Multi-level redundancy control method and system based on multiple entities

Abstract

The invention relates to the technical field of industrial control automation, in particular to a multi-level redundancy control method and system based on multiple entities, and the method comprises the steps: S1, a control entity cluster periodically sends main and standby negotiation messages, and a control entity divides a main control entity, a hot standby control entity and a cold standby control entity according to the main and standby negotiation messages; s2, the main control entity and the hot standby control entity generate redundant data object information, and synchronize the redundant data object information to the data use entity in real time; s3, the data using entity receives redundant data objects sent by the main control entity and the hot standby control entity, a redundant data object k1 generated by the main control entity is preferentially selected according to the data object role identifier, if k1 is invalid, the current main control entity is released, the hot standby control entity is switched to the main control entity, and if k1 is invalid, the main control entity is switched to the hot standby control entity; and the proportion of the main control entity and the hot standby control entity is ensured. According to the invention, undisturbed switching of the control entity is ensured, effective data element replacement is realized, and redundancy reliability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control automation, and in particular to a multi-entity-based multi-level redundant control method and system. Background Art

[0002] With the rapid development of communications technology, control systems are showing a significant trend toward automation and networking. In this context, to enhance control system reliability, traditional technologies typically employ redundant design solutions, primarily encompassing cold standby redundancy, 1:1 hot standby redundancy, and triple or quadruple redundancy.

[0003] During operation, cold standby redundancy technology places the backup device in a dormant state. When the primary device fails, manual intervention is required to connect the backup device, which limits the system's real-time response capabilities. 1:1 hot standby redundancy is node-based. During normal operation, the primary node assumes system tasks. Once the primary node fails, the backup node immediately takes over. However, due to the time delay in switching between the primary and backup nodes, a completely disturbance-free and smooth switchover cannot be achieved, impacting the continuity and stability of system operation. While triple or quadruple redundancy solutions effectively address switching disturbances, increasing the number of redundant nodes reduces overall system availability, leading to a significant increase in hardware and maintenance costs. Furthermore, these redundant systems all rely on nodes for redundancy. When the number of system failures exceeds their designed fault margin, even if the fault locations of each failed node are different, the entire system will still fail, making it difficult to ensure the continued stable operation of the control system.

[0004] In real-world applications, the reliability and fault tolerance requirements for various input and output data in control systems vary significantly. Critical data, while relatively small in quantity, has extremely high reliability requirements; on the other hand, most common data has relatively low reliability requirements. However, traditional control system redundancy design schemes are difficult to change once the architecture is determined, and all data is processed using a unified architecture. This forces the control system to be designed with the highest reliability requirements for critical data in mind, leading to over-allocation of system design resources, significantly increasing control system costs, and significantly limiting both cost-effectiveness and practicality. Summary of the Invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and provide a multi-entity based multi-level redundancy control method, comprising the following steps: S1: The control entity cluster periodically sends a master-slave negotiation message including the control entity ID, role status, and priority. n control entities are divided into 1 master control entity, m-1 hot standby control entities, and nm cold standby control entities according to the master-slave negotiation message. S2: The main control entity and the hot standby control entity generate redundant data object information including data object role identifier, data object validity, data element and data element validity, and synchronize the redundant data object information to the data using entity q in real time; S3: The data using entity q receives the redundant data objects k1 to k2 sent by the main control entity and the hot standby control entity. m , according to the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1.

[0006] Preferably, in step S1, the n control entities are divided into one master control entity, m-1 hot standby control entities and nm cold standby control entities according to the master-standby negotiation message, including: The control entity broadcasts the master-slave negotiation message including the IP address within a preset event window; The hot standby control entity with the highest priority weight is selected as the main control entity. If the priorities are the same, the one with the larger IP address wins as the main control entity. After the election is completed, the main control entity sends a role assignment confirmation message including the generated redundant data object information and data object validity to all control entities. The first m-1 control entities with the second highest priority are used as the hot standby control entities, and the remaining control entities are the cold standby control entities.

[0007] Preferably, in step S2, the main control entity and the hot standby control entity generate redundant data object information and synchronize the redundant data object information to the data using entity q in real time, including: After the main control entity updates its own data object, the main control entity sends a redundant mutually exclusive message including the data object version number and the redundant data object information to the hot standby control entity; After receiving the redundant mutually exclusive message, the hot standby control entity verifies the data object version number and data element. If they are inconsistent, it requests the main control entity to retransmit. If the verification passes, the hot standby control entity updates its own data object and returns a confirmation response, and synchronizes the redundant data object information of all the hot standby control entities and the main control entity to the data using entity q in real time.

