A method for accurately determining and switching the status of two machines in a multiplexed process bus

Abstract

The present invention discloses a method for accurately determining and switching the dual-machine states of a multiplexed process bus, and introduces a field process bus for communication between a logic control unit and an IO unit as an auxiliary channel for dual-machine communication of the logic control unit, which is used to exchange the operating states of the dual machines, so that the cause of the interruption of the main channel communication of the logic control unit dual machines can be accurately determined, and unnecessary master-slave switching can be avoided because the interruption of the main channel link of the dual-machine communication is misjudged as abnormal operation of the opposite-side logic control unit, resulting in an abnormal situation of "dual master operation" of the dual-machine system, thereby improving the reliability of the system; the present invention adopts a dual-machine system with an auxiliary channel for dual-machine communication, and when the main channel link of the dual-machine communication is interrupted, the normal master-slave switching function can still be maintained through the auxiliary channel, thereby improving the stability of the industrial control system.

Description

Technical Field

[0001] The present invention relates to the fields of industrial control such as electric power, petrochemical industry, metallurgy, etc., and in particular to a method for accurately determining and switching the states of two machines of a multiplexed process bus. Background Art

[0002] The logic control unit of the industrial automation system communicates with the IO unit through the field process bus, obtains the digital and analog quantities sent by various sensors and control terminals on site, and sends the digital and analog quantities to the IO unit. The field process bus includes CAN, EtherCAT, PROFIBUS and Ethernet.

[0003] In order to ensure the reliability of the system, the logic control unit adopts a master-slave dual-machine configuration. The master and standby dual-machine control unit exchange key information such as the operating status of the dual-machine through a dedicated communication link between the two machines, synchronize the operating data of the two machines, and perform logical judgment on the master-slave switching of the two machines.

[0004] The prior arts most similar to the present invention are:

[0005] CN112782965A-"A dual-machine hot standby communication system", the main and standby main control boards are directly connected via optical fiber Ethernet, and the main and standby boards of the lower environment collection and the relay main and standby boards communicate through the CAN bus to realize the redundancy function of the system.

[0006] CN208819201U《A dual-machine communication structure》A dual-machine communication structure includes: a master and a slave are connected via a data line. On the basis of the original communication architecture, an event notification line is added between the master and the slave. When the slave has an event to be read and needs to notify the master, the purpose of timely notifying the master can be achieved by processing the event notification line. The master is only responsible for inquiries, and the slave is only responsible for responses, thereby improving the communication efficiency between the two machines and simplifying the communication logic.

[0007] CN110417761A "Communication method and device based on dual-machine redundancy", dual-machine redundancy communicates with communication equipment. In the case of communication interruption between the host and the communication equipment, the unresponsive request message is synchronized to the standby machine through the dual-machine channel, and the standby machine tries to communicate with the communication equipment again, thereby avoiding frequent switching between the master and the standby, and improving the system's risk resistance and communication efficiency. The problem solved by this patent is different.

[0008] CN113794538A "A High-efficiency Dual-machine Communication Feedback Method" sets two feedback bits in the synchronization header in the dual-machine communication protocol, and adds a communication feedback mechanism without occupying the communication bandwidth, thereby realizing reliable and efficient dual-machine communication. The scheme adopted is different from this patent.

[0009] However, the prior art has the following problems:

[0010] Existing dual-machine communication technology usually uses a dedicated communication link to exchange dual-machine data and status as the basis for dual-machine switching logic judgment. When the dual-machine is running, in addition to the change of the self-test alarm status of the dual-machine exchange, it may also cause the dual-machine communication to be abnormal due to the inability to receive the dual-machine communication data on the opposite side, thereby causing the primary-backup switch. Specifically: the logic control unit cannot receive the dual-machine communication data, which may be caused by the power failure or crash of the opposite-side logic control unit, or the interruption of the dual-machine communication link. In the former case, if the logic control unit is in the standby state, it should be promoted to the main machine; in the latter case, the logic control unit should maintain the main-backup state unchanged, and the main-backup switch should not occur, otherwise it will cause the dual host to run, causing unpredictable system failures. The existing dual-machine communication that only uses the dual-machine dedicated communication link cannot determine the exact cause of the dual-machine communication interruption, and thus cannot prevent the master-backup erroneous switch caused by the dual-machine communication interruption. There are potential risks in the stability and reliability of the dual-machine system.

