A control method for actuators of distributed redundant control systems

Abstract

The present invention discloses a control method for a distributed redundant control system actuator, comprising: a main actuator broadcasts a first command or first data; if the main actuator broadcasts the first command, all actuators obtain an execution result based on the first command, and use the execution result as the first result; if the main actuator broadcasts the first data, all actuators compare the received first data with their own newly added data, and use the comparison result as the first result; each actuator broadcasts the first result to other actuators, and all actuators vote based on the received first result; the main actuator collects the voting results and determines whether the vote is passed, and if the vote is passed, the first result is used as the final execution result. The control method for the distributed redundant control system actuator provided by the present invention makes the system operation more stable and safe by voting and electing the actuators.

Description

Technical Field

[0001] The present invention relates to a control system actuator applied to the field of industrial control, and in particular to a control method for a distributed redundant control system actuator. Background Art

[0002] In the field of industrial control, people have very high requirements for the security and reliability of industrial software. As a software that directly controls the control system, the security and reliability of the control system actuator directly affect the safe production of the entire workshop and even the entire project. Independently running actuators may be offline, faulty, and unavailable due to network environment, equipment status, and human factors, thus affecting production.

[0003] The currently commonly used master-slave redundancy technical solution realizes the stable and safe operation of the control system actuator. The operating data is kept synchronized on the master and slave actuators, and switching is carried out according to the decision of a third party when an abnormality occurs.

[0004] However, the above-mentioned master-slave redundancy technical solution inevitably relies on a third party for arbitration, which will lead to failure when the third party loses connection or fails. On the other hand, since the use of database to synchronize operation data means that the data is generated by the master actuator, when the data source connected to the master actuator is unstable or the master actuator is attacked, the slave actuator cannot provide verification or error correction functions. Summary of the invention

[0005] In order to improve the stability and safety of the actuator, the present invention provides a reliable and safe control method for the distributed redundant control system actuator. By voting and electing the execution results of the distributed redundant control actuator, the operation of the actuator of the control system can be made more stable and safe, and the anti-interference ability and robustness of the actuator are improved.

[0006] The technical solution adopted by the present invention to overcome its technical problems is: a control method for a distributed redundant control system actuator, applied to a control system including at least three actuators, wherein the actuators include at most one master actuator and no less than two slave actuators, specifically including: the master actuator broadcasts a first command or first data; if the master actuator broadcasts the first command, all actuators in the system obtain an execution result based on the first command, and use the execution result as the first result; if the master actuator broadcasts the first data, all actuators in the system compare the received first data with their own newly added data, and use the comparison result as the first result; each actuator broadcasts the first result to other actuators respectively, and all actuators vote respectively based on the received first result; the master actuator collects the voting results, and determines whether the vote is passed based on the voting results, and if the vote is passed, the first result is used as the final execution result.

[0007] The first command is used for distributed execution of distributed redundant control system actuators, and the first data is used for data synchronization.

[0008] Furthermore, if the voting result is passed, it also includes increasing the weight of the executor that voted in favor.

[0009] The weights of the executors affect the results of elections and voting.

[0010] Furthermore, if an abnormality occurs in the main executor, the slave executor is changed to a candidate executor based on the detected abnormality and re-initiates the election of the main executor.

[0011] Furthermore, the slave executor is changed to a candidate executor based on the detected anomaly and re-initiates the election of the master executor, specifically including: the candidate executor increments the term ID and then initiates the election of the master executor, votes for itself, and collects the voting results after broadcasting the voting request; determines whether it wins the election based on the collected voting results; if the election is successful, the new master executor publishes the winning election and term ID, and the remaining executors become slave executors; if the election fails, the candidate executor re-initiates the election of the master executor at a preset interval.

[0012] Furthermore, if the master executor recovers during the election process, it becomes a candidate executor to participate in the election of the master executor. If the master executor recovers after a new master executor is elected, it becomes a slave executor.

[0013] Furthermore, if the main executor broadcasts the first command, the main executor also writes the final result into the controller.

[0014] Furthermore, if the main executor broadcasts the first data, it also includes all executors writing the final result into a database or cache.

