High-precision redundant excitation system switching method

Abstract

According to the high-precision redundant excitation system switching method, data needing to be synchronized are monitored and recorded through an FPGA module, parallel transmission of synchronous data is achieved, the data synchronization amount of each scanning period is reduced, the data synchronization process is completely completed by an FPGA, CPU resources are not occupied, the scanning period of the system is not increased in the data synchronization process, and the data synchronization efficiency is improved. The performance of the redundant PLC can be improved; a VHDL language is adopted for FPGA function design, detailed design of all functional modules of the FPGA and simulation results of key modules are given, data synchronization between a main PLC and a standby PLC is achieved on a hardware platform, and the problems that in other redundant PLC data synchronization methods, the data synchronization amount is large, and the system scanning period is increased in the data synchronization process are solved.

Description

Technical Field

[0001] The invention belongs to the technical field of redundant system switching and relates to a high-precision redundant excitation system switching method. Background Art

[0002] Dual-mode redundancy is a commonly used hardware redundancy method, also known as high-precision redundancy. It includes dual-mode hot standby redundancy and cold standby redundancy. Dual-mode hot standby redundancy is the most commonly used. In a dual-mode hot standby redundancy system, two modules work at the same time. One of them is the main module, which has control over the system input and output; the other is the backup module, which keeps real-time synchronization with the main module. Once the main module fails, the system immediately switches, and the backup module obtains input and output control and becomes the new main module. The original main module is downgraded to a backup module.

[0003] Most of the existing PLC redundant systems are based on hardware redundancy. According to redundancy theory, full consideration of the reliability requirements of medium-sized PLC redundant architecture, combined with the comparison of several redundant methods, hardware-based dual-machine hot standby redundancy is selected as the redundant method of PLC redundant architecture.

[0004] However, in the design of PLC redundant system, data synchronization is a key technology that must be faced and solved. How to achieve data synchronization between the main and standby PLCs, and solve the problems of large data synchronization volume and increased system scan cycle in the data synchronization of other redundant PLCs. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a high-precision redundant excitation system switching method to achieve parallel transmission of synchronous data, thereby reducing the amount of data synchronization in each scanning cycle.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is: a high-precision redundant excitation system switching method, comprising the following steps: S1, design redundant architecture, including CPU module redundancy, rack redundancy, power supply redundancy, communication dual network redundancy, synchronous data redundancy and I / O module redundancy; S2, analysis, formulates redundant nodes according to the redundant architecture, representing the fault tolerance with fault-tolerant devices or modules; S3, CPU module framework design, the CPU module uses ARM7 chip as the main controller, and an SRAM is connected to the off-chip expansion bus. The main controller and SRAM are connected through FPGA, and FPGA is used as a data synchronization function module; S4, main chip interface circuit design. In addition to the address bus, data bus and control bus between the CPU and FPGA, there are also information exchange lines between the FPGA and CPU and the configuration line of the FPGA. The information exchange lines between the FPGA and CPU are used for the collaborative work between the two processors to realize the data synchronization function of the FPGA. A channel is provided inside the FPGA. When the CPU accesses the SRAM, the corresponding address bus, data bus and control bus are connected to the SRAM. S5, dual-processor collaborative design, CPU is the main control chip, responsible for all PLC tasks except data synchronization, FPGA is the coprocessor, responsible for data synchronization; FPGA has two RAM spaces, registers and counters inside, all with their own independent address space, CPU performs read and write operations on them; S6, fault detection mechanism design, including fault mode definition, fault detection and diagnosis; S7, system fault-tolerant mechanism design, the system fault-tolerant mechanism includes the system operation mechanism definition, dual-machine collaboration and data synchronization mode design, and system fault handling and state switching mechanism.

[0007] In S1, the power module failure in the power redundancy is a module with a higher failure rate in the PLC system. When a power module fails in the system, the system does not need to switch; only when two power modules fail at the same time, the system switches to the PLC system on another rack to continue to execute the control task; only when all four power supplies on the active and standby racks fail, the system will shut down due to power module failure.

[0008] In S2, judging fault tolerance includes: S2-1, when a power module fails, another module connected in parallel provides power alone, and the system is not affected; S2-2, when a data synchronization link or remote I / O module fails, the system automatically switches to another backup module, and the other modules of the control system remain unchanged, realizing module-level switching; S2-3, when the CPU module, communication module, field bus connection line fails or both power modules fail at the same time, the backup PLC system will replace the original main PLC system to run alone, realizing system-level switching.

[0009] In S5, dual processor collaborative switching includes: S3-1, when the CPU module works as the main module, the CPU executes the user program and directly operates the relevant components in the external SRAM; S3-2, when the CPU module is used as a hot standby module, the FPGA automatically receives synchronization data from the main CPU; S3-3, the working mode of FPGA is informed by the CPU.

[0010] System fault handling and state switching mechanism For the main PLC system fault, there are three types according to the processing results: the first is that the system does not need to switch; the second is that the system performs module-level switching; the third is that the system performs system-level switching.

[0011] No switching is required. In the PLC redundant architecture, the power supply module consists of two modules working in parallel. When one module fails, the other module can provide system power independently without causing any impact on other modules in the system.

[0012] During module-level switching, the data synchronization link and remote I / O modules are both module-level parallel redundant. When any of them fails, only module-level switching is performed without the need for system-level switching. When the CPU detects such a module failure, it will continue to run through another module.

[0013] During system-level switching, when the CPU module, communication module or communication link of the main PLC system fails, there is no module-level parallel redundancy and system-level switching is required. The main PLC system transmits the system status information to the hot standby PLC through the Ethernet communication link or data synchronization link. After receiving the main module fault information, the hot standby PLC starts to execute the complete system scanning task and makes the input and output valid. The PLC runs in stand-alone mode. After the original main PLC system recovers from the fault, it becomes a hot standby PLC through automatic synchronization link, and the original hot standby PLC becomes the main PLC to form a new redundant system.

