Weaving method and dual-machine hot standby system

Abstract

This invention discloses a weaving method and a dual-machine hot standby system, belonging to the field of spacecraft technology. The weaving method, which uses a weaving program to back up or restore data from the main program, includes: dividing the main program into multiple process nodes according to the process flow; marking checkpoint connection points and recovery connection points in each process node; setting checkpoint cutoff points and checkpoint notifications corresponding to the checkpoint connection points, and recovery cutoff points and recovery notifications corresponding to the recovery connection points in the weaving program; when data is collected from the main program through the weaving program, the checkpoint cutoff points of the weaving program and the checkpoint connection points on the main program match to trigger checkpoint notifications, and the weaving program collects data from the main program through the checkpoint notifications. The beneficial effect of this invention is that it provides a weaving method and its hot standby system that avoids entanglement between core code and backup code.

Description

Technical Field

[0001] This invention relates to the field of aerospace technology, and more specifically, to a weaving method and a dual-machine hot standby system. Background Technology

[0002] In the operation of satellite automation platforms, a dual-machine hot standby mechanism is usually required to achieve reliable operation 24 / 7. This means using two servers: one as the primary server and the other as the backup server. The primary and backup servers back up the same control system to each other. The primary server is used to perform automated control of the satellite. When the primary server fails, the backup server is activated to perform automated control of the satellite.

[0003] However, during primary / standby switchover, in order to reduce the standby response time, the data generated by the primary machine during operation needs to be sent to the standby machine for backup. In this way, when the primary machine fails, the standby machine can quickly recover to the state at the time of the primary machine failure through the data sent by the primary machine.

[0004] In existing methods, data recording and transmission code is typically inserted into the core program of the host execution module. After the host execution module completes a command, the inserted code is triggered, and the relevant data is sent to the standby unit for storage. This approach leads to an intertwining of core business logic and backup components within the host execution module, resulting in overly complex program execution and impacting the stability of core business operations. Summary of the Invention

[0005] The summary section of this invention provides a brief overview of the concepts, which will be described in detail in the detailed description section that follows. This summary section is not intended to identify key or essential features of the claimed invention, nor is it intended to limit the scope of the claimed invention.

[0006] As a first aspect of the present invention, in order to solve the technical problems mentioned in the background section above, some embodiments of the present invention provide a weaving method, which uses a weaving program to back up or restore the data of the main program, including the following steps: The main program is divided into multiple process nodes according to the process; Mark the checkpoint connection point and the recovery connection point in each process node; In the weaving process, set the checkpoint cut-off point and checkpoint notification corresponding to the checkpoint connection point, and the recovery cut-off point and recovery notification corresponding to the recovery connection point; When data is collected from the main program through the weaving program, the checkpoint cutoff point of the weaving program matches the checkpoint join point on the main program to trigger a checkpoint notification. The weaving program then collects data from the main program through the checkpoint notification. When data on the main program is restored via the weaving process, the recovery point of the weaving process matches the recovery join point on the main program to trigger a recovery notification. The weaving process then restores the data on the main program via the recovery notification.

[0007] The weaving method used in this invention only requires dividing the main program into multiple process nodes according to the process, and marking the corresponding recovery connection points and checkpoint connection points on the process nodes, which will not affect the main program as a whole. The collection and restoration of data on the main program are carried out by the weaving program matching connection points. Therefore, the main program of core business can be separated from the weaving program that collects and restores data on the main program. In actual use, this can avoid the problem of the main program becoming too bloated when backing up data on the main program.

[0008] Furthermore, the weaving process tracks the execution progress of the main program to sequentially collect data from the process nodes in the main program or sequentially restore the data from the process nodes in the main program.

[0009] Furthermore, the weaving process generates multiple checkpoint files corresponding to each process node from the collected main program data, and backs up the checkpoint files.

[0010] Furthermore, when the weaving process triggers a recovery notification, the recovery notification uses the checkpoint file to restore the data on the main program from the recovery connection point that triggered the recovery notification to the corresponding process node.

