理器不参与报文的收发，一方面逻辑器件在检查到状态改变后向处理器发送中断，降低了处理器的负荷，另一方面逻辑器件发送报文的周期固定，降低了冗余控制器的切换抖动。整个冗余切换报文的通信周期在7.52us，报文处理周期在50us内，冗余切换的周期在100us内，较采用处理器控制的方式1-10ms内，冗余切换的速度提高10倍以上。
 附图说明
    图1为本申请实施例控制系统的拓扑结构。
图2为本申请实施例控制器冗余切换模块框图。
图3为本是申请实施例中逻辑器件的状态机跳转图。
 具体实施方式
    下面结合附图对本申请的技术方案作进一步的说明。
本实施例提供了一种应用于主从冗余控制系统的冗余通信以及冗余切换的方法，该方法应用在冗余控制器之间的主从同步和主从切换。主要目的实现主从控制器的快速切换，降低主从切换的周期抖动，同时使主从切换具有功能可扩展性以及高可靠性的特点。通过可编程逻辑器件来实现主从控制器的状态转换控制，解决了由CPU直接进行冗余切换造成的切换速度变化问题，降低了控制器通信周期对冗余切换周期的影响，同时也降低了控制器切换周期抖动。主、从控制器固定周期内通过报文的形式将从控制器的状态发送给主控制器，同时将主控制器的状态发送给从控制器，该报文包含了主从控制器的状态，以及数据校验信息。该通信报文由可编程逻辑器件实现收发，采用报文的方式，解决了由固定连接线构成主从切换的可扩展性问题，同时可以添加校验信息保证通信的可靠性。
如图1所示，本实施例系统包括两个完全相同的控制器1和控制器2，该控制器1和控制器2互为冗余备份，其中一个控制器1或者控制器2工作在主控制器状态，负责整个控制逻辑的处理，监控设备的通信，现场设备的控制，同时将控制数据通过以太网接口14主动传输给冗余控制器，另一个控制器处于冗余备份状态，接收主控制器通过以太网接口14发送来的控制数据，做到与主控制器的完全同步。
在主控制器发送故障的条件下产生两种处理逻辑，一种是主控制器通过通信接口13主动将主控制器的故障信息发送给从控制器，从控制器将本机切换为主控制器的同时将发送状态转换报文把主控制器切换为从控制器；另一种情况，主控制器故障已经无法发送状态报文，从控制在通过通信接口13发送给主控制器状态的时间内，未收到主控制器发送的状态报文，判断主控制器已经离线，主动将从控制器切换为主控制器。
逻辑器件12负责冗余数据通信和冗余状态通信的数据链路层的实现，对外通信连接通信接口13和以太网接口14，对内通信连接处理器11，将对内通信和对外通信解耦合，以防止处理器11负荷增加对冗余数据通信和冗余状态通信周期产生影响，同时防止外部数据通信对增加处理器11的负荷。逻辑器件在没有处理器11参与的情况下，主动收发冗余状态数据，接收处理器11发送的状态信息，在冗余状态发生改变的情况下，主动向处理器11发送状态信息。
如图2所示，为本实施例控制器内冗余切换逻辑框图，处理器11包含一个可以作为SPI主设备的外设，SPI可以支持全双工通信，单个字节在25MHz时钟下通信周期为320ns，并且该接口可以在发送本机状态123情况下同时接收冗余状态124。
首先处理器11根据本控制器的状态（网络状态、电源状态、设备通信状态等信息）周期通过SPI外设向逻辑器件12的SPI 121发送本机状态123，由于SPI 121全双工通信方式，在发送的同时处理器11可以接收到冗余状态124，该方式为处理器11在冗余状态124没有改变的情况下，主动查询冗余状态124的方式，同时处理器11支持在冗余状态124改变的情况下，以中断的方式读取冗余状态，这两种方式保证了处理器11对控制器工作状态的周期诊断和主从控制器状态改变的立即响应处理。处理器的周期诊断的任务周期在50us。