[0014] In the state switching mechanism, in a normal redundant PLC system, the working contents of the main PLC and the hot standby PLC are different; when two originally independent PLCs are in the process of establishing a redundant hot standby PLC, or when a failure occurs after the redundant system is established, the states of the two PLCs will change.

[0015] The main beneficial effects of the present invention are: An FPGA module is used to monitor and record the data that needs to be synchronized, and the parallel transmission of the synchronized data is realized, so that the amount of data synchronization in each scanning cycle is reduced.

[0016] The data synchronization process is completely completed by FPGA, does not occupy CPU resources, and does not increase the system scan cycle, which can improve the performance of redundant PLC.

[0017] VHDL language is used for FPGA functional design, and the detailed design of each functional module of FPGA and the simulation results of key modules are given. Data synchronization between the main and standby PLCs is realized on the hardware platform, which solves the problems of large data synchronization amount and increased system scanning cycle in the data synchronization process of other redundant PLC data synchronization methods.

[0018] The overall hardware design of the CPU module of the PLC redundant system was carried out, and the fault-tolerant mechanism of the PLC redundant system was designed, including the fault detection mechanism and the state switching mechanism after the fault.

[0019] By analyzing and comparing the data synchronization modes in existing redundant PLCs, a monitoring data synchronization mode is designed, which can minimize the amount of synchronized data. In addition, the data synchronization work does not occupy CPU resources, thereby improving the performance of the redundant system. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] Figure 1 This is a redundant architecture diagram of the present invention.

[0022] Figure 2 This is a block diagram of the dual power supply redundancy of the present invention.

[0023] Figure 3 This is a block diagram of redundant nodes of the system of the present invention.

[0024] Figure 4 This is a structural block diagram of the CPU module of the present invention.

[0025] Figure 5 This is a diagram of interface signals between the main chips of the present invention.

[0026] Figure 6 This is a schematic diagram of the FPGA internal bus switching switch of the present invention.

[0027] Figure 7 This is a CPU synchronization control flow chart of the present invention.

[0028] Figure 8 Schematic diagram of the scanning cycle of the system of the present invention.

[0029] Fig. 9 It is a state transition flow chart of the present invention. DETAILED DESCRIPTION

[0030] like Figure 1 to Figure 9 A high-precision redundant excitation system switching method includes the following steps: S1, design redundant architecture, including CPU module redundancy, rack redundancy, power supply redundancy, communication dual network redundancy, synchronous data redundancy and I / O module redundancy; S2, analysis, formulates redundant nodes according to the redundant architecture, representing the fault tolerance with fault-tolerant devices or modules; S3, CPU module framework design, the CPU module uses ARM7 chip as the main controller, and a SRAM is connected to the off-chip expansion bus. The main controller and SRAM are connected through FPGA, and FPGA is used as a data synchronization function module; S4, main chip interface circuit design. In addition to the address bus, data bus and control bus between the CPU and FPGA, there are also information exchange lines between the FPGA and CPU and the configuration line of the FPGA. The information exchange lines between the FPGA and CPU are used for the collaborative work between the two processors to realize the data synchronization function of the FPGA. A channel is provided inside the FPGA. When the CPU accesses the SRAM, the corresponding address bus, data bus and control bus are connected to the SRAM. S5, dual-processor collaborative design, CPU is the main control chip, responsible for all PLC tasks except data synchronization, FPGA is the coprocessor, responsible for data synchronization; FPGA has two RAM spaces, registers and counters inside, all with their own independent address space, CPU performs read and write operations on them; S6, fault detection mechanism design, including fault mode definition, fault detection and diagnosis; S7, system fault-tolerant mechanism design, the system fault-tolerant mechanism includes the definition of system operation mechanism, dual-machine collaboration and data synchronization mode design, system fault handling and state switching mechanism; Embodiment 1, Taking into account the application scenarios of medium-sized PLCs, the probability of occurrence of different failure modes and other factors, dual CPU module hot standby redundancy, power supply redundancy, field bus redundancy, data synchronization link redundancy and I / O module redundancy are selected to form a complete medium-sized PLC redundant architecture, such as Figure 1 It should be emphasized that this architecture is flexible and users can flexibly configure the redundancy function according to actual needs.

[0031] CPU module redundancy.

[0032] The redundant system uses two CPU modules to achieve hot standby redundancy. The CPU module is a dedicated redundancy module that integrates the synchronization function required for dual-machine hot standby, and can automatically switch when the main system fails and the system needs to switch. The data synchronization interface is derived from the CPU module, which changes the previous method of some redundant PLCs to achieve data synchronization through dedicated redundant hot standby modules. This is also determined by the data synchronization method in this architecture.

[0033] Rack redundancy, The rack is a base for placing each PLC module. Each module is placed in different installation slots of the rack in a certain order, and the modules are connected with bus connectors. Many applications require that the two CPU modules be placed separately, so that multi-point monitoring of the control system can be achieved, and at the same time, the situation where both the main and standby PLCs fail due to some reasons can be avoided, thus dispersing the risk. This design installs the main and standby CPU modules in two different racks respectively, requiring rack redundant configuration.

[0034] Power redundancy, The power module failure is a module with a higher failure rate in the PLC system. External environmental factors such as poor grid quality, as well as the power module's own failures such as excessive heat and component damage, may cause the output voltage to fail to meet the requirements, resulting in the system being unable to operate stably and reliably. In view of the importance of the power module in the entire PLC control system, multiple redundant designs are performed on the power module. First, each rack, including the remote I / O module, has a separate power module to power the PLC module on the rack. Secondly, for some particularly important or harsh environments, dual power modules can be configured in parallel for each rack. The principle of the parallel redundant design of two power modules is as follows: Figure 3 shown.