[0015] Furthermore, all executors vote based on the first result received, specifically including: all executors collect the execution results of other executors and the corresponding weight of each executor. If the execution result of the executor cannot be collected, it will be ignored. If the weight of the executor cannot be collected, the weight collected last time will be used. If the ratio of the collected executor weights that meet the results and the total weight is greater than the first preset threshold, the executor votes in favor.

[0016] Furthermore, the main executor collects voting results and determines whether the vote is passed based on the voting results, specifically including: if the main executor collects votes from all executors, if the ratio of the number of votes to the total number of votes is greater than a second preset threshold, the voting result is judged to be passed.

[0017] Furthermore, if the voting result fails, the main executor broadcasts the first command or the first data repeatedly.

[0018] The beneficial effects of the present invention are:

[0019] 1. The control system actuator adopts a more flexible distributed redundant architecture, so that each actuator participates in the execution process under normal circumstances, thereby providing better data reliability, security and robustness.

[0020] 2. Through the election and voting of the executors, the execution of the executors is made more reliable and safer. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flow chart of a control method for an actuator of a distributed redundant control system according to an embodiment of the present invention;

[0022] Figure 2 A schematic flow chart of a distributed execution method of a distributed redundant control system actuator according to an embodiment of the present invention;

[0023] Figure 3 A schematic flow chart of a data synchronization method for a distributed redundant control system actuator according to an embodiment of the present invention;

[0024] Figure 4 The figure is a flow chart of a method for selecting an actuator of a distributed redundant control system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0026] Before describing the technical solution of the distributed redundant control system actuator of the present invention, some special terms related to the solution are first explained:

[0027] Distributed: Spread a system across multiple computers to achieve higher performance and better reliability

[0028] Redundancy: A backup system provided for safety and reliability, usually with hot-swap function

[0029] Actuator: A piece of hardware or software that executes a process or logic. It is located at the upper layer of the control system and has the ability to directly control the control system. Its function can be expressed as: Actuator (previous state, event) = next state.

[0030] State: specifically refers to the state of a system. Usually a system can be described by a state model.

[0031] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0032] like Figure 1 As shown, a control method for a distributed redundant control system actuator proposed by the present invention is applied to a control system including at least one master actuator and two slave actuators. The control method for the distributed redundant control system actuator specifically includes: the master actuator broadcasts a first command or first data. If the master actuator broadcasts the first command, all actuators in the system execute the command based on the first command to obtain an execution result, and use the execution result as the first result; if the master actuator broadcasts the first data, all actuators in the system compare the received first data with their own newly added data, and use the comparison result as the first result. Each actuator broadcasts the first result to other actuators respectively, and all actuators vote based on the received first result. The master actuator collects the voting results and determines whether the vote is passed based on the voting results. If the voting result is passed, the first result is used as the final execution result.

[0033] In some implementations, the first command is used for a control method in which distributed execution is performed by the executor, and the first data is used for a control method in which data synchronization is performed by the executor.

[0034] Below Figure 2 The distributed execution control method of the distributed control system is illustrated as shown in the figure. The distributed redundant control system includes a master actuator and three slave actuators, namely slave actuator 1, slave actuator 2 and slave actuator 3. The master actuator executes command a. After command a starts to execute, the master actuator broadcasts the start of command a so that all actuators receive command a. After receiving command a, each actuator reads the program data and the control program, and tries to execute command a, and broadcasts the execution result obtained by the attempt to the system. Figure 2 As shown, the execution result obtained by the master executor when attempting to execute is result A, the execution result obtained by slave executor 1 when attempting to execute is result A, the execution result of slave executor 2 is A, and the execution result of slave executor 3 is B.

[0035] In some implementations, since different executors may be connected to different data sources and different data sources have different data read and write permissions, different executors may have different execution results for the same execution command.

[0036] In some other implementations, network status, data delay, etc. may cause the executor to have different results, and abnormal results of the executor are not excluded.

[0037] Each executor broadcasts the execution result to other executors. All executors vote whether the execution result A of the main executor is correct based on the collected execution results and weights. The main executor collects the results and determines whether it passes the vote. If it fails, it re-executes command a and repeats the above process. If it passes, it collects the final execution result A, and the main executor completes the subsequent control, for example Figure 2 If the command fails, the main executor is returned to start the distributed execution process.