[0011] In addition, although the current solution of duplexing communication links is generally adopted to improve the reliability of dual-machine communication links and avoid dual-machine communication failure caused by single link failure, it is still impossible to fundamentally avoid the interruption of dual-machine communication links leading to erroneous switching of dual-machine status. Summary of the invention

[0012] Purpose of the invention: The purpose of the present invention is to provide a method for accurately determining and switching the dual-machine status of a multiplexed process bus, thereby solving the problem that the operating status of the opposite side cannot be known when the main channel link of the dual-machine communication is interrupted, and avoiding the master-slave erroneous switching caused by the interruption of the dual-machine communication link.

[0013] Technical solution: The method for accurately determining and switching the dual-machine states of a multiplexed process bus described in the present invention includes the following steps:

[0014] (1) The two logical control units configure the unit addresses according to the agreed rules to complete the pairing of the left and right units.

[0015] (2) The logic control unit performs weighted processing based on the impact of various self-test alarm information on the local system, and accumulates the self-test alarm status level value (0-15, 0 means no alarm, the best status; 15 means the highest alarm level).

[0016] (3) The two logical control units are directly connected through the 100M Ethernet port on the CPU board, which serves as the main communication channel between the two machines. Based on the main communication channel, the logical control unit synchronizes the operating data and parameter configuration of the two machines and completes the exchange of the current active and standby operating status and self-test alarm status.

[0017] (4) The logic control unit compares the self-test alarm status of the local machine and the opposite machine, selects the machine with the lower self-test alarm status level value as the master machine, and completes the master-slave logic state switching; the left and right machines can be combined into four operating states: "dual standby" (the left machine and the right machine are both in standby state), "master standby" (the left machine is the master machine and the right machine is the standby machine), "standby master" (the right machine is the master machine and the left machine is the standby machine), and "dual master" (the left machine and the right machine are both in the master state), and switch between them through the following process:

[0018] (a) After the two machines are powered on, they are both in standby mode, i.e., in the "dual standby" operating mode. If the self-test alarm status level values ​​of the two machines are the same, the left machine will be promoted to the master machine and the right machine will remain the standby machine.

[0019] (b) When the two machines are in the "active / standby" operating state, that is, the left machine is the active machine and the right machine is the standby machine, if the self-test alarm status level value of the two machines changes, and the self-test alarm of the left machine is greater than that of the right machine, the left machine will be downgraded to the standby machine first and enter the dual standby state. Afterwards, if the self-test alarm of the left machine is still greater than that of the right machine, the right machine will be promoted to the active machine and the two machines will complete the active / standby switching.

[0020] (c) When the two machines are in the "standby-master" operating state, that is, the right machine is the master and the left machine is the standby. If the self-test alarm status level value of the two machines changes and the right machine's self-test alarm is greater than that of the left machine, the right machine will be downgraded to the standby machine first and enter the "dual standby" state. Afterwards, if the right machine's self-test alarm is still greater than that of the left machine, the left machine will be promoted to the master and the two machines will complete the master-standby switch.

[0021] (d) When the two machines are in the "dual-master" operating state, if the self-test alarm level values ​​of the two machines are the same, the right machine will be downgraded to the backup machine and the left machine will remain the master machine; if the self-test alarm level values ​​of the two machines are inconsistent, the unit with a better operating status will remain the master machine and the other will be downgraded to the backup machine.