[0035] When a power module fails in the system, the system does not need to switch. Only when two power modules fail at the same time, the system will switch to the PLC system on another rack to continue to execute the control task; only when all four power supplies on the main and standby racks fail, the system will stop due to power module failure, which greatly improves reliability.

[0036] Communication dual network redundancy, Two communication modules are configured in the main and standby racks, one for communication with the host computer and the other for communication with small PLC, remote I / O module or bottom-level equipment. Communication redundancy includes redundancy of communication interface, network connector and communication cable.

[0037] The Ethernet communication module provides an industrial Ethernet interface for communication with upper-layer devices. Industrial Ethernet is one of the most popular topology standards in the world, with many advantages such as high transmission rate, rich network resources, strong system functions, simple installation and convenient use and maintenance. The communication between the medium-sized redundant PLC and the host computer does not provide a redundant network. On the one hand, the cost of the Ethernet communication module is relatively high. On the other hand, the wiring environment of the communication link between the PLC and the host computer is generally good and the failure rate is low.

[0038] Medium-sized PLCs and small PLCs, remote I / O modules or low-level devices use fieldbuses for communication. Fieldbus is a fully digital, two-way, multi-site communication system that connects intelligent field devices and automation systems. It mainly solves the digital communication between intelligent instruments, controllers, actuators and other field devices at industrial sites, as well as the information transmission between these field control devices and advanced control systems. This design uses the Profibus-DP fieldbus, which is more commonly used in industrial control, for communication.

[0039] The CPU module reads information through this communication network and outputs control information. Moreover, this communication network is distributed in various places of the workshop and production line, with many connections and a complex and harsh environment, which makes it very easy to have failures such as communication network disconnection. Therefore, it is necessary to control the communication between medium-sized PLCs and underlying devices.

[0040] Provides dual network redundancy design. The communication modules of the main PLC and the hot standby PLC are each connected to a Profibus-DP bus. When the DP communication module or communication link of the main PLC system fails, the PLC implements the main-standby switch. The fieldbus control module of the original standby system is upgraded to a working module to realize the control of other modules on the DP bus.

[0041] Data synchronization link redundancy, The data synchronization link is an important communication connection for the main CPU to transmit synchronization data to the hot standby CPU in real time to ensure that the status of the main and standby CPUs are consistent, so that the main and standby CPUs can switch smoothly in case of failure. Once the synchronization data is disconnected or other failures occur during the transmission process, the synchronization of the main and standby CPUs will not be possible, and the redundant control function will be lost. Therefore, this design also makes a dual-channel redundant design for the data synchronization link. Once the main channel fails and cannot work normally, the backup channel will automatically switch to the main channel to continue working.

[0042] I / O module redundancy, Two I / O modules form a redundant I / O module pair to achieve redundant control of the control object. Each I / O module has two communication bus interfaces, which are connected to the field bus of the main and standby PLC systems respectively. The module pair can have one module working and the other standby; or two modules can work in parallel and output at the same time. Users can configure according to the needs of the control object.

[0043] In the preferred solution, in S1, the power module failure in the power redundancy is a module with a higher failure rate in the PLC system. When a power module fails in the system, the system does not need to switch; only when two power modules fail at the same time, the system switches to the PLC system on another rack to continue to execute the control task; only when all four power supplies on the primary and standby racks fail, the system will shut down due to a power module failure.

[0044] Preferably, if Figure 4 The redundancy method of first parallel connection and then series connection can improve system reliability better than the redundancy method of first series connection and then parallel connection. It can be seen from the block diagram that the power supply, redundant synchronization link, and redundant field bus all adopt the method of first parallel connection and then series connection, so they all have the independence of redundant nodes.

[0045] In a preferred solution, in S2, judging fault tolerance includes: S2-1, when a power module fails, another module connected in parallel provides power alone, and the system is not affected; S2-2, when a data synchronization link or remote I / O module fails, the system automatically switches to another backup module, and the other modules of the control system remain unchanged, realizing module-level switching; S2-3, when the CPU module, communication module, field bus connection line fails or both power modules fail at the same time, the backup PLC system will replace the original main PLC system to run alone, realizing system-level switching.

[0046] Optimally, different redundancy modes have an effect on improving system reliability, proving that the reliability calculation value of two-mode hot standby redundancy is higher than that of three-mode voting redundancy, and the reliability of the system redundancy mode of first parallel and then series connection is higher than that of the system redundancy mode of first series and then parallel connection, which provides a basis for the selection of redundancy mode of medium-sized redundant PLC. According to the application environment and fault source of medium-sized PLC, the functional and performance requirements of medium-sized redundant PLC architecture are proposed, and finally a complete medium-sized PLC redundant system architecture with high reliability is built.

[0047] Preferably, the CPU module uses an ARM7 chip as the main controller, and an SRAM is connected to the off-chip expansion bus. The main controller and the SRAM are connected via FPGA, and the FPGA is used as a data synchronization function module, which will be described in detail in Section 4 of this chapter. In addition, it also includes a reset circuit, a real-time clock circuit, an RS232 communication interface for COM1, and RS485 communication interfaces for COM2 and COM3, where COM3 is a serial communication interface for data synchronization derived from FPGA. The overall structure of the CPU module is as follows: Figure 5 shown.

[0048] The CPU module obtains 5V power from the power module on the rack, and then converts 5V into 3.3V, 1.8V and 1.2V through the power conversion circuit for chip use.

[0049] In addition to the expansion bus connecting the FPGA and CPU, there are also configuration buses and interactive connections related to data synchronization.

[0050] The indicator light circuit provides indicator lights for various states of the CPU module itself to indicate the system operation status.