[0038] In some embodiments, the results R of all executors and the corresponding execution weights p are collected before the executors vote. The requirement for passing the vote is That is, if the sum of the weights of the executors that meet the result divided by the sum of the total weights is greater than or equal to 0.5, then a vote is cast. If there are results that cannot be collected in time, they will be empty. If the weights of the executors cannot be collected in time, the weights collected last time will be used.

[0039] In some implementations, if the number of votes collected by the main executor that have been voted in is greater than half of the total number of votes, the vote is determined to have been passed, and the result of the previous attempted execution is converted into an actual execution result.

[0040] In some implementations, the execution weights of all executors that voted yes are increased. In an embodiment of the present invention, since slave executor 1 and slave executor 2 voted yes for the execution result A of the master executor, the execution weights of slave executor 1 and slave executor 2 are increased.

[0041] In some implementations, if there are multiple executions or the execution fails for a long time, the execution weight of the main executor is reduced, the main executor is downgraded to a candidate, and the election is re-initiated.

[0042] The control method of the distributed redundant control system actuator of the present invention is also applicable to data synchronization. Figure 3 The data synchronization method of the distributed redundant control system is illustrated in the figure.

[0043] The data of the controller is directly read by each actuator, and there is no synchronization issue. However, in some cases, such as after the step execution ends, after a special event is triggered, the state of the actuator changes, and the actuator needs to synchronize the data of the currently executed program. Data synchronization starts at the beginning of command execution.

[0044] In some implementations, the executor needs to synchronize data of the executed program, such as variables, parameters, timers, triggers, etc.

[0045] The data synchronization process is triggered by the main executor, such as Figure 3As shown, the main executor first increments the transaction ID, calculates and obtains the first data, and broadcasts the first data.

[0046] The transaction ID represents the order of data update. The executor records the transaction ID to prevent data loss in certain situations. The first data is the data change between two transaction IDs, that is, Figure 3 New data in .

[0047] The slave executor compares the received new data with the data changes between its two transaction IDs to determine whether its own data changes match the new data. Slave executors 1 and 2 vote to the master executor by comparing the data results. The master executor collects the voting results and decides whether the vote is passed. If not, it returns Figure 3 The transaction ID increment process shown restarts synchronization. If the vote is passed, the collected final results are sent to all executors, which then synchronize data and write the final results to the database and data cache.

[0048] like Figure 3 As shown, slave executors 1 and 2 participate in data synchronization, but slave executor 3 does not participate in the data synchronization process due to its previous abnormal state. Therefore, the data comparison and voting process is not performed.

[0049] exist Figure 3 In the illustrated embodiment, since slave 1 compares the newly added data and finds it consistent with its own data changes, it casts a vote of approval to the master executor, while slave 2 compares the newly added data and finds it does not conform to its own data changes, it casts a vote of rejection to the master executor.

[0050] It should be noted that a certain error is allowed during matching, and it is considered to be in compliance within the error range. The executor that voted for the pass has its data weight increased. If the execution fails multiple times or for a long time, the data weight of the main executor will be reduced, and it may be downgraded to a candidate executor, triggering a re-election.

[0051] The election process Figure 4 As shown, if in a distributed redundant control system, the master actuator is offline, or the master actuator fails to complete the distributed execution or data synchronization task for many times or for a long time, the master actuator is degraded, such as Figure 4 The master executor shown fails. Slave executor 1 and slave executor 2 detect that the master executor has timed out or failed, and then they are upgraded to candidate executors. Slave executor 3 may not have detected that the master executor has failed, and therefore does not participate in the process of initiating election voting.

[0052] Candidate executors 1 and 2 increment their term IDs. Candidate executors first vote for themselves, broadcast voting requests to other executors, and send weights to other slave executors. Figure 4 As shown, the sending weight of candidate executor 1 is P=1.1, the sending weight of candidate executor 2 is P=1.8, and the voting results are collected.