[0008] Preferably, the data object role identification, data object validity, data element and data element validity include: The data object role identifier of the redundant data object information includes a function for identifying a primary control role or a hot standby control role, wherein the primary control role is a data object generated by the primary control entity, and the hot standby control role is a data object generated by the hot standby control entity; The data object validity includes timestamp and checksum; The data element is the actual data transmitted by the data object; The data element validity is used to mark the trustworthy status of a single data element and includes the priority of the data object. The control entity q selects the data object with the higher priority to obtain data according to the priority.

[0009] Preferably, in step S3, verifying the validity of the redundant data object k1 further includes: Verify whether the primary control role of the redundant data object k1 is legal. If the identification format does not meet the preset requirements, the redundant data object k1 is judged to be illegal. The signature and priority weight of the data object validity are verified, and the validity of the data element is verified item by item to verify the credibility of the data element. If the main control role of the redundant data object is legal, the signature and priority weight verification are passed, and all data elements are valid, then the redundant data object is judged to be completely valid. If the redundant data object k1 has some invalid data elements but meets the use requirements as a whole, then the redundant data object is judged to be partially valid. If the main control role of the redundant data object is illegal, the signature or priority weight verification fails, or the number of invalid data elements exceeds the threshold, then the redundant data object is judged to be completely invalid. Among them, the overall satisfaction of the use requirements is that the invalid data elements of the redundant data object k1 are eliminated by selecting the redundant data objects k2~redundant data objects k1 of the hot standby control entity. m The valid data elements in replace the invalid data elements, making the redundant data object k1 valid as a whole.

[0010] Preferably, in step S3, if the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1, further comprising: When the redundant data object k1 is invalid, the data using entity q sends an error response to the main control entity and selects redundant data objects k2 to k3 of the hot standby control entity according to the data object role identifier and data object validity priority. m-1 Select the hot standby data object; In response to the error response, the master control entity releases the master control role, selects the hot standby control entity as the master control entity, and triggers the cold standby control entity to join the hot standby control entity group to maintain a 1:m-1 hot standby ratio.

[0011] Preferably, triggering the cold standby control entity to join the hot standby control entity group includes: screening available entities based on a self-diagnosis result of the cold standby control entity; Update the data object role identifier of the newly added new hot standby control entity to the hot standby state; Send a hot standby group update notification to the data using entity q.

[0012] Based on the same concept, the present invention also provides a multi-entity-based multi-level redundant control system, comprising: A master-slave negotiation module is configured to periodically send a master-slave negotiation message including the control entity ID, role status, and priority to the control entity cluster. The n control entities are divided into one master control entity, m-1 hot standby control entities, and nm cold standby control entities according to the master-slave negotiation message. A redundant data object generation module, wherein the main control entity and the hot standby control entity generate redundant data object information including data object role identification, data object validity, data elements and data element validity, and synchronize the redundant data object information to the data use entity q in real time; The data fault tolerance module, the data using entity q receives the redundant data objects k1 to k2 sent by the main control entity and the hot standby control entity. m , according to the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1.

[0013] Preferably, the verifying the validity of the redundant data object k1 further includes: Verify whether the primary control role of the redundant data object k1 is legal. If the identification format does not meet the preset requirements, the redundant data object k1 is judged to be illegal. The signature and priority weight of the data object validity are verified, and the validity of the data element is verified item by item to verify the credibility of the data element. If the main control role of the redundant data object is legal, the signature and priority weight verification are passed, and all data elements are valid, then the redundant data object is judged to be completely valid. If the redundant data object k1 has some invalid data elements but meets the use requirements as a whole, then the redundant data object is judged to be partially valid. If the main control role of the redundant data object is illegal, the signature or priority weight verification fails, or the number of invalid data elements exceeds the threshold, then the redundant data object is judged to be completely invalid. Among them, the overall satisfaction of the use requirements is that the invalid data elements of the redundant data object k1 are eliminated by selecting the redundant data objects k2~redundant data objects k1 of the hot standby control entity. m The valid data elements in replace the invalid data elements, making the redundant data object k1 valid as a whole.