[0051] The CPU uses TI's TMS470R1B1M chip, which has 64k RAM, 1M FLASH, and a frequency of 60MHz. The external SRAM uses ISSI's BS616LV2018E-55 chip with a capacity of 128k*16Bits and a speed of 55ns. The FPGA uses ALTERA's SECRONIII series chip EP3C10, which can provide 10320 LEs, 25kWords of RAM space, and a speed level of 8ns. The configuration of the FPGA is completed by the CPU in serial mode. In addition, the real-time clock chip is PFC8563; the MODBUS communication uses the RS485 interface chip ADM3485E.

[0052] Preferably, the interface signals between the CPU and FPGA, SRAM are as follows Figure 4 As shown. In addition to the address bus, data bus and control bus between the CPU and FPGA, there are also information exchange lines between the FPGA and CPU and the configuration line of the FPGA. The information exchange line between the FPGA and the CPU is used for the collaborative work between the two processors to realize the data synchronization function of the FPGA. A channel is provided inside the FPGA. When the CPU accesses the SRAM, the corresponding address bus, data bus and control bus are connected to the SRAM.

[0053] In a preferred solution, in S5, the dual processor collaborative work switching includes: S3-1, when the CPU module works as the main module, the CPU executes the user program and directly operates the relevant components in the external SRAM; S3-2, when the CPU module is used as a hot standby module, the FPGA automatically receives synchronization data from the main CPU; S3-3, the working mode of FPGA is informed by the CPU.

[0054] Preferably, in a dual-processor architecture, the CPU is the main control chip, responsible for all PLC tasks except data synchronization. The FPGA is a coprocessor responsible for data synchronization. There are two RAM spaces and some other registers, counters, etc. inside the FPGA. They have their own independent address spaces, and the CPU can read and write them. Because the SRAM and FPGA internal storage units have different address spaces, the FPGA can decode the address to give the SRAM and FPGA chip select signals and control the bus switch, such as Figure 6 shown.

[0055] When the SRAM chip select signal is valid, the corresponding data address signal is transmitted to the SRAM, and the control signal is transmitted to the SRAM after the logic combination design. When the FPGA chip select is valid, it means that the CPU is operating the FPGA. At this time, the entire bus is transferred to the internal functional module of the FPGA. In the redundant PLC system, the CPU module must be able to serve as a backup module and be in hot standby working state. When the main module fails, it must be able to automatically switch to the working mode of the main module. That is, the functions of two working modes, namely the main / standby mode, must be integrated in the CPU and FPGA, and they must be able to switch automatically.

[0056] In the preferred solution, the system fault handling and state switching mechanism is divided into three types according to the processing results for the fault of the main PLC system: the first is that the system does not need to be switched; the second is that the system performs module-level switching; the third is that the system performs system-level switching.

[0057] Embodiment 2, Fault detection technology is an important part of redundant fault-tolerant technology. Fault detection is the process of determining whether a system has a fault and where the fault occurs. It is the basis for system control reconstruction to isolate, downgrade, recover and upgrade the system.

[0058] The diagnostic function of PLC includes hardware and software diagnosis. Hardware diagnosis determines the location of hardware faults through hardware logic judgment, and software diagnosis is divided into internal diagnosis and external diagnosis. Diagnosis of the internal performance and functions of PLC through software is internal diagnosis, and diagnosis of the information exchange function between PLC CPU and external input and output components through software is external diagnosis. Despite a large number of extensive error diagnoses, some errors may still not be detected. Therefore, it should be pointed out that the backup system is not completely reliable. The design of redundant PLC aims to improve reliability by increasing the coverage of fault detection to maintain control of the machine or process. It can also be said that the reliability of PLC depends to a certain extent on the ability of fault diagnosis.

[0059] The fault detection of this redundant PLC system is mainly designed from the following aspects.

[0060] CPU self-test, The CPU is one of the most important components in the PLC system, so its testing problem is particularly important. However, the testing problem of microprocessors has always been a difficult problem. Because the CPU is a large-scale integrated circuit with a limited number of input and output pins and an extremely complex internal structure, it is difficult to establish an accurate fault model at the logic gate level; on the other hand, the controllability and observability of the fault are greatly reduced due to the limitation of the number of pins. In addition, the control logic part and the data processing logic part are on the same chip, and it cannot be assumed in advance which part is always good, so the test program can only use instructions with potential faults to verify other instructions.

[0061] The main function of the CPU is to execute instructions. Therefore, by checking whether the CPU can correctly execute all its instructions, it can be basically determined whether it can work normally. Among the verification methods of various models, the system instruction self-test is the most effective and feasible. Due to the rich PLC instructions and complex addressing methods, if the CPU wants to test all its instructions, including the combination of various addressing methods, the self-test program will become very long and the execution time will increase accordingly. Therefore, in the PLC CPU self-test, by analyzing and classifying the machine codes of various PLC instructions, several representative instructions of the same type are selected for testing, which can cover all instructions of this type, thereby improving the detection efficiency.

[0062] Storage device self-test, Medium and large PLC systems require a large storage space. A PLC may need to use multiple off-chip storage chips to store user programs and various instruction components. The main storage chips are EEPROM, SRAM, DRAM, etc. Because it is off-chip storage, the power supply of the storage chip, the wiring length, etc. may cause the storage chip to fail. Therefore, in the system fault detection design, the detection of external storage devices is also a part. The main method of self-detection of storage devices is to directly write and read the free space of the storage device. If they are the same, it means that the storage device is normal. During the operation of the system, because it is impossible to know what is specifically stored in the storage device, a value cannot be written first during detection. Instead, the value is read and saved first, and then the value is written to the original address. Finally, the read value is compared with the saved value. If they are consistent, it is considered that the storage device is working normally.