[0011] As a first aspect of the present invention, in order to solve the technical problems mentioned in the background section above, some embodiments of the present invention provide a satellite dual-machine hot standby system, including... Host; The backup unit, similar to the main unit, is used to take over the satellite remote control function of the main unit when the main unit fails. Both the main unit and the backup unit include an execution module for controlling the satellite and a backup module for backing up or restoring the execution module data; The program executed in the execution module is set as the main program; The program executed in the backup module is set as a weaving program; The host's backup module uses the aforementioned weaving method to collect data generated by the host's execution module during operation; The backup module of the standby machine uses the aforementioned weaving method to restore the working state of the standby machine's execution module.

[0012] The dual-machine hot standby system provided by this invention executes the main program in the execution module and the weaving program in the backup module, thereby separating the weaving program for restoring and backing up data on the main program of the execution module from the main program, thus avoiding the problem of the main program of the execution module being too bloated.

[0013] Furthermore, the main programs of the execution modules of the main unit and the backup unit are divided into multiple control command objects, and recovery connection points and checkpoint connection points are marked in the control command objects; each time the main program of the execution module completes the execution of a control command object, it sends a remote control command to the satellite.

[0014] Furthermore, when the host machine is not paralyzed, the host machine's backup module tracks the execution process of the host machine's main program and records data to form a checkpoint file, which is then sent to the standby machine's backup module for backup.

[0015] Furthermore, the host's backup module tracks the execution process of the host's execution module, ensuring that the checkpoint cutoffs of the weaving program in the host's backup module match the checkpoint join points in the execution program of the host's execution module. This triggers a checkpoint notification from the host's backup module, which then obtains data from the control command object corresponding to the checkpoint join point that triggered the checkpoint notification, thus forming a checkpoint file.

[0016] Furthermore, when the primary machine fails, the standby machine's execution module executes the control command objects sequentially, while the standby machine's backup module tracks the execution process of the standby machine's execution module. The standby machine's backup module restores the data of the control command objects in the standby machine's execution module sequentially through the checkpoint file.

[0017] Furthermore, when the recovery cutoff point of the backup module of the standby machine matches the recovery connection point of the execution module of the standby machine, a recovery notification is triggered from the backup module of the standby machine. The recovery notification uses the checkpoint file stored in the backup module to restore the data of the control command object in the execution module of the standby machine that corresponds to the recovery connection point that triggered the recovery notification.

[0018] In summary: This invention achieves dual-machine hot standby by employing the AOP mechanism, with the satellite control process execution module as the core focus and the state backup synchronization module as the cross-cutting focus. Without affecting the core business modules of the satellite control process execution, the functionality of the state backup synchronization module is enhanced by dynamically adding agents, thus isolating the core business modules and the state backup synchronization module and avoiding the code entanglement between the core modules and auxiliary modules. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention, making other features, objects, and advantages of the invention more apparent. The illustrative embodiments of the invention illustrated in the drawings and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention.

[0020] Furthermore, throughout the accompanying drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the elements are not necessarily drawn to scale.

[0021] In the attached diagram: Figure 1 It is a traditional dual-machine hot standby system; Figure 2 This is a dual-section hot standby system provided according to an embodiment of the present invention; Figure 3 This is a schematic diagram of information interaction between the execution module and the backup module according to an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the generation of checkpoint files by a backup module according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the process of a standby machine transitioning from a recovery state to a normal state according to an embodiment of the present invention; Figure 6 This is a flowchart of a dual-section hot standby method provided according to Embodiment 3 of the invention. Detailed Implementation

[0022] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0023] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0024] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] In the operation of satellite automation platforms, a dual-machine hot standby mechanism is usually required to achieve reliable operation 24 / 7. This means using two servers: one as the primary server and the other as the backup server. The primary and backup servers back up the same control system to each other. The primary server is used to perform automated control of the satellite. When the primary server fails, the backup server is activated to perform automated control of the satellite.