逻辑器件12包含一个SPI 121，该SPI 121是属于SPI主从通信中的从设备，从设备不能发送通信时钟，只能响应处理器11的SPI主设备的通信命令，因此逻辑器件12的SPI 121 不能主动发起通信，只能等待处理器11的命令。
逻辑器件12包含一个串行收发模块122，该模块包含串行发送和串行接收两部分。该模块将并行的数据按照2.5MHz的波特率发送出去。
串行发送模块获取本机状态123后，添加CRC8校验信息，构造一个发送报文，发送报文交给串行发送模块发送；
串行接收模块接收报文，该报文包含了冗余状态信息和CRC8的校验信息，串行接收模块将串行数据转化成并行数据暂存后，对接收到的数据进行校验，校验报文没有错误情况下更新冗余状态124，在报文检验错误情况下发送错误标记为给处理器11。
逻辑器件12包含一个冗余状态改变模块125，该模块可以有效降低处理器11的负荷并提高处理器11的相应速度，从而提高冗余控制系统的主从切换速度。冗余状态改变模块125，在检测到冗余状态124发生改变的情况下，向处理器11产生中断，处理器11快速响应中断后，通过SPI接口读取冗余状态124。
如图3所示，为逻辑器件12的状态机跳转图，该逻辑器件12的功能需求为：①响应处理器11下发的数据；②固定的周期内将本机状态123发送出去；③等待接收数据，根据接收到的数据初步判断冗余控制器的状态，在特定的情况下将该数据发送给处理器11。
图3逻辑器件12的状态跳转如下，控制器1和控制器2启动后，逻辑器件12同时创建四个功能模块，分别负责SPI接收，发送本机状态、接收冗余状态和冗余状态改变，四个功能模块并行执行。
SPI接收，控制器1或者控制器2上电后，一直等待处理器11的通信命令，接收到数据（本机状态123）后，进入下一个等待周期。
发送本机状态，控制器1或者控制器2上电后，一直在发送由SPI接收到的本机状态123，处理器11在启动过程中本机状态123为全0状态，该状态发送给冗余控制器，冗余控制器可以判断本控制器存在但是在启动中，因此发送本机状态模块的周期发送不能中断，中断后冗余控制器判断本地控制器不存在，会将冗余控制器切换为主控制器状态。控制器1或者控制器2在正常启动后，SPI会收到处理器11发送的本机状态123信息，该信息会更新给发送本机状态模块。
接收冗余状态（由串行收发模块执行），控制器1或者控制器2上电后，一直等待通信接口13输入的数据。如图3所示，通信接口13输入的数据分为两种不同情况，一种情况下在一个通信周期内未收到冗余控制器发送过来的数据，判断冗余控制器不存在，将冗余状态124清零后，通知处理器11，控制器1或者控制器2进入单机运行状态，在单机运行状态下，串行收发模块也在一直等待通信接口13输入的数据，如果收到数据即退出单机模式；另一种情况，通信接口13收到了冗余控制器发送过来的数据，进行数据校验后没有错误，更新冗余状态124，控制系统进入双机冗余控制状态。
冗余状态改变（由冗余状态改变模块执行），控制器1或者控制器2上电后，一直在监控冗余状态124，冗余状态124改变后，即向处理器11发出中断，等待处理器11读取冗余状态124，处理器11通过SPI外设发送读取命令，读取完成后，冗余状态改变模块需要清除该中断，进行下一个监控冗余状态124周期。
以上所述仅是本申请的一种实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下还可以作出若干改进，这些改进也应视为本申请的保护范围。