[0063] Module self-test, The I / O modules of PLC generally have a self-detection function, which periodically self-checks and writes the detection results into the status register. Before the system runs, the status of the I / O device can be known by querying the status register or control port of the I / O device. During the operation of the system, it is necessary to regularly detect the operating status of the I / O device. By starting a daemon task in the system, the I / O device is polled regularly to determine the status of each I / O device. For I / O devices that do not respond or have serious faults, the system will register these device error information, which will serve as the basis for judging whether the machine is faulty. "Heartbeat detection" means that two machines monitor each other and send messages to each other at regular intervals to check whether the other party is in normal working condition. "Heartbeat" detection is a common fault detection method for multi-machine systems. The host and the slave regularly send system status information to each other through the high-speed serial port. If the host or the slave does not hear the "heartbeat" of the other party within the specified time, it is considered that the other party has a serious fault.

[0064] There are three situations in which Party A in the system, i.e. Party A is the host or the slave, cannot receive the "heartbeat" signal from Party B, i.e. Party B is the slave or the host.

[0065] (1) Party B encounters a serious failure and the system cannot operate; (2) The program for sending signals regularly in Party B runs away or deadlocks due to the interference of instantaneous fault of system hardware; (3) The communication line between Party A and Party B fails and the "heartbeat" signal cannot be transmitted. At this time, the heartbeat detection program cannot determine which situation has occurred, so it waits for a short period of time. At this time, if the signal from the other party can be received again, it means that the second situation mentioned above has occurred on the other party, or the communication line has temporarily failed, and the system can still work normally; if the signal from the other party is still not received, it means that the first or third situation mentioned above has occurred. At this time, the system can no longer work normally, and the system will handle the fault according to the identity of the machine at that time. If it is a master, it will mark the slave as unavailable, and no information needs to be sent to it, and its own status will be modified; if it is a slave, the system will issue a switching command, and the slave will replace the master.

[0066] In redundant PLCs, it is necessary to be able to achieve non-stop switching or even disturbance-free switching. Therefore, the frequency of heartbeat detection should be greater than or equal to the system scan cycle frequency, otherwise a control "vacuum" may occur.

[0067] Communication fault diagnosis PLC, The design of the system often involves communication with peripheral devices to transfer and exchange data bits. In order to ensure that the communication control module is correctly called and connected in real time, a counter needs to be placed in it. Each time the communication module is executed, the accumulated value is accumulated and stored in the data block of the PLC. When the diagnostic program cannot detect the change of the accumulated value within a specific time, that is, the time setting is different according to different program blocks, a fault message is issued, that is, a communication error. When the communication is initialized, the value of the counter is set to 1, and then 1 is accumulated one by one to obtain the value of the new counter.

[0068] Power-off detection, Power failure is one of the most common PLC failures, so the module should have a power failure detection function. The AC input power module in this design provides an AC_OK power failure detection signal. When the power fails, the AC_OK signal will notify the CPU in the form of an interrupt. If both parallel redundant power modules send a power failure interrupt signal, the CPU will confirm that a power failure has occurred on this rack. Since the power module has an energy storage function, it will take a long time from AC_OK detecting the power failure to the CPU power failure. The CPU can use this time for tasks such as master-slave PLC switching. Of course, if the power module does not fail, but the low-voltage power supply of the CPU fails, the CPU cannot do the corresponding processing. In addition, communication modules, remote I / O modules, etc. should also have power failure detection.

[0069] In the preferred solution, there is no need for switching. In the PLC redundant architecture, the power supply module consists of two modules working in parallel. When one module fails, the other module can provide system power alone without causing any impact on other modules in the system.

[0070] In the preferred solution, during module-level switching, the data synchronization link and the remote I / O module are both module-level parallel redundant. When any one of them fails, only module-level switching is performed without the need for system-level switching. When the CPU detects such a module failure, it will continue to run through another module.

[0071] In the preferred scheme, during system-level switching, when the CPU module, communication module or communication link of the main PLC system fails, there is no module-level parallel redundancy and system-level switching is required. The main PLC system transmits the system status information to the hot standby PLC via an Ethernet communication link or a data synchronization link. After receiving the main module fault information, the hot standby PLC begins to execute the complete system scanning task and enables the input and output at the same time. The PLC runs in stand-alone mode. After the original main PLC system recovers from the fault, it becomes a hot standby PLC through an automatic synchronization link, and the original hot standby PLC becomes the main PLC to form a new redundant system.

[0072] Embodiment 3, Dual-machine collaboration and data synchronization mode, master control decision and transfer, In a two-CPU redundant system, the main PLC has control over the I / O, while the hot standby CPU does not, to ensure that the input and output are controlled by only one CPU. The two CPUs monitor each other's operating status. If the main control CPU module fails and a system-level switch is required, the hot standby CPU will gain control.

[0073] CPU module synchronous control, The hot standby CPU must be ready at any time. Once a system-level switch is required, it will immediately take control and become the master CPU. Therefore, the master CPU must transmit its status information to the hot standby CPU in real time so that the hot standby CPU can keep its status synchronized with itself. In this way, when a system switch is required, the system can be switched without disturbance. The synchronous control flow chart is as follows: Figure 7 shown.

[0074] Dual-machine collaboration and data synchronization mode, The redundant system of PLC requires the cooperation of two PLCs. When there is no fault, the status synchronization between the main and standby PLCs must be guaranteed; when a fault occurs and the system needs to be switched, the smooth switching must be guaranteed. There are two methods for data synchronization between PLCs: hard synchronization and soft synchronization. Hard synchronization is to use special redundant modules or fix the program in the PLC to achieve PLC data synchronization. The main CPU will transmit data to the backup CPU in real time through a dedicated data transmission channel according to a certain method. This method synchronizes faster and does not require user programming. The entire process is automatically completed by hardware. Soft synchronization is a method of user programming that transmits synchronization data to the backup CPU through a communication line according to a certain method. This method has a slow data synchronization speed and is limited by the user's programming level, so the system reliability cannot be guaranteed. This design uses a hardware-based dual-machine hot backup, so its data synchronization is also hard synchronization completed by hardware.