[0026] refer to Figure 1 In order to reduce the switching time between the primary and standby machines, it is necessary to send the relevant parameters collected by the primary machine during operation and the status data of the primary machine to the standby machine for backup in real time.

[0027] In existing technologies, the main unit typically sends the data generated during the execution of the control process to the backup unit after completing the control process for satellite control. Therefore, the backup unit contains the data generated by the main unit during its operation. In this way, when the main unit fails, the backup unit can directly restore the working state of the main unit at the time of failure through the backed-up data, and then directly take over the work of the main unit.

[0028] However, the above design approach has the following problems: To ensure high consistency between the primary and backup systems during failover, the primary and backup systems must operate with the highest possible consistency. Therefore, after executing a set of thread parameters, the primary system needs to send the data to the backup system for backup. This results in complex programs running on the primary system. The programs running on the primary system not only need to include the original programs for parsing telemetry data transmitted by satellites and executing control flow threads based on telemetry parameters, but also need to embed backup data program code within these control flow execution threads to ensure that data updated by the primary system during operation can be sent to the backup system for backup.

[0029] Therefore, the latency during primary / standby switchover is related to the density of the backup programs installed. The higher the density of backup programs installed in the core business modules of the host, the higher the consistency during primary / standby switchover. Conversely, the lower the density of backup programs installed in the core business modules of the host, the lower the consistency during primary / standby switchover.

[0030] Therefore, to ensure good master-slave consistency, the execution module needs to continuously perform state synchronization and backup functions while completing core business operations. This leads to the execution module and backup module becoming intertwined. Consequently, the execution module for core business operations experiences a high workload and its operating state is prone to instability.

[0031] To address the above problems, the present invention provides the following technical solution: Example 1: refer to Figure 3 A weaving method that uses a weaving program to back up or restore data from the main program includes the following steps: Step 1: Divide the main program into multiple process nodes according to the process; such as process node 1, process node 2, process node n; Step 2: Mark the checkpoint connection point and the recovery connection point in each process node; Step 3: In the weaving program, set the checkpoint cutoff and checkpoint notification corresponding to the checkpoint connection point, and the recovery cutoff and recovery notification corresponding to the recovery connection point; When it is necessary to collect data from the main program via the weaving process, perform the following steps: Step 4.1a: The weaver tracks the execution process of the main program, the checkpoints of the weaver match the checkpoint join points on the main program, and the weaver triggers checkpoint notifications. Step 4.2a: After triggering a checkpoint notification, the weaving program collects data from the process nodes on the main program corresponding to the checkpoint connection point that triggered the checkpoint notification. Then, the weaving program creates a checkpoint file from the collected data and backs up the checkpoint file.

[0032] For example, when the main program executes to process node 1, the checkpoint cutoff point of the weaver will match the checkpoint join point marked on process node 1, thereby triggering the checkpoint notification. The weaver then collects the relevant data on process node 1 and creates checkpoint file 1. As the weaver continues to follow the execution of the main program, it continuously triggers checkpoint notifications, thereby continuously obtaining checkpoint file 2, ..., checkpoint file n.

[0033] When it is necessary to restore data on the main program via the weaving process, perform the following steps: Step 4.1b: The main program executes the process nodes sequentially according to the predetermined process. The weaver tracks the execution process of the main program. The recovery point of the weaver matches the recovery join point on the main program. The weaver triggers the recovery notification. Step 4.2b: After the weaving program triggers the recovery notification, it uses the stored checkpoint file to restore the data of the process node on the main program corresponding to the recovery join point that triggered the recovery notification. The checkpoint file is the checkpoint file of the process node corresponding to the recovery join point that triggered the recovery notification in step 4.2a.

[0034] For example, when the main program executes to process node 1, the recovery pointcut of the weaver will match the recovery checkpoint marked on process node 1, and then the weaver will trigger a recovery notification. The weaver will then use checkpoint file 1 to recover the data of process node 1. As the weaver continues to follow the execution of the main program, the recovery pointcut and recovery join point will match continuously, and the weaver will continuously trigger recovery notifications, thereby continuously using checkpoint files to recover the data of process node 1, process node 2, ... process node n.