[0022] (5) The master-slave logic control unit communicates with the IO unit through the field process bus, and reuses the process bus as an auxiliary channel for dual-machine communication. Two dedicated bytes are designed in the IO data message to transmit the status of the left and right logic control units, including the master-slave status, duty / shutdown status, and self-test alarm level value of the logic control unit, as an auxiliary criterion for the master-slave switching of the dual machines.

[0023] The step (5) comprises the following steps:

[0024] (5.1) The two logic control units simultaneously send IO data messages to the IO units through the field process bus, and fill in the left machine status byte or the right machine status byte in the IO data message with the active / standby operation status and self-test alarm level value of the machine according to the position of the left machine or the right machine.

[0025] (5.2) The logic control unit fills the master and standby operating states of the machine into Bit 7 and Bit 6 of the status byte (8 bits in total); Bit 7 and Bit 6 are combined in binary format, 2 represents the master state, 1 represents the standby state, and 3 and 0 represent invalid states.

[0026] (5.3) The logic control unit writes the self-test alarm level value of the machine into Bit 3 to Bit 0 of the status byte, a total of four bits, and the binary combination value range is 0-15.

[0027] (5.4) The IO unit determines that the logic control unit is in the duty state according to the received downlink message of the logic control unit. If the received downlink message of the logic control unit times out, the IO unit determines that the logic control unit is in the outage state.

[0028] (5.5) The IO unit returns the dual-machine status byte obtained from the received downlink message of the logical control unit to the dual-machine logical control unit, and writes the determined on-duty / out-of-service status of the logical control unit into Bit5 and Bit4 of the status byte of the uplink IO data message. Bit5 and Bit4 are combined in binary format, 2 represents on-duty status, 1 represents out-of-service status, and 3 and 0 represent invalid status.

[0029] (5.6) The logic control unit receives the status word information sent by the IO unit, and parses the corresponding status byte according to the left or right position of the local unit, and obtains the duty / outage status, active / standby status, and self-test alarm level value of the opposite logic control unit, which is used as an auxiliary criterion for the active / standby switching of the dual machines.

[0030] (6) When the main communication channel between the two machines is normal, the logic control unit checks whether the master and standby states of the opposite sides obtained through the main channel and the auxiliary channel are consistent. If they are inconsistent, an alarm message is output.

[0031] (7) When the logic control unit receives an abnormal communication message from the other side through the main communication channel of the two-machine communication, the logic control unit uses the dual-machine auxiliary channel judgment criteria to perform the master-slave switching logic judgment; for any of the two machines, if it is determined that the logic control unit on the opposite side is in the duty state, the current master-slave state is maintained, and the auxiliary judgment criteria obtained from the dual-machine auxiliary channel are used to continue the master-slave switching logic judgment, and then the logic control unit in the master state reports the dual-machine channel link interruption alarm; for any of the two machines, if it is determined that the logic control unit on the opposite side is in the shutdown state, and if this machine is in the backup state, it is upgraded to the master operation state, and an alarm of the abnormality on the opposite side is sent.

[0032] A computer storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned method for accurately determining and switching the dual-machine states of a multiplexed process bus.

[0033] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for accurately determining and switching the dual-machine states of a multiplexed process bus is implemented.

[0034] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0035] 1. The present invention introduces a field process bus for communication between the logic control unit and the IO unit as an auxiliary channel for communication between the two machines of the logic control unit, which is used to exchange the operating status of the two machines, so that the cause of the interruption of the main channel communication between the two machines of the logic control unit can be accurately determined, avoiding unnecessary switching of the main and standby machines due to misjudging the interruption of the main channel link of the two-machine communication as abnormal operation of the opposite-side logic control unit, resulting in the abnormal situation of "dual-master operation" of the dual-machine system, thereby improving the reliability of the system.