[0075] PLC data synchronization principle, First, let's analyze the data synchronization principle of the redundant PLC system. The underlying software of medium and large PLCs is based on the operating system platform. Different operating systems have different task designs. In terms of the choice of synchronization timing, some perform main task cycle synchronization, such as Modicon's large PLC; some perform each task synchronization, such as AB's large PLC; and Siemens' S7-400 uses their unique event synchronization method. Although the working process of the CPU in different PLC redundant working modes is different, their operating principles can be simply expressed as.

[0076] After the CPU performs input and output scanning or completes program execution, the state of the system will change. Therefore, the main CPU needs to transmit all the components that represent the system state to the backup CPU at a suitable time point, and the backup CPU will then update the values ​​of these transmitted components to its own memory, so that the hot standby CPU maintains the same system state as the main CPU. When a failure occurs, the backup CPU can switch based on the state of the main CPU when the failure occurs, achieving continuous control without stopping.

[0077] Traditional PLC data synchronization methods can be classified into two types: direct data synchronization and transmission data synchronization.

[0078] In direct data synchronization, tasks such as user program execution and data transmission between the main and standby CPUs are completely completed by a single CPU. When the CPU is transmitting synchronization data, it cannot perform other tasks. That is, the work of synchronizing data occupies CPU resources, increases the system scan cycle, and reduces system performance. In recent years, redundant PLCs have developed in the direction of multiple CPUs. That is, in the PLC system, multiple CPU chips are used at the same time, allowing them to complete different tasks respectively, improving system performance.

[0079] In the transmission data synchronization, the data synchronization and related work between the main and standby CPUs are assigned to the coprocessor in the hot standby module. In this way, the CPU only needs to copy the data that needs to be synchronized from the CPU internal memory or external memory to the coprocessor in the hot standby module through the high-speed parallel bus. The coprocessor then independently transmits the synchronized data to the hot standby module in the backup system. During this process, the CPU can perform other tasks. resources without being occupied by data synchronization work.

[0080] The transmission-based data synchronization method avoids the impact of the data transmission rate between the active and standby controllers on the CPU resource usage. However, when the amount of synchronized data is large, the synchronization data transmitted from the CPU to the coprocessor will still occupy a portion of the CPU resources.

[0081] Problems with traditional data synchronization methods: The time taken for data transmission varies depending on the CPU performance and synchronization method of PLC. For example, the time required to transmit 100kBytes of synchronization data is about tens of milliseconds to hundreds of milliseconds or even more. When the amount of synchronization data is large, the data synchronization work will occupy the CPU for a long time, resulting in a longer system scan cycle and reduced real-time performance of the control system. This is the first problem with the traditional PLC synchronization method.

[0082] The first problem with traditional PLC synchronization methods. Based on the performance parameters of some current redundant PLCs, we can give the approximate time required for the main stages in the system scanning cycle: the time required for redundant hot standby related processing: 20ms; the time to execute the user program: 80ms; the time to transmit synchronous data: 60ms, that is, calculated based on the transmission of 200k data at a rate of 100kByte / 30ms. The time for other stages is shorter and can be ignored. It can be seen that the data synchronization time accounts for a large proportion of the entire system scanning cycle. The data synchronization time is mainly determined by two factors: one is the amount of data that needs to be synchronized, and the other is the data transmission rate. The data that needs to be synchronized includes input and output data, timer counter data, user data block data, etc. The system stores this data in the form of data blocks. As long as the data in a data block is updated, the main processor will The entire data block will be transmitted to the slave processor during the synchronization phase. This method has another problem, that is, the amount of data transmitted each time is very large, because the synchronization data efficiency is low. Because in the synchronized data block, there is usually a lot of data that has not changed after the program is executed once, and it is not necessary to update the slave processor. Here, the synchronization data efficiency can be defined as the ratio of the data that needs to be updated by the slave processor to the total synchronized transmission data. The data transmission rate mainly depends on the transmission mode, transmission medium and chip processing speed.

[0083] Design of monitoring data synchronization method,In order to solve the problems of data synchronization process occupying CPU resources and low synchronization data efficiency in traditional redundant PLC data synchronization methods, this paper proposes a method, that is, adding a coprocessor FPGA in each CPU module to form a controller module with a dual CPU architecture, in order to achieve parallel transmission of synchronization data.

[0084] First, we need to distinguish the two levels mentioned in this article: dual controller module redundant architecture and dual CPU architecture. Dual controller module redundant architecture refers to the PLC control system using two controller modules to form a redundant system in order to improve reliability. Dual CPU architecture refers to the two processors of a controller module working in parallel. As mentioned above, the transmission synchronization method also uses a coprocessor to achieve data synchronization.

[0085] Although this method avoids the impact of data transmission rate on CPU resource usage, when the amount of synchronization data is large, the synchronization data transmitted from the CPU to the coprocessor will still occupy more CPU resources. The dual-processor architecture proposed in this paper monitors and records synchronization-related data through the auxiliary processor and independently transmits this data to the slave CPU module, which can be called monitoring synchronization.

[0086] Each CPU module consists of a CPU and an FPGA coprocessor. In this architecture, the CPU only executes user programs and handles interrupts, while data synchronization is done in parallel by the FPGA. The FPGA performs synchronous data transmission in parallel while the CPU executes the program. Therefore, the transmission time of the synchronous data will not affect the CPU's scanning of the program, reducing the CPU's additional overhead. It can be seen that the introduction of FPGA can reduce the system program scanning time, improve real-time performance, and solve the first problem existing in the traditional synchronization method.

[0087] All synchronization-related data in the CPU are accessed in the external RAM through the control bus, address bus and data bus; the FPGA in the main module records the data and corresponding addresses written by the CPU to the external RAM by monitoring the three bus signals. The recorded data information is the updated data generated during the program execution. In this way, the efficiency of the synchronized data information reaches 50%, that is, the address data is auxiliary information, and other synchronization methods do not need to transmit address information, which greatly reduces the amount of synchronized data, thereby reducing the synchronization data transmission time, and solving the second problem in the traditional synchronization method.