[0035] Example 2: refer to Figure 2 and Figure 3 A dual-machine hot standby system includes a primary machine and a standby machine. The primary machine and the standby machine have the same built-in modules. The primary machine is equipped with an execution module, a backup module, and a primary / standby sensing module.

[0036] The execution module performs the core functions of the main unit, namely collecting satellite telemetry data, processing the telemetry data into telemetry parameters, and then sending remote control commands to the satellite based on the input control parameters. The backup module backs up the data in the execution module. The primary / backup sensing module controls one of the execution modules in either the main unit or the backup unit, enabling the backup unit to take over control of the satellite's operational status in the event of a main unit failure. The backup modules of the main unit and the backup unit are signal-connected, and data stored in the main unit's backup module is sent to the backup module of the backup unit for storage.

[0037] The backup module of the host machine uses the weaving method of Embodiment 1 to collect data from the execution module of the host machine; the backup module of the standby machine uses the weaving method of Embodiment 1 to restore the data of the execution module of the standby machine.

[0038] When the host is functioning normally, its execution module sends remote control commands to the satellite based on the input telemetry data and control parameters. Simultaneously, the host's backup module accesses and stores the data generated by the execution module during its operation.

[0039] When the primary unit fails for various reasons, the primary and backup sensing modules of the primary and backup units are activated. After primary-backup arbitration, the backup unit is selected as the new primary unit. The backup module of the backup unit weaves the data generated by the execution module of the primary unit into the execution module of the backup unit. Thus, the execution module of the backup unit can restore the primary unit to the state when the primary unit failed by using the woven data.

[0040] Thus, the main program of the execution module of this application will not contain programs that control backup data and restore data, which separates the main program and the backup program from each other and avoids the situation where the core business part and the backup business part overlap.

[0041] As a more specific embodiment: the process nodes in the main programs of the execution modules of the host and standby machines are divided as follows: the main programs of the execution modules of the host and standby machines are divided into multiple control command objects according to the process of sending control commands to the satellite. Each time the main program completes the execution of a control command object, it completes the sending of a remote control command. Thus, the main programs of the execution modules of the host and standby machines can be divided into control command object 1, control command object 2, control command object 3, ... control command object n. Therefore, this invention uses control command objects as the basis when dividing the process nodes in the main programs of the execution modules of the host and standby machines. This system can mark recovery join points and checkpoint join points at appropriate locations in the main program of the execution modules on both the host and standby machines. This prevents the density of checkpoint and recovery join points from being too high, requiring frequent triggering of checkpoint and recovery notifications, or too low, resulting in too much data being generated by the main program between two checkpoint notifications. It also prevents the main program from suddenly stopping after a checkpoint notification has been triggered and before it has reached the next checkpoint join point. In such cases, the data from the moment the last checkpoint notification was triggered until the main program stopped is not stored and cannot be recovered.

[0042] Because the control command object indicates the remote control commands sent by the execution module to the satellite each time, dividing the process nodes according to the control command object can ensure that the state of the execution module last sent a remote control command to the satellite can be restored. Therefore, when the host suddenly fails, the execution module of the standby machine can be restored to the state of the host's execution module before the host fails, by using the checkpoint file saved by the backup module of the standby machine to restore the standby machine's execution module.