[0014] Preferably, if the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1, further comprising: When the data object k1 is invalid, the data using entity q sends an error response to the main control entity and selects redundant data objects k2 to k3 of the hot standby control entity according to the data object role identifier and data object validity priority. m Select the hot standby data object; In response to the error response, the master control entity releases the master control role, selects the hot standby control entity as the master control entity, and triggers the cold standby control entity to join the hot standby control entity group to maintain a 1:m-1 hot standby ratio.

[0015] Compared with the prior art, the present invention has the following beneficial effects: The present invention uses a control entity cluster to periodically send master-slave negotiation messages. According to the master-slave negotiation messages, n control entities are divided into one master control entity, m-1 hot standby control entities, and nm cold standby control entities. This implements a highly redundant architecture, with n control entities generating redundant data objects and one master control entity generating low-level data, thereby ensuring reliability and reducing costs. The present invention generates redundant data object information including data object role identification, data object validity, data elements and data element validity through a main control entity and a hot standby control entity, and synchronizes the redundant data object information to a data user entity q in real time, so that both the main control entity and the hot standby control entity send the redundant data object information to a control entity that uses the redundant data object, and the data user entity q that uses the redundant data object information completes data deduplication and regeneration; The present invention receives redundant data objects k1 to k2 sent by the main control entity and the hot standby control entity through the data using entity q. m-1 , based on the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1. When the data object sent by the main control entity is invalid, the data of the standby hot standby control entity is immediately switched, thereby ensuring non-disruptive switching. When the data elements in the data object are invalid, they are replaced by valid data elements, thereby improving the redundancy reliability as much as possible, with high reliability and flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Various other advantages and benefits will become apparent to those skilled in the art by reading the following detailed description of the preferred embodiment.The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the invention.

[0017] Figure 1 It is a flow chart of the multi-entity-based multi-level redundant control method of the present invention; Figure 2 This is a structural diagram of the multi-entity-based multi-level redundant control method of the present invention; Figure 3 Schematic diagram of redundant data object information of the multi-entity-based multi-level redundancy control method of the present invention; Figure 4 This is a verification flow chart of the multi-entity-based multi-level redundant control method of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Obviously, the embodiments described are part of the embodiments of this application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without making creative work are within the scope of protection of this application.

[0019] Those skilled in the art will understand that, unless otherwise specified, the singular forms "a," "an," and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0020] The technical terms involved in the embodiments of the present invention are defined as follows: 1. Control entity: It is the producer and consumer of data and the carrier of data objects. It is composed of an actual controller or a virtual program. 2. Published data object: It is a data fragment and the smallest unit used by a control entity to publish data. It consists of a data object ID, alias, data, and data description. A published data object is generated by a source control entity and published to one or more target control entities through communication. The target control entity uses the data of the published data object by running control logic. 3. Data object: A data fragment, the smallest unit used to control data exchange between entities. Each data object can independently define the sending and receiving mechanism to ensure that the sending and receiving behavior has minimal impact on the controlling entity. Each data object has a unique identification number, and the controlling entity must provide a unique identification number when using the data object data.

[0021] Example 1 This embodiment provides a graphical configuration method for collaborative parameters among multiple entities of a control system in field engineering applications such as ships, marine engineering, and engineering vehicles. This embodiment introduces the concept of data objects, visualizes the data to be published as a data object, and the control entity generates the data object and publishes it to the control entity that uses the data. The connection between the two establishes a visual association. At the same time, this embodiment establishes a locking mechanism for multi-user use. The control entity being edited by the current user is automatically locked and marked, and other users cannot edit it, thereby avoiding the possibility of unexpected modifications.

[0022] See also Figure 1 and Figure 2 As shown, this embodiment provides a multi-entity based multi-level redundancy control method, comprising the following steps: S1: The control entity cluster periodically sends a master-standby negotiation message including the control entity ID, role status and priority. The n control entities are divided into 1 master control entity, m-1 hot standby control entities and nm cold standby control entities according to the master-standby negotiation message. Specifically, in this embodiment, the m-1 hot standby control entities are hot standby control entity 2 to hot standby control entity m, and the role status is the current role cold standby control entity, hot standby control entity or cold standby control entity. The master control entity is the node with the highest priority. If the priorities are the same, the one with the smallest ID can be selected. The hot standby control entity is the node with the second highest priority, and the cold standby control entity is the remaining node, which is only in the listening state and does not participate in fast switching.