Claims (6)

  1. 一种主从冗余控制系统，包括两个可根据工作状态进行主从切换的控制器；其特征在于，各控制器包括：
    处理器，实现主从控制器的控制逻辑；
    通信接口，作为控制器的同步状态报文的传输接口；
    以太网接口，作为控制器的同步数据报文的传输接口；
    逻辑器件，实现主从切换和主从同步逻辑的收发控制。
  2. 根据权利要求1所述的主从冗余控制系统，其特征在于，所述逻辑器件包括：
    SPI接口，与处理器相连，接收处理器下发的本机状态信息并更新到本机状态中，同时响应处理器的读取冗余状态的命令，向处理器发送冗余状态；
    串行收发模块，包含串行发送和串行接收构成串行收发模块的全双工通信，该模块在发送本机状态的同时接收冗余状态；
    冗余状态改变模块，在检测到冗余状态改变的情况下向处理器发出中断。
  3. 一种主从冗余控制方法，其特征在于，采用以下冗余切换逻辑：处理器根据本控制器的状态向逻辑器件发送本机状态，逻辑器件获取本机状态，添加校验信息，固定周期内发送报文；逻辑器件同时接收报文，对接收的报文数据进行校验，校验报文没有错误的情况下更新冗余状态，并在检测到冗余状态发生改变的情况下，向处理器发送中断，处理器读取冗余状态；逻辑器件在校验报文错误情况下发送错误标记给处理器。
  4. 根据权利要求3所述的主从冗余控制方法，其特征在于，所述主从冗余控制方法包括以下步骤：
    处理器根据本控制器的状态周期向逻辑器件的SPI接口发送本机状态；
    SPI接口接收到本机状态后，进入下一个等待周期；
    串行发送模块获取本机状态后，添加CRC8校验信息，发送报文；
    通信接口，接收冗余控制器发送的状态报文；
    冗余状态改变模块，根据冗余控制器的状态报文的接收情况，更新冗余状态；在冗余状态发生改变的情况下，向处理器发出中断；
    处理器以中断的方式读取冗余状态，读取完成后，冗余状态改变模块清除该中断，进行下一个监控冗余状态周期。
  5. 根据权利要求4所述的主从冗余控制方法，其特征在于，所述主从冗余控制方法还采用以太网接口进行主从控制器的控制数据报文收发。
  6. 根据权利要求4所述的主从冗余控制方法，其特征在于，当通信接口在一个通信周期内未收到冗余控制器发送过来的状态报文，判断冗余控制器不存在，将冗余状态清零，通知处理器，本机控制器进入单机运行状态，在此状态下，持续等待通信接口接收的报文数据，当收到数据即退出单机模式；当通信接口收到冗余控制器发送过来的状态报文，进行数据校验后没有错误，更新冗余状态，控制系统进入双机冗余控制状态。
PCT/CN2023/077134 2022-07-15 2023-02-20 一种主从冗余控制系统及控制方法 WO2024011906A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210830298.3A CN115113516A (zh) 2022-07-15 2022-07-15 一种主从冗余控制系统及控制方法
CN202210830298.3 2022-07-15

Publications (1)

Publication Number Publication Date
WO2024011906A1 true WO2024011906A1 (zh) 2024-01-18

Family

ID=83332546

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/077134 WO2024011906A1 (zh) 2022-07-15 2023-02-20 一种主从冗余控制系统及控制方法

Country Status (2)

Country Link
CN (1) CN115113516A (zh)
WO (1) WO2024011906A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117647965A (zh) * 2024-01-29 2024-03-05 西安热工研究院有限公司 一种dcs控制器可信策略下装方法、装置、设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115113516A (zh) * 2022-07-15 2022-09-27 南京科远智慧科技集团股份有限公司 一种主从冗余控制系统及控制方法
CN115695177A (zh) * 2022-11-02 2023-02-03 广东九博科技股份有限公司 一种基于以太网的主备同步方法及系统

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH06110859A (ja) * 1992-09-29 1994-04-22 Toshiba Corp 二重化システム状態認識回路
JP2008146236A (ja) * 2006-12-07 2008-06-26 Toshiba Corp 二重化制御装置、及びその制御権設定信号の冗長化方法
CN101217353A (zh) * 2007-01-05 2008-07-09 深圳市科陆电子科技股份有限公司 一种呼叫中心多点双机冗余系统的控制方法
US20120144252A1 (en) * 2010-12-01 2012-06-07 Hitachi, Ltd. Storage control apparatus and storage control method
CN107300851A (zh) * 2016-04-14 2017-10-27 南京南瑞继保电气有限公司 一种冗余控制系统的逻辑算法无扰更新方法
CN112770958A (zh) * 2020-12-25 2021-05-07 华为技术有限公司 控制方法、监控方法、电子控制单元、控制器和控制系统
CN113467222A (zh) * 2020-03-30 2021-10-01 南京南瑞继保电气有限公司 主从冗余控制系统的数据同步方法及装置
CN114326366A (zh) * 2021-12-02 2022-04-12 珠海格力电器股份有限公司 软冗余控制系统及其配置方法
CN114338361A (zh) * 2022-03-15 2022-04-12 浙江中控技术股份有限公司 通讯装置的通讯方法、通讯装置及分布式控制系统
CN115113516A (zh) * 2022-07-15 2022-09-27 南京科远智慧科技集团股份有限公司 一种主从冗余控制系统及控制方法