[0036] 2. The present invention adopts a dual-machine system with a dual-machine communication auxiliary channel. When the dual-machine communication main channel link is interrupted, the normal master-slave switching function can still be maintained through the auxiliary channel, thereby improving the stability of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a dual-machine system architecture diagram;

[0038] Figure 2 This is the flow chart of the normal state of two-machine communication;

[0039] Figure 3 It is a schematic diagram of the principle of the logic control unit transmitting the state through the IO communication byte;

[0040] Figure 4 This is the flowchart for processing when the main channel of dual-machine communication receives no message. DETAILED DESCRIPTION

[0041] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0042] The method for accurately determining and switching the dual-machine states of a multiplexed process bus described in the present invention is applied to a distributed control system in the field of industrial automation, and the system includes a logic control unit and a field IO acquisition and control unit. The logic control unit communicates with the IO unit through the field process bus, the IO unit sends the acquired input state quantity and analog quantity, and the logic control unit sends the output state quantity and the output analog quantity and the current master and standby operation state of the machine to the IO unit.

[0043] In the dual-machine system described in the present invention, the logic control unit master and standby dual machines are paired according to the established rule configuration unit address. The specific rule is that the right machine address is 128 greater than the left machine address, for example, the left machine address is 1 and the right machine address is 129.

[0044] The two logic control units are in duty operation at the same time. If a fault occurs, they will be in shutdown state. In the duty operation state, they are in the main machine state and the backup machine state respectively.

[0045] The two logic control units are directly connected through the 100M Ethernet port on the CPU board as the main communication channel between the two machines. In addition, the two logic control units use the field process bus that communicates with the IO unit as the auxiliary channel for switching between the active and standby states of the two machines. The overall communication structure is as follows: Figure 1 .

[0046] Dual-machine communication uses a dedicated communication protocol designed based on the Ethernet link layer to complete dual-machine equipment self-check alarms, operating status, configuration and parameter CRC information, as well as synchronous interaction of dual-machine data.

[0047] The logical control unit performs weighted processing based on the impact of various alarms on the system, and accumulates the self-test alarm status level value (0-15, 0 means no alarm, the best status; 15 means the highest alarm level). The logical control unit with a lower self-test alarm value, that is, a better status, is the master. When the self-test alarm status of the master and standby machines is the same, the left machine takes priority as the master to avoid "dual master" or "dual standby" operation. When the communication between the two machines is normal, the flow of the master and standby status of the two machines is as follows: Figure 2 The specific flow process is as follows:

[0048] (a) After both machines are powered on, they are both in standby mode. If the self-test alarm status levels of both machines are the same, the left machine becomes the master machine and the right machine remains the standby machine.

[0049] (b) When the two machines are in the "active / standby" state (the left machine is active and the right machine is standby), if the self-test alarm level value of the two machines changes and the self-test alarm of the left machine is greater than that of the right machine, the left machine will be downgraded to the standby machine first and enter the dual standby state. Afterwards, if the self-test alarm of the left machine is still greater than that of the right machine, the right machine will be promoted to the active machine and the two machines will complete the active / standby switch;

[0050] (c) When the two machines are in the "standby master" state (the right machine is the master and the left machine is the standby), if the self-test alarm state level value of the two machines changes and the self-test alarm of the right machine is greater than that of the left machine, the right machine will be downgraded to the standby machine first and enter the dual standby state. Afterwards, if the self-test alarm of the right machine is still greater than that of the left machine, the left machine will be promoted to the master and the two machines will complete the master-standby switch;

[0051] (d) When the two machines are in dual-master operation, if the self-test alarm level values ​​of the two machines are the same, the right machine will be downgraded to the backup machine and the left machine will remain the master machine; if the self-test alarm level values ​​of the two machines are inconsistent, the unit with a better operating status will remain the master machine and the other will be downgraded to the backup machine.

[0052] In addition to the main channel of dual-machine communication, the logic control unit reuses the field process bus as the auxiliary channel of dual-machine communication to exchange the master and standby, duty status, and self-test alarm level value of the logic control unit as an auxiliary criterion for dual-machine master and standby switching. The specific method is as follows (such as Figure 3 ).

[0053] In the IO data communication protocol, two bytes are designed to transmit the status of the left and right logic control units respectively. The status byte has 8 bits in total, and the specific definition is as follows.