[0023] Preferably, in step S1, n control entities are divided into one master control entity, m-1 hot standby control entities and nm cold standby control entities according to the master-standby negotiation message, including: The control entity broadcasts a master-slave negotiation message including the IP address within a preset event window. Specifically, in this embodiment, the powered-on control entity proactively sends a master-slave negotiation message to all nodes in the control domain. The master-slave negotiation message also declares its own health (hardware / software status score), performance metrics (CPU / memory utilization, etc.), and generates a data object list (including data object k). The hot standby control entity with the highest priority weight is selected as the main control entity. If the priorities are the same, the one with the larger IP address wins as the main control entity. After the election is completed, the main control entity sends a role assignment confirmation message including the generated redundant data object information and data object validity to all control entities. The first m-1 control entities with the second highest priority are used as hot standby control entities, and the remaining control entities are cold standby control entities. Specifically, in this embodiment, the hot standby control entity performs main and standby election based on strategies such as health priority, performance priority, address priority, and custom priority.

[0024] When n=5, m=3, and the node priorities are as follows, Node A has the highest priority and is selected as the primary control entity: Node A (ID = 1, priority = 100) Node B (ID = 2, priority = 90) Node C (ID = 3, priority = 90) Node D (ID = 4, priority = 80) Node E (ID = 5, priority = 70).

[0025] Furthermore, this embodiment implements a mechanism of 1 main control entity, m hot standby control entities, and n-m cold standby control entities, with a fault margin of n-1, that is, the system operation will fail only when the invalid data elements in the data object k generated by the n control entities are the same.

[0026] S2: The main control entity and the hot standby control entity generate redundant data object information including data object role identification, data object validity, data elements and data element validity, and synchronize the redundant data object information to the data use entity q in real time. Specifically, in this embodiment, please refer to Figure 3 As shown, the redundant data object information is a data segment, which contains four types of information: data object role identification, data object validity, several data elements and their data validity. The data using entity q can choose which entity's data to use based on the priority of the main control entity and the hot standby control entity, that is, the data of the main control entity is used first, and the data of the hot standby control entity is used only when the data of the main control entity is invalid or unavailable.

[0027] Preferably, in step S2, the main control entity and the hot standby control entity generate redundant data object information and synchronize the redundant data object information to the data using entity q in real time, including: After updating its own data object, the master control entity sends a redundant mutual exclusion message including the data object version number and redundant data object information to the hot standby control entity. Specifically, in this embodiment, when control entities 1 to n that generated data object list k have completed negotiation and there are m hot standby control entities, a redundant mutual exclusion message is issued to the control entity that actively initiated the master-standby negotiation message, and the control entity enters a silent state. After receiving the redundant mutually exclusive message, the hot standby control entity verifies the data object version number and data elements. If they are inconsistent, it requests the main control entity to retransmit. If the verification passes, the hot standby control entity updates its own data object and returns a confirmation response, and synchronizes the redundant data object information of all hot standby control entities and the main control entity to the data using entity q in real time. Specifically, in this embodiment, the data using entity q can receive data from the main control entity and multiple hot standby control entities at the same time, and adopt strategies such as majority voting or master priority principle to handle data inconsistencies.

[0028] Preferably, the data object role identification, data object validity, data element and data element validity include: The data object role identifier of the redundant data object information includes a identifier for identifying the primary control role or the hot standby control role, wherein the primary control role is a data object generated by the primary control entity, and the hot standby control role is a data object generated by the hot standby control entity. Specifically, in this embodiment, the control entity q gives priority to the primary control role; Data object validity includes timestamp and checksum (hash value of all data elements); The data element is the actual data transferred by the data object (e.g. control cycle = 50ms); The data element validity is used to mark the trustworthy status of a single data element and includes the priority of the data object. The control entity q selects the data object with the higher priority to obtain the data according to the priority.