[0053] The candidate executor determines whether it has won the election through the collected voting results. Since in the embodiment of the present invention, the slave executor 3 votes for the candidate executor 2, the candidate executor 2 successfully becomes the master executor, and the candidate executor 1 fails and waits for the election result. The candidate executor that becomes the master executor publishes the election result and updates the term. The other executors receive the updated term, indicating that the original slave executor 2 becomes the master executor. Then the other executors, whether they were candidates, slaves or masters before, will become new slaves.

[0054] If all candidate executors fail to win the election, they will need to wait for a while before re-initiating the vote. A candidate executor is considered to have won the election if it receives more than half of all votes.

[0055] It should be noted that slave 3 receives voting requests from candidate executor 1 and candidate executor 2 within a short receiving time. Since candidate executor 2 has a higher weight, it votes for candidate executor 2.

[0056] In some embodiments, the weight at the time of election is determined by the data weight and the execution weight, and the smaller value of the two can also be used as the weight at the time of election. The initial weight is 1 and the minimum weight is 1, and the maximum weight will not exceed the total divided by two. Weight P = N / πarctan(M), where N is the number of actuators and M is the number of successful operations in the past 20 times.

[0057] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0058] The above only describes the basic principles and preferred embodiments of the present invention. Those skilled in the art may make many changes and improvements based on the above description, and these changes and improvements should fall within the protection scope of the present invention.

Claims

1. A control method for an actuator of a distributed redundant control system, characterized in that: Applied to a control system including at least three actuators, wherein the actuators include at most one master actuator and no less than two slave actuators, the control method of the distributed redundant control system actuators specifically includes: The master executor broadcasts a first command or first data; If the main executor broadcasts the first command, all executors in the system obtain the execution result based on the first command and use the execution result as the first result; If the master executor broadcasts the first data, all executors in the system compare the received first data with their own newly added data, where the newly added data is the data change between their two transaction IDs, and use the comparison result as the first result; Each executor broadcasts the first result to other executors respectively, and all executors vote respectively based on the received first results, specifically including: all executors collect the first results of other executors and the weight of each corresponding executor, if the first result of the executor cannot be collected, it is ignored, if the weight of the executor cannot be collected, the weight collected last time is used, if the ratio of the collected weight of the executor that meets the result to the total weight is greater than the first preset threshold, the executor votes in favor; The master executor collects the voting results and determines whether the vote is passed based on the voting results. If the vote is passed, the first result is used as the final execution result. If an exception occurs in the master executor, the slave executor is changed to a candidate executor based on the detected exception and re-initiates the election of the master executor.

2. The control method of the distributed redundant control system actuator according to claim 1, characterized in that: If the vote is passed, it also includes increasing the weight of the executor that voted in favor.

3. The control method of the distributed redundant control system actuator according to claim 1, characterized in that: The slave executor changes to a candidate executor based on the detected anomaly and re-initiates the election of the master executor, specifically including: The candidate executor will increment its term ID and initiate the election of the primary executor, vote for itself, broadcast the voting request and collect the voting results; Determine whether you have won the election based on the collected votes; If the election is successful, the new master executor publishes the election winning and term ID, and the remaining executors become slave executors; If the election fails, the candidate executor will re-initiate the election of the master executor after a preset time interval.

4. The control method of the distributed redundant control system actuator according to claim 3, characterized in that: If the master executor recovers during the election process, it becomes a candidate executor to participate in the election of the master executor. If the master executor recovers after a new master executor is elected, it becomes a slave executor.

5. The control method of the distributed redundant control system actuator according to claim 1, characterized in that: If the master executor broadcasts the first command, the master executor also writes the final result into the controller.

6. The control method of the distributed redundant control system actuator according to claim 1, characterized in that: If the main executor broadcasts the first data, it also includes all executors writing the final result into a database or cache.

7. The control method of the distributed redundant control system actuator according to claim 1, characterized in that: The main executor collects the voting results and determines whether the vote is passed based on the voting results, specifically including: if the main executor collects the votes of all executors, if the ratio of the number of votes to the total number of votes is greater than a second preset threshold, then the voting result is determined to be passed.

8. The control method of the distributed redundant control system actuator according to any one of claims 1 to 7, characterized in that: If the voting result fails, the main executor broadcasts the first command or the first data repeatedly.

Images