[0043] refer to Figure 4 The host's backup module backs up the host's execution module's data in the following way: The weaving program in the host's backup module tracks the execution of the main program in the host's execution module. When the main program of the host's execution module reaches the checkpoint join point, the checkpoint cutoff point of the standby backup module matches the checkpoint join point of the host's execution module. The standby backup module triggers a checkpoint notification, which in turn generates a checkpoint file containing the execution status data of the host's execution module. Each time a checkpoint notification is triggered, a checkpoint file is generated and stored in the standby backup module. Then, the checkpoint file is sent to the standby backup module. refer to Figure 5 When the main unit fails and a backup unit is needed to remotely control the satellite's operation, the procedure is as follows: The primary and backup sensing modules of the main and backup satellites are activated, and the backup satellite is switched to become the new primary satellite. The backup satellite enters recovery mode to restore the data of its execution module. In recovery mode, the backup satellite's execution module executes the main program, while the backup module accesses the execution module. The weaving program in the backup module tracks the execution of the main program in the primary satellite's execution module. The recovery point of the backup module matches the recovery link point in the execution module, thereby triggering a recovery notification in the backup module. The recovery notification restores the control command object corresponding to the recovery link point through the checkpoint file stored in the backup module. This process continues until all the checkpoint files stored in the backup module are used up. After all the checkpoint files stored in the backup module are used up, the backup satellite completes recovery and switches from recovery mode to normal mode. The backup satellite continues to execute the main program to control the satellite's operational status.

[0044] Implementation Three: refer to Figure 6 A dual-machine hot standby method includes the following steps: S1: Set up the same master unit and the same backup unit. Both the master unit and the backup unit can be used to remotely control the satellite. Under normal circumstances, the master unit remotely controls the satellite to control its operating status. When the master unit fails, the backup unit takes over the work of the master unit to control the satellite's operating status. S2: Divide the main programs of the execution modules of the host and standby machines into multiple control command objects; S3: Mark the recovery connection point and checkpoint connection point in each control command object; S4: In the weaving program of the backup module of the primary and standby machines, set the checkpoint cut-off point and checkpoint notification corresponding to the checkpoint connection point, as well as the recovery cut-off point and recovery notification corresponding to the recovery connection point. To determine if the host is down, if the host is not down, the host's execution module runs the main program, the host's backup module runs a weaving program to access the host's execution module, and the host's backup module backs up the data of the host's execution module, as described below: S5.11: The host's backup module tracks the execution process of the host's main program; S5.12: The checkpoint cutoff point of the host's backup module matches the checkpoint join point of the host's execution module; S5.13: Triggers a checkpoint notification for the host's backup module. S5.14: The host's backup module obtains data from the host's execution module to generate a checkpoint file; details are as follows: After triggering a checkpoint notification, the host's backup module collects data from the host's execution module corresponding to the checkpoint join point that triggered the checkpoint notification, forming a checkpoint file. For example, when the host's execution module's main program runs to control command object 1, the checkpoint cutoff point of the host's backup module's weaving program matches the marked checkpoint join point on control command object 1, triggering a checkpoint notification. Subsequently, the host's backup module collects data from the host's execution module's execution of control command object 1 to form checkpoint file 1. S5.15a: If the host is not paralyzed, the host's execution module continuously runs the main program, and the host's backup module continuously tracks the execution module. In this way, the above steps S5.11~5.14 are continuously run to obtain checkpoint files that correspond one-to-one with all control command objects executed by the host's execution module. S5.15b: The host's backup module will obtain the checkpoint file and send it to the backup module for backup; When the primary server fails, the primary / standby arbitration module of the standby server sets the standby server as the new primary server, and then the standby server switches to the recovery state. The execution module of the standby server restores the data, as follows: S5.21: The standby machine's execution module executes the main program sequentially; S5.22: The backup module of the standby machine tracks the execution process of the main program of the standby machine's execution module; S5.23: The recovery switch point in the backup module of the standby machine and the recovery connection point of the execution module in the standby machine are coordinated; S5.24: Trigger the recovery notification of the backup module of the standby machine, and then the recovery notification restores the control command object in the execution module of the standby machine through the checkpoint file stored in the backup module of the standby machine. The checkpoint file is a checkpoint file that matches the control command object to be restored; for example, when the main program of the execution module of the standby machine executes to control command object 1, the backup module of the standby machine uses checkpoint file 1 to restore the data of control command object 1.