[0029] See also Figure 4 As shown, the data using entity q receives the redundant data objects k1~ redundant data objects k1 sent by the main control entity and the hot standby control entity. m, based on the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1. Specifically, in this embodiment, the control entity q does not pay attention to the master-standby negotiation of the control entities 1~n, but only pays attention to the master-standby information of the data object k. The control entity q uses the data object k to complete the control function. When using data, it first confirms that the data object k is the main data object k1. When the main control entity and the hot standby control entity 1~m fail, a control entity is selected from the cold standby control entities m+1~n to join the hot standby control entity to complete the replacement and maintain the 1:m hot standby state.

[0030] Furthermore, this embodiment implements a triple verification mechanism for redundant data object k, that is, the control entity q performs validity check on data object k through the master-slave identifier, data object validity identifier, and data element validity identifier, so as to ensure the most complete data validity possible in the event of an anomaly.

[0031] Preferably, in step S3, verifying the validity of the redundant data object k1 further includes: Verify whether the primary control role of the redundant data object k1 is legal. If the identification format does not meet the preset requirements, the redundant data object k1 is determined to be illegal. Specifically, in this embodiment, the verification of whether the primary control role is legal can be determined based on a specific string format, length limit, character range, etc. If the identification format does not meet the preset requirements, the data object is determined to be illegal and use of the data object is directly rejected. An error log can be recorded and error information is fed back to the sender. Verify the signature and priority weight of the validity of the data object. Specifically, in this embodiment, the signature verification is to extract the signature information from the data object. The signature is usually generated by encrypting the key information of the data object (such as data content, version number, timestamp, etc.) using the sender's private key. The data use entity q uses the sender's public key to decrypt the signature and compare it with the hash value of the key information calculated locally. If the decrypted signature is consistent with the locally calculated hash value, it means that the signature verification is successful and the data object has not been tampered with during transmission; otherwise, the data object is judged to be invalid and the use of the data object is rejected. Verifying the priority weight is to check whether the priority weight of the data object is within a reasonable range. The priority weight range can be set from 0 to 100. If the priority weight exceeds the preset range, the data object is judged to be invalid and the use of the data object is rejected. An error log can be recorded and error information can be fed back to the sender. The validity of data elements is verified item by item to ensure the credibility of data elements. Specifically, in this embodiment, if the data object k1 is invalid and the validity identifier is marked as invalid, the data usage entity q will invalidate the data object k1 and send a redundant data object k1 error response to the main control entity to maintain the validity of the data object k as a whole.

[0032] Preferably, the validity of data elements is verified item by item to determine the credibility of the data elements, including: Check whether the data type of the data element meets the expectations. For example, if a data element should be of integer type but is actually of string type, the data element is considered invalid. For numeric data elements, check whether their values ​​are within a reasonable range. For example, the reasonable range of a temperature data element is 0-100°C. If the received value exceeds this range, the data element is considered invalid. For string data elements, check whether their format complies with specific rules. For example, the format of a date data element should be "YYYY - MM - DD". If the actual received format does not meet the requirements, the data element is considered invalid. There may be dependencies between certain data elements. Check whether these dependencies are met. For example, the value of a data element must be greater than the value of another data element. If this condition is not met, the relevant data elements are judged invalid.

[0033] If the primary control role of the redundant data object is legal, the signature and priority weight verification are passed, and all data elements are valid, then the data object is considered completely valid and the data-using entity q can use the data object normally for business processing; If the redundant data object has some invalid data elements, but the whole object still meets the use requirements, then the data object is judged to be partially valid, where the invalid data elements of the redundant data object k1 are met by selecting the redundant data objects k2~redundant data objects k1 of the hot standby control entity. m The valid data elements in the data object k1 are replaced by the valid data elements to make the redundant data object k1 valid as a whole. For example, if the physical channel of the main control room diagnoses an error, resulting in the data element k1 of the data object k1 being 1.i When no longer trusted, data element k 1.i The validity identification is marked as invalid. At this time, the control entity q retrieves the hot standby data objects k2~k received at the same time according to the priority in the validity of the data object. m , select redundant data object k2~ redundant data object k m Valid data element k in x.i Replace the invalid data element k in data object k11.i , making the redundant data object k1 valid as a whole.

[0034] If the primary control role of the data object is illegal, the signature or priority weight verification fails, or the number of invalid data elements exceeds the threshold, the data object is judged to be completely invalid, and the data-using entity q refuses to use the data object and can take corresponding measures, such as requesting the sender to resend the data, switching to other available data objects, etc.