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH06110859A (ja) * 1992-09-29 1994-04-22 Toshiba Corp 二重化システム状態認識回路
JP2008146236A (ja) * 2006-12-07 2008-06-26 Toshiba Corp 二重化制御装置、及びその制御権設定信号の冗長化方法
CN101217353A (zh) * 2007-01-05 2008-07-09 深圳市科陆电子科技股份有限公司 一种呼叫中心多点双机冗余系统的控制方法
US20120144252A1 (en) * 2010-12-01 2012-06-07 Hitachi, Ltd. Storage control apparatus and storage control method
CN107300851A (zh) * 2016-04-14 2017-10-27 南京南瑞继保电气有限公司 一种冗余控制系统的逻辑算法无扰更新方法
CN113467222A (zh) * 2020-03-30 2021-10-01 南京南瑞继保电气有限公司 主从冗余控制系统的数据同步方法及装置
CN112770958A (zh) * 2020-12-25 2021-05-07 华为技术有限公司 控制方法、监控方法、电子控制单元、控制器和控制系统
CN114326366A (zh) * 2021-12-02 2022-04-12 珠海格力电器股份有限公司 软冗余控制系统及其配置方法
CN114338361A (zh) * 2022-03-15 2022-04-12 浙江中控技术股份有限公司 通讯装置的通讯方法、通讯装置及分布式控制系统
CN115113516A (zh) * 2022-07-15 2022-09-27 南京科远智慧科技集团股份有限公司 一种主从冗余控制系统及控制方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117647965A (zh) * 2024-01-29 2024-03-05 西安热工研究院有限公司 一种dcs控制器可信策略下装方法、装置、设备及存储介质
CN117647965B (zh) * 2024-01-29 2024-04-30 西安热工研究院有限公司 一种dcs控制器可信策略下装方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN115113516A (zh) 2022-09-27

Similar Documents

Publication Publication Date Title
WO2024011906A1 (zh) 一种主从冗余控制系统及控制方法
CN103647781B (zh) 一种基于设备冗余和网络冗余的混合冗余可编程控制系统
CN102103532B (zh) 列控车载设备的安全冗余计算机系统
CN102611598B (zh) 控制器局域网络总线冗余系统及冗余切换的方法和装置
CN102724083A (zh) 基于软件同步的可降级三模冗余计算机系统
CN105897574B (zh) 一种支持双网双主冗余的Modbus RTU/TCP网关装置
CN110427283B (zh) 一种双余度的燃油管理计算机系统
WO2020192029A1 (zh) 一种设备主备系同步和热备方法及系统
CN107453913B (zh) 具备处理器间高速通信的网关冗余方法
CN108551397A (zh) 网桥装置及应用以及多plc主站与多plc从站的通信控制方法
CN110488597B (zh) 机车主处理单元双冗余控制方法
JP3882783B2 (ja) プログラマブルコントローラ及びｃｐｕユニット並びに通信ユニット及び通信ユニットの制御方法
CN104424680A (zh) 一种门禁冗余控制系统
CN105471653A (zh) 一种机载双通道无缝切换方法及系统
CN110515295A (zh) 一种动态可配置的冗余io模块的方法
CN103744753A (zh) 一种双机系统的数据交互方法与装置
CN109995681B (zh) 一种单芯片实现双主控主备切换的装置及方法
CN109306875B (zh) 一种汽轮机deh双控制器同步热备冗余切换装置及方法
CN101291201A (zh) 心跳信息传输系统及方法
CN203455884U (zh) 一种门禁冗余控制系统
CN202142052U (zh) 列控车载设备的安全冗余计算机系统
WO2012167461A1 (zh) Cpu间互联容错的实现方法及系统
CN101741532A (zh) 一种用于冗余服务器切换的双机切换装置
CN102231700A (zh) 交换卡切换信息的下发方法和交换卡热备份系统
CN102402212B (zh) 用于运行网络的方法和网络

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23838408

Country of ref document: EP

Kind code of ref document: A1