[0088] In traditional PLC redundant hot standby architecture, the hot standby module is usually used to detect the CPU's operating status, synchronize the controllers, and transmit synchronous data between the master and standby controllers. In the dual-processor architecture proposed in this paper, the transmission of synchronous data is completed by FPGA, thereby replacing the dedicated hot standby module. According to redundancy theory, the failure of the hot standby module itself will also reduce the reliability of the system. Therefore, replacing the hot standby module with FPGA not only saves space and cost, but also improves the reliability of the redundant system.

[0089] One point that needs to be noted in the monitoring synchronization method is that some major PLC soft elements related to synchronization data, such as counters, except high-speed counters, R elements, D elements, etc. must be placed in external SRAM. Otherwise, FPGA will not be able to monitor and record changes in these data, and thus cannot ensure the integrity of synchronization data. For some special synchronization information, such as system status, if it is not placed in external SRAM, it can be written into the synchronization data queue before the synchronization data is transmitted, and transmitted to the hot standby PLC together with other synchronization data obtained by monitoring and recording.

[0090] As the requirements for PLCs in the field of industrial control continue to increase, and thanks to the development of chip technology and storage technology, the CPU performance of medium and large redundant PLCs is constantly improving, the speed is constantly increasing, and the memory capacity is also increasing. Generally speaking, the speed of medium and large redundant PLCs is at least hundreds of megahertz, and the memory capacity is more than tens of kBytes. The performance of some newly launched redundant PLCs is even more powerful. Take the latest LK large redundant PLC launched by the domestic manufacturer Hollysys as an example. Its CPU frequency is as high as 533MHz, the program storage capacity is 16MBits, and the data storage capacity is 64MBits.

[0091] For the FPGA design proposed in this article, several aspects are mainly considered in the selection of FPGA chips. The first is to consider the resources of the FPGA, including the number of LEs, the number of PLLs, the number of internal RAM units, and the number of IO pins. In particular, since two large RAM spaces need to be opened inside the FPGA to store synchronous data, the selected chip must meet the RAM space requirements of the PLC redundancy function. Secondly, the power supply requirements of the FPGA must be considered. Generally, FPGAs require a variety of voltage levels, and it is necessary to ensure that the system can provide the corresponding power supply voltage. Finally, the speed level of the FPGA must also be considered. In medium and large PLCs, the speed levels of the CPU and external SRAM are relatively high, so the speed of the FPGA must be able to record the synchronous data information in a timely and accurate manner.

[0092] In the preferred scheme, in the state switching mechanism, in a normal redundant PLC system, the working contents of the main PLC and the hot standby PLC are different; when two originally independent PLCs are in the process of establishing a redundant hot standby PLC, or when a failure occurs after the redundant system is established, the states of the two PLCs will be changed.

[0093] Embodiment 4, System troubleshooting, PLC faults are classified according to the working process into four types: power-on detection failure, transition to operation failure, operation failure and user command failure.

[0094] In these faults, a single PLC system without redundancy will also perform corresponding fault detection at the corresponding stage. However, after detecting a fault, the single PLC system can only report an error, enter the fault handling program or directly shut down, but there is no way to keep the control system running continuously without stopping.

[0095] The addition of redundant PLC is to enable the system to ensure continuous operation through some corresponding processing mechanisms after a fault is detected. Therefore, the fault handling mechanism of redundant PLC is an addition or modification based on the fault handling mechanism of the original single PLC system.

[0096] In PLC dual-machine hot standby redundancy, the backup PLC is also working (but it does not execute the user program and the result output is invalid), and detects its own status in real time. Once the hot standby PLC fails, it will exit the hot standby system, and the main PLC system will run in single-machine operation mode. After the hot standby system fails, it will be automatically synchronized and linked to form a hot standby system again.

[0097] The failures of the main PLC system can be divided into three types according to their processing results.

[0098] The first is that the system does not need to switch. In the PLC redundant architecture designed in this paper, the power supply module consists of two modules working in parallel. When one module fails, the other module can provide system power alone without any impact on other modules in the system.

[0099] The second is that the system performs module-level switching. The data synchronization link and remote I / O modules are all module-level parallel redundant. Therefore, when any of them fails, only module-level switching is performed without system-level switching. When the CPU detects this type of module failure, it will continue to operate through another module.

[0100] The third is system-level switching. When the CPU module, communication module or communication link of the main PLC system fails, system-level switching is required because there is no module-level parallel redundancy. The main PLC system transmits system status information to the hot standby PLC through an Ethernet communication link or a data synchronization link. After receiving the main module fault information, the hot standby PLC begins to perform a complete system scan task, while enabling input and output, and the PLC runs in stand-alone mode. After the original main PLC system recovers from the fault, it becomes a hot standby PLC through an automatic synchronization link, and the original hot standby PLC becomes the main PLC to form a new redundant system.

[0101] System state switching mechanism, In a normal redundant PLC system, the work contents of the main PLC and the hot standby PLC are different. Table 3-3 lists the main work contents of the main and standby PLCs in each cycle.

[0102] Synchronous data transmission is an important part of data synchronization. Its function is to ensure that the internal state of the hot standby PLC and the main PLC are periodically synchronized. The synchronous data information includes the values ​​of various PLC components, the values ​​of the input and output image area, and the PLC system status information.

[0103] When two originally independent PLCs are in the process of establishing a redundant hot standby PLC, or when a failure occurs after the redundant system is established, the states of the two PLCs will change.