[0035] Furthermore, in this embodiment, the data object k is prioritized according to a preset strategy to obtain a priority weight, wherein the main control entity has the highest priority, and the hot standby control entity priority is adjusted according to the preset strategy, so that the control entity q receives k1~k m ,When the main data object k1 is abnormal, the data object k2 with the highest priority is selected to replace it.

[0036] Preferably, in step S3, if the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1, further comprising: When the data object k1 is invalid, the data using entity q sends an error response to the main control entity and selects the redundant data objects k2 to k1 from the hot standby control entity according to the data object role identifier and data object validity priority. m-1 Select the hot standby data object; In response to the error response, the master control entity releases the master control role, selects the hot standby control entity as the master control entity, and triggers the cold standby control entity to join the hot standby control entity group to maintain a 1:m-1 hot standby ratio. Specifically, in this embodiment, after the master control entity receives the error response message of the data object k1, it chooses to release the master control role or continue to maintain the master control role according to the preset strategy. After the master control role is released, a new master control entity for generating data object k is designated. The master-standby switching is only valid for data object k, and the remaining data objects are not affected. At the same time, the new master control entity selects a new control entity from the control entities m+1~n to join the hot standby control entity to maintain a 1:m-1 hot standby ratio, thereby ensuring that the system can still ensure that the validity of the 1:m data objects is not degraded before nm faults occur. The cold standby entities m+1~n only self-diagnose to ensure that they have the ability to generate data objects, and send a fault alarm to the diagnosis system when they do not have the ability.

[0037] Preferably, triggering the cold standby control entity to join the hot standby control entity group includes: Available entities are screened based on the self-diagnosis results of the cold standby control entities. Specifically, in this embodiment, after the main control entity releases the main control role, it broadcasts a message to all cold standby control entities triggering joining the hot standby group. After receiving the message, the cold standby control entity immediately starts a self-diagnosis program to check whether its own hardware devices, such as the CPU, memory, storage devices, network interfaces, etc., are working properly, check whether the running software programs, including the operating system, application programs, drivers, etc., are normal, check whether the locally stored data objects are consistent with the data objects of the current hot standby group, and judge the consistency of the data by comparing the version number, checksum and other information of the data objects; The data object role identifier of the newly added hot standby control entity is updated to the hot standby state. Specifically, in this embodiment, the master control entity selects an appropriate entity from the screened available cold standby control entities to join the hot standby group (based on preset rules such as priority and performance). It then sends a role update instruction to the newly added cold standby control entity, requesting it to update its data object role identifier to the hot standby state. After receiving the role update instruction, the newly added cold standby control entity updates its own data object role identifier from the cold standby state to the hot standby state. At the same time, based on the latest data object information provided by the master control entity, the local data object is updated to ensure consistency with the data in the hot standby group. Send a hot standby group update notification to the data-using entity q. Specifically, in this embodiment, the main control entity (temporary coordination role) prepares a hot standby group update notification. The notification content includes relevant information of the newly added hot standby control entity, such as the control entity ID, IP address, data object version number, etc., as well as the latest status information of the hot standby group.

[0038] Furthermore, the redundancy of the control system in this embodiment only switches the primary and backup data objects k, and other data objects generated by the control entity are not affected. When the control entity q collects invalid data elements in the data object, it uses the valid data elements in the data object k with the highest priority to replace them. Even if n control entities fail at the same time, as long as the invalid data is not the same data element in the same redundant data object, this embodiment can still achieve delay-free and disturbance-free switching, that is, improve the fault tolerance of the data object.

[0039] Example 2 Based on the same concept, this embodiment also provides a multi-entity-based multi-level redundant control system, including: The master-slave negotiation module is used to control the entity cluster to periodically send master-slave negotiation messages including the control entity ID, role status and priority. The n control entities are divided into 1 master control entity, m-1 hot standby control entities and nm cold standby control entities according to the master-slave negotiation messages. Redundant data object generation module, the main control entity and the hot standby control entity generate redundant data object information including data object role identification, data object validity, data elements and data element validity, and synchronize the redundant data object information to the data use entity q in real time; In the data fault-tolerant module, the data using entity q receives the redundant data objects k1~k1 sent by the main control entity and the hot standby control entity. m , according to the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1.