[0045] S5.25: When all the checkpoint files stored in the backup module of the standby unit are used up, the standby unit recovery is completed, the standby unit switches from the recovery state to the normal state, and then executes the predetermined main program according to the standby unit to remotely control the satellite and control the satellite's operating status.

[0046] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A weaving method, characterized in that: The process of backing up or restoring the main program's data using a weaving procedure includes the following steps: The main programs of the primary and backup machines are divided into multiple process nodes according to their processes; Mark the checkpoint connection point and the recovery connection point in each process node; In the weaving program of the primary and standby machines, set the checkpoint cut-off point and checkpoint notification corresponding to the checkpoint connection point, as well as the recovery cut-off point and recovery notification corresponding to the recovery connection point; When the host's weaving program collects data from the host's main program, the checkpoint cutoff point of the weaving program matches the checkpoint join point on the main program to trigger a checkpoint notification. The weaving program then collects data from the main program through the checkpoint notification. The host's weaving program generates multiple checkpoint files corresponding one-to-one with the process nodes from the collected data from the host's main program and backs up the checkpoint files. When the standby machine's weaving program restores data on the standby machine's main program, the weaving program's recovery cutoff point matches the recovery join point on the main program to trigger a recovery notification. The weaving program then restores the data on the main program through the recovery notification. When the standby machine's weaving program triggers a recovery notification, the recovery notification uses the checkpoint file to restore the data of the process node on the standby machine's main program corresponding to the recovery join point that triggered the recovery notification.

2. The weaving method according to claim 1, characterized in that: The weaving programs for the primary and backup machines track the execution process of the primary program. The primary program's weaving program sequentially collects data from the process nodes in the primary program, while the backup program's weaving program sequentially restores the data from the process nodes in the backup program.

3. A dual-machine hot standby system, characterized in that: include Host; The backup unit, similar to the main unit, is used to take over the satellite remote control function of the main unit when the main unit fails. Both the main unit and the backup unit include an execution module and a backup module. The execution module is used to control the satellite's operating status, and the backup module is used to back up or restore the data of the execution module. The program executed in the execution module is set as the main program; The program executed in the backup module is set as a weaving program; The host's backup module uses the weaving method described in any one of claims 1 to 2 to collect data generated by the host's execution module during operation; The backup module of the standby machine uses the weaving method described in any one of claims 1 to 2 to restore the working state of the execution module of the standby machine.

4. The dual-machine hot standby system according to claim 3, characterized in that: The main program of the execution module of the main unit and the standby unit is divided into multiple control command objects. The recovery connection point and checkpoint connection point are marked in the control command object. The main program of the execution module sends a remote control command to the satellite after each control command object is executed.

5. The dual-machine hot standby system according to claim 4, characterized in that: When the host machine is not paralyzed, the host machine's backup module tracks the execution process of the host machine's main program and records data to form a checkpoint file. The checkpoint file is then sent to the standby machine's backup module for backup.

6. The dual-machine hot standby system according to claim 5, characterized in that: The host's backup module tracks the execution process of the host's execution module, ensuring that the checkpoint cutoffs of the weaving program in the host's backup module match the checkpoint join points in the execution program of the host's execution module. This triggers a checkpoint notification from the host's backup module, which then obtains data from the control command objects corresponding to the checkpoint join points that triggered the checkpoint notification, thus forming a checkpoint file.

7. The dual-machine hot standby system according to claim 6, characterized in that: When the primary machine fails, the standby machine's execution module executes the control command objects sequentially. At the same time, the standby machine's backup module tracks the execution process of the standby machine's execution module and restores the data of the control command objects in the standby machine's execution module sequentially through the checkpoint file.

8. The dual-machine hot standby system according to claim 7, characterized in that: When the recovery cutoff point of the backup module of the standby machine matches the recovery connection point of the execution module of the standby machine, the recovery notification of the backup module of the standby machine is triggered. The recovery notification uses the checkpoint file stored in the backup module to restore the data of the control command object in the execution module of the standby machine that corresponds to the recovery connection point that triggered the recovery notification.

Images