[0054] Bit7 and Bit6 are defined as the master and standby states of the logic control unit in binary combination, 2 represents the master state, 1 represents the standby state, 3 and 0 represent invalid states;

[0055] Bit5 and Bit4 are defined as the duty status of the logic control unit in binary combination, 2 represents the duty status, 1 represents the shutdown status, 3 and 0 represent the invalid status;

[0056] Bit3 to Bit0 are four bits in total, and the binary combination is 16 digits from 0 to 15, corresponding to the logic control unit self-test alarm level value 0 to 15.

[0057] The logic control unit fills the master / slave status and the self-test alarm status value of the unit into the corresponding logic control unit status byte in the downlink IO data message according to the position of the unit in the left or right machine of the dual machine. The IO unit determines whether it is on duty according to the timeout of receiving the downlink message of the logic control unit, fills the duty / outage status into the corresponding logic control unit status word in the uplink IO data message, and forwards the logic control unit status word obtained from the downlink IO data message into the uplink message.

[0058] Therefore, the dual-machine receiving logic control unit IO unit sends status word information, and parses the corresponding status byte according to the left or right position of the local machine, and obtains the duty / shutdown status, master / standby status, and self-test alarm level value of the opposite-side logic control unit, which is used as an auxiliary criterion for the master-standby switching of the dual machines.

[0059] When the main communication channel between the two machines is normal, the logic control unit can check the active and standby status of the two machines obtained through the main channel and the auxiliary channel. If they are inconsistent, an alarm message is output.

[0060] When the logic control unit receives an abnormal dual-machine communication message from the other side through the dual-machine communication main channel, the logic control unit uses the dual-machine auxiliary judgment criteria to make a primary and standby switching logic judgment (such as Figure 4 ). For any of the two machines, if it is determined that the opposite-side logical control unit is in the duty state, the current master-slave state is maintained, and the opposite-side self-test alarm level value obtained by the dual-machine auxiliary channel is used as a comparison criterion for the master-slave switching logic judgment, and the dual-machine channel link interruption alarm is reported by the logical control unit in the master; for any of the two machines, if it is determined that the opposite-side logical control unit is in the outage state, and if this machine is in the standby state, it is upgraded to the master operation state, and the alarm of the opposite-side abnormality is sent.