[0104] PLC has four main fixed states, such as Fig. 9 As shown in the ellipse, they are respectively the main and standby running states, the offline stop state before forming a redundant system, and the offline running state after a fault. The basic principle of PLC in the process of forming a redundant system is: the first one to start is the main PLC, and the one to start later is automatically the hot standby PLC. After the redundant system is established, the PLCs run as the main PLC and the hot standby PLC respectively. The main PLC transmits the synchronization data and the main PLC system status information to the slave PLC in each cycle; the slave PLC also transmits the status information of the hot standby system to the main PLC. The main and standby PLCs determine the state of their own PLCs in the next cycle based on their own states and the states of the other PLCs. After a fault occurs, the PLC system where the faulty module is located will exit the redundant system and become offline; the other PLC system will remain the main PLC system or switch from the hot standby system to the main PLC system. After the faulty module is replaced with a new module, it will be synchronized with the running main PLC system again to become a redundant system.

[0105] The above-mentioned embodiments are only preferred technical solutions of the present invention and should not be regarded as limitations of the present invention. The embodiments and features in the embodiments of the present application can be arbitrarily combined with each other without conflict. The protection scope of the present invention shall be the technical solutions recorded in the claims, including the equivalent replacement solutions of the technical features in the technical solutions recorded in the claims. That is, equivalent replacement improvements within this scope are also within the protection scope of the present invention.

Claims

1. A high-precision redundant excitation system switching method, characterized in that: The steps include: S1, design redundant architecture, including CPU module redundancy, rack redundancy, power supply redundancy, communication dual network redundancy, synchronous data redundancy and I / O module redundancy; S2, analysis, formulates redundant nodes according to the redundant architecture, representing the fault tolerance with fault-tolerant devices or modules; S3, CPU module framework design, the CPU module uses ARM7 chip as the main controller, and an SRAM is connected to the off-chip expansion bus. The main controller and SRAM are connected through FPGA, and FPGA is used as a data synchronization function module; S4, main chip interface circuit design. In addition to the address bus, data bus and control bus between the CPU and FPGA, there are also information exchange lines between the FPGA and CPU and the configuration line of the FPGA. The information exchange lines between the FPGA and CPU are used for the collaborative work between the two processors to realize the data synchronization function of the FPGA. A channel is provided inside the FPGA. When the CPU accesses the SRAM, the corresponding address bus, data bus and control bus are connected to the SRAM. S5, dual-processor collaborative design, CPU is the main control chip, responsible for all PLC tasks except data synchronization, FPGA is the coprocessor, responsible for data synchronization; FPGA has two RAM spaces, registers and counters inside, all with their own independent address space, CPU performs read and write operations on them; S6, fault detection mechanism design, including fault mode definition, fault detection and diagnosis; S7, system fault-tolerant mechanism design, the system fault-tolerant mechanism includes the system operation mechanism definition, dual-machine collaboration and data synchronization mode design, and system fault handling and state switching mechanism.

2. The high-precision redundant excitation system switching method according to claim 1 is characterized in that: In S1, the power module failure in the power redundancy is a module with a higher failure rate in the PLC system. When a power module fails in the system, the system does not need to switch; only when two power modules fail at the same time, the system switches to the PLC system on another rack to continue to execute the control task; only when all four power supplies on the active and standby racks fail, the system will shut down due to power module failure.

3. The high-precision redundant excitation system switching method according to claim 1 is characterized in that: In S2, judging fault tolerance includes: S2-1, when a power module fails, another module connected in parallel provides power alone, and the system is not affected; S2-2, when a data synchronization link or remote I / O module fails, the system automatically switches to another backup module, and the other modules of the control system remain unchanged, realizing module-level switching; S2-3, when the CPU module, communication module, field bus connection line fails or both power modules fail at the same time, the backup PLC system will replace the original main PLC system to run alone, realizing system-level switching.

4. The high-precision redundant excitation system switching method according to claim 1 is characterized in that: In S5, dual processor collaborative switching includes: S3-1, when the CPU module works as the main module, the CPU executes the user program and directly operates the relevant components in the external SRAM; S3-2, when the CPU module is used as a hot standby module, the FPGA automatically receives synchronization data from the main CPU; S3-3, the working mode of FPGA is informed by the CPU.

5. The high-precision redundant excitation system switching method according to claim 1 is characterized in that: System fault handling and state switching mechanism For the main PLC system fault, there are three types according to the processing results: the first is that the system does not need to switch; the second is that the system performs module-level switching; the third is that the system performs system-level switching.

6. The high-precision redundant excitation system switching method according to claim 5 is characterized in that: The system does not need to be switched. In the PLC redundant architecture, the power supply module consists of two modules working in parallel. When one module fails, the other module can provide system power independently without causing any impact on other modules in the system.

7. The high-precision redundant excitation system switching method according to claim 5 is characterized in that: When the system performs module-level switching, the data synchronization link and remote I / O modules are all module-level parallel redundant. When any of them fails, only module-level switching is performed without the need for system-level switching. When the CPU detects such a module failure, it will continue to run through another module.

8. The high-precision redundant excitation system switching method according to claim 5 is characterized in that: During system-level switching, when the CPU module, communication module or communication link of the main PLC system fails, there is no module-level parallel redundancy and system-level switching is required. The main PLC system transmits the system status information to the hot standby PLC through the Ethernet communication link or data synchronization link. After receiving the main module fault information, the hot standby PLC starts to execute the complete system scanning task and makes the input and output valid. The PLC runs in stand-alone mode. After the original main PLC system recovers from the fault, it becomes a hot standby PLC through automatic synchronization link, and the original hot standby PLC becomes the main PLC to form a new redundant system.

9. The high-precision redundant excitation system switching method according to claim 8 is characterized in that: In the state switching mechanism, in a normal redundant PLC system, the working contents of the main PLC and the hot standby PLC are different; when two originally independent PLCs are in the process of establishing a redundant hot standby PLC, or when a failure occurs after the redundant system is established, the states of the two PLCs will change.

Images