[0040] Preferably, the verifying the validity of the redundant data object k1 further includes: Verify whether the primary control role of the redundant data object k1 is legal. If the identification format does not meet the preset requirements, the redundant data object k1 is judged to be illegal. The signature and priority weight of the data object validity are verified, and the validity of the data element is verified item by item to verify the credibility of the data element. If the primary control role of the redundant data object is legal, the signature and priority weight verification are passed, and all data elements are valid, then the redundant data object is judged to be completely valid. If the redundant data object k1 has some invalid data elements, but the overall usage requirements are met, then the redundant data object is judged to be partially valid. If the primary control role of the redundant data object is illegal, the signature or priority weight verification fails, or the number of invalid data elements exceeds the threshold, then the redundant data object is judged to be completely invalid. Among them, the overall satisfaction of the usage requirements is that the invalid data elements of the redundant data object k1 are eliminated by selecting the redundant data objects k2 to k3 of the hot standby control entity. m The valid data elements in replace the invalid data elements, making the redundant data object k1 valid as a whole.

[0041] Preferably, if the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1, further comprising: When the data object k1 is invalid, the data using entity q sends an error response to the main control entity and selects redundant data objects k2 to k3 of the hot standby control entity according to the data object role identifier and data object validity priority. m Select the hot standby data object; In response to the error response, the master control entity releases the master control role, selects the hot standby control entity as the master control entity, and triggers the cold standby control entity to join the hot standby control entity group to maintain a 1:m-1 hot standby ratio.

[0042] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A multi-level redundant control method based on multiple entities, characterized in that: The following steps are involved: S1: The control entity cluster periodically sends a master-slave negotiation message including the control entity ID, role status, and priority. n control entities are divided into 1 master control entity, m-1 hot standby control entities, and nm cold standby control entities according to the master-slave negotiation message. S2: The main control entity and the hot standby control entity generate redundant data object information including data object role identifier, data object validity, data element and data element validity, and synchronize the redundant data object information to the data using entity q in real time; S3: The data using entity q receives the redundant data objects k1 to k2 sent by the main control entity and the hot standby control entity. m , according to the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1.

2. The multi-entity-based multi-level redundant control method according to claim 1, characterized in that: In step S1, the n control entities are divided into one master control entity, m-1 hot standby control entities and nm cold standby control entities according to the master-standby negotiation message, including: The control entity broadcasts the master-slave negotiation message including the IP address within a preset event window; The hot standby control entity with the highest priority weight is selected as the main control entity. If the priorities are the same, the one with the larger IP address wins as the main control entity. After the election is completed, the main control entity sends a role assignment confirmation message including the generated redundant data object information and data object validity to all control entities. The first m-1 control entities with the second highest priority are used as the hot standby control entities, and the remaining control entities are the cold standby control entities.

3. The multi-entity based multi-level redundant control method according to claim 1, characterized in that: In step S2, the main control entity and the hot standby control entity generate redundant data object information and synchronize the redundant data object information to the data using entity q in real time, including: After the main control entity updates its own data object, the main control entity sends a redundant mutual exclusion message including the data object version number and the redundant data object information to the hot standby control entity; After receiving the redundant mutually exclusive message, the hot standby control entity verifies the data object version number and data element. If they are inconsistent, it requests the main control entity to retransmit. If the verification passes, the hot standby control entity updates its own data object and returns a confirmation response, and synchronizes the redundant data object information of all the hot standby control entities and the main control entity to the data using entity q in real time.

4. The multi-entity based multi-level redundant control method according to claim 3, characterized in that: Data object role identification, data object validity, data elements, and data element validity, including: The data object role identifier of the redundant data object information includes a function for identifying a primary control role or a hot standby control role, wherein the primary control role is a data object generated by the primary control entity, and the hot standby control role is a data object generated by the hot standby control entity; The data object validity includes timestamp and checksum; The data element is the actual data transmitted by the data object; The data element validity is used to mark the trustworthy status of a single data element and includes the priority of the data object. The control entity q selects a redundant data object with a high priority according to the priority to obtain data.