Claims

1. A method for accurately determining and switching the dual-machine states of a multiplexed process bus, characterized in that: The following steps are involved: (1) The two logical control units configure the unit addresses according to the agreed rules to complete the pairing of the left unit and the right unit; (2) The logic control unit performs weighted processing based on the impact of various self-test alarm information on the local system, and accumulates the self-test alarm status level value; (3) The two logical control units are directly connected through the 100M Ethernet port on the CPU board, which serves as the main communication channel between the two machines. Based on the main communication channel, the logical control unit synchronizes the operation data and parameter configuration of the two machines and completes the exchange of the current active and standby operation status and self-test alarm status. (4) The logic control unit compares the self-test alarm status of the local machine and the opposite machine, selects the machine with the lower self-test alarm status level as the master machine, and completes the switch of the master-slave logic status; the left and right machines can be combined into four operating states: "dual standby", "master standby", "standby master", and "dual master", and switch between them through the following process: (a) After the two machines are powered on, they are both in standby mode, i.e., in "dual standby" operation mode. If the self-test alarm status level values ​​of the two machines are the same, the left machine will be promoted to the master machine and the right machine will remain the standby machine; (b) When the two machines are in the "active / standby" operation state, that is, the left machine is the active machine and the right machine is the standby machine, if the self-test alarm state level value of the two machines changes, and the self-test alarm of the left machine is greater than that of the right machine, the left machine will be downgraded to the standby machine first and enter the dual standby state. Afterwards, if the self-test alarm of the left machine is still greater than that of the right machine, the right machine will be promoted to the active machine, and the two machines will complete the active / standby switch; (c) When the two machines are in the "standby-master" operation state, that is, the right machine is the master and the left machine is the standby. If the self-test alarm level value of the two machines changes and the self-test alarm of the right machine is greater than that of the left machine, the right machine will be downgraded to the standby machine first and enter the "double standby" state. Afterwards, if the self-test alarm of the right machine is still greater than that of the left machine, the left machine will be promoted to the master and the two machines will complete the master-standby switch; (d) When the two machines are in the "dual-master" operation state, if the self-check alarm level values ​​of the two machines are the same, the right machine will be reduced to the standby machine and the left machine will remain the master machine; if the self-check alarm level values ​​of the two machines are inconsistent, the unit with the better operation status will remain the master machine and the other will be reduced to the standby machine; (5) The active / standby logic control unit communicates with the IO unit through the field process bus, and the process bus is reused as an auxiliary channel for dual-machine communication. Two dedicated bytes are designed in the IO data message to transmit the status of the left and right logic control units, including the active / standby status, duty / outage status, and self-test alarm level value of the logic control unit, as auxiliary criteria for dual-machine active / standby switching; (6) When the main communication channel between the two machines is normal, the logic control unit checks whether the master and standby states of the opposite side obtained through the main channel and the auxiliary channel are consistent. If they are inconsistent, an alarm message is output; (7) When the logic control unit receives an abnormal communication message from the other side through the main communication channel of the two-machine communication, the logic control unit uses the dual-machine auxiliary channel judgment criteria to perform the master-slave switching logic judgment; for any of the two machines, if it is determined that the logic control unit on the opposite side is in the duty state, the current master-slave state is maintained, and the auxiliary judgment criteria obtained from the dual-machine auxiliary channel are used to continue the master-slave switching logic judgment, and then the logic control unit in the master state reports the dual-machine channel link interruption alarm; for any of the two machines, if it is determined that the logic control unit on the opposite side is in the shutdown state, and if this machine is in the backup state, it is upgraded to the master operation state, and an alarm of the abnormality on the opposite side is sent.

2. The method for accurately determining and switching the dual-machine states of a multiplexed process bus according to claim 1 is characterized in that: The step (5) comprises the following steps: (5.1) The two logic control units simultaneously send IO data messages to the IO units through the field process bus, and fill in the master / slave operation status and self-test alarm level value of the local machine into the left machine status byte or the right machine status byte in the IO data message according to the position of the local machine on the left or right machine; (5.2) The logic control unit fills the master and standby operation status of the machine into Bit 7 and Bit 6 of the status byte; Bit 7 and Bit 6 are combined in binary format, 2 represents the master state, 1 represents the standby state, 3 and 0 represent invalid state; (5.3) The logic control unit writes the self-test alarm level value of the machine into Bit 3 to Bit 0 of the status byte, a total of four bits, and the binary combination value range is 0-15; (5.4) The IO unit determines that the logic control unit is in the duty state according to the received downlink message of the logic control unit. If the received downlink message of the logic control unit times out, the logic control unit is determined to be in the outage state; (5.5) The IO unit returns the dual-machine status byte obtained by receiving the downlink message of the dual-machine logical control unit to the dual-machine logical control unit, and writes the determined on-duty / out-of-service status of the logical control unit into Bit 5 and Bit 4 of the status byte of the uplink IO data message. Bit 5 and Bit 4 are combined in binary format, 2 represents on-duty status, 1 represents out-of-service status, and 3 and 0 represent invalid status; (5.6) The logic control unit receives the status word information sent by the IO unit, and parses the corresponding status byte according to the left or right position of the local unit, and obtains the duty / outage status, active / standby status, and self-test alarm level value of the opposite logic control unit, which is used as an auxiliary criterion for the active / standby switching of the dual machines.

3. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, a method for accurately determining and switching the dual-machine states of a multiplexed process bus as described in any one of claims 1-2 is implemented.

4. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, a method for accurately determining and switching the dual-machine states of a multiplexed process bus according to any one of claims 1-2 is implemented.

Images