5. The multi-entity based multi-level redundancy control method according to claim 1, characterized in that: In step S3, verifying the validity of the redundant data object k1 further includes: Verify whether the primary control role of the redundant data object k1 is legal. If the identification format does not meet the preset requirements, the redundant data object k1 is judged to be illegal. The signature and priority weight of the data object validity are verified, and the validity of the data element is verified item by item to verify the credibility of the data element. If the primary control role of the redundant data object is legal, the signature and priority weight verification are passed, and all data elements are valid, then the redundant data object is judged to be completely valid. If the redundant data object k1 has some invalid data elements, but the overall usage requirements are met, then the redundant data object is judged to be partially valid. If the primary control role of the redundant data object is illegal, the signature or priority weight verification fails, or the number of invalid data elements exceeds the threshold, then the redundant data object is judged to be completely invalid. Among them, the overall satisfaction of the usage requirements is that the invalid data elements of the redundant data object k1 are eliminated by selecting the redundant data objects k2 to k3 of the hot standby control entity. m The valid data elements in replace the invalid data elements, making the redundant data object k1 valid as a whole.

6. The multi-entity-based multi-level redundancy control method according to claim 5, characterized in that: In step S3, if the verification result is invalid, the current main control entity is released, and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1, further comprising: When the redundant data object k1 is invalid, the data using entity q sends an error response to the main control entity and selects redundant data objects k2 to k3 of the hot standby control entity according to the data object role identifier and data object validity priority. m Select the hot standby data object; In response to the error response, the master control entity releases the master control role, selects the hot standby control entity as the master control entity, and triggers the cold standby control entity to join the hot standby control entity group to maintain a 1:m-1 hot standby ratio.

7. The multi-entity based multi-level redundancy control method according to claim 6, characterized in that: Triggering the cold standby control entity to join the hot standby control entity group includes: screening available entities based on a self-diagnosis result of the cold standby control entity; Update the data object role identifier of the newly added new hot standby control entity to the hot standby state; Send a hot standby group update notification to the data using entity q.

8. A multi-entity based multi-level redundant control system, characterized in that: include: A master-slave negotiation module is configured to periodically send a master-slave negotiation message including the control entity ID, role status, and priority to the control entity cluster. The n control entities are divided into one master control entity, m-1 hot standby control entities, and nm cold standby control entities according to the master-slave negotiation message. A redundant data object generation module, wherein the main control entity and the hot standby control entity generate redundant data object information including data object role identification, data object validity, data elements and data element validity, and synchronize the redundant data object information to the data use entity q in real time; Data fault tolerance module, the data using entity q receives redundant data objects k1 to k2 sent by the main control entity and the hot standby control entity m , according to the data object role identifier, the redundant data object k1 generated by the main control entity is preferentially selected, and the validity of the redundant data object k1 is verified. If the verification result is invalid, the current main control entity is released and the hot standby control entity is switched to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1.

9. The multi-entity based multi-level redundant control system according to claim 8, characterized in that: The verifying the validity of the redundant data object k1 further includes: Verify whether the primary control role of the redundant data object k1 is legal. If the identification format does not meet the preset requirements, the redundant data object k1 is judged to be illegal. The signature and priority weight of the data object validity are verified, and the validity of the data element is verified item by item to verify the credibility of the data element. If the primary control role of the redundant data object is legal, the signature and priority weight verification are passed, and all data elements are valid, then the redundant data object is judged to be completely valid. If the redundant data object k1 has some invalid data elements, but the overall usage requirements are met, then the redundant data object is judged to be partially valid. If the primary control role of the redundant data object is illegal, the signature or priority weight verification fails, or the number of invalid data elements exceeds the threshold, then the redundant data object is judged to be completely invalid. Among them, the overall satisfaction of the usage requirements is that the invalid data elements of the redundant data object k1 are eliminated by selecting the redundant data objects k2 to k3 of the hot standby control entity. m The valid data elements in replace the invalid data elements, making the redundant data object k1 valid as a whole.

10. The multi-entity based multi-level redundant control system according to claim 9, characterized in that: If the verification result is invalid, releasing the current main control entity and switching the hot standby control entity to the main control entity to ensure that the ratio of the main control entity to the hot standby control entity is 1:m-1, further comprising: When the data object k1 is invalid, the data using entity q sends an error response to the main control entity and selects redundant data objects k2 to k3 of the hot standby control entity according to the data object role identifier and data object validity priority. m Select the hot standby data object; In response to the error response, the master control entity releases the master control role, selects the hot standby control entity as the master control entity, and triggers the cold standby control entity to join the hot standby control entity group to maintain a 1:m-1 hot standby ratio.

Images