A method for switching between active and standby computers

Abstract

The master-slave switching method of a safety computer platform with a two-by-two-out-of-two structure is a method for judging the working state of the system by integrating known detection faults in the dual-set system. Data is transmitted between railway signal equipment through communication methods such as Ethernet and CAN bus, and the communication status between each system is one of the important factors that determine the master-slave switching. Since the redundant structure, communication method, and controlled equipment of each system are different, the master-slave switching is disordered or inefficient. The present invention proposes a master-slave switching method for a safety computer platform based on a two-by-two-out-of-two structure based on the on-off state of the communication object. On the basis of the communication state between the known safety computer platform and the external communication object, according to the redundant structure, communication method, control device type and other factors of the communication object, the master-slave switching of the safety computer platform with a two-by-two-out-of-two structure is realized to avoid accidental failure of the machine, and improve the reliability of the system while ensuring the safety of the system.

Description

Technical Field

[0001] The invention belongs to the technical field of railway signal control systems and relates to a method for switching between active and standby computers of a safe computer platform with a two-by-two-out-of-two structure based on communication object status judgment. Background Art

[0002] With the acceleration of my country's railway construction and the continuous density of the railway network, the railway industry, especially high-speed railways, has achieved leapfrog development. At present, my country's railway transportation is moving towards high speed and high density, which puts forward higher requirements for driving safety and transportation efficiency in railway operations. As the center and brain of the railway system, how to ensure the safety and reliability of railway signal equipment during operation has become an important research direction.

[0003] The two-by-two-take-two structure is a redundant system design structure based on dual sets of safety hardware and heterogeneous software. It ensures safety and reliability through redundant resources. "Take two" refers to completing the output consistency comparison of two independent computing units in a single system to ensure safety. "Two-by-two" refers to the main and standby operation mode of two systems. When one set of equipment fails, it can be switched to the other set of equipment at any time to improve reliability. The two-by-two-take-two safety computer platform developed based on this redundant structure meets the railway safety standards of my country and Europe, has a SIL4 safety level, and is widely used in my country's railway signal equipment.

[0004] The master-slave switching method of a safety computer platform with a two-by-two-out-of-two structure is a method for judging the working state of the system by integrating known detection faults in the dual-set system. Data is transmitted between railway signal equipment through communication methods such as Ethernet and CAN bus. The communication status between systems is one of the important factors that determine the master-slave switching. Since the redundant structure, communication method, and controlled equipment of each system are different, the master-slave switching is disordered or inefficient. The present invention proposes a master-slave switching method for a safety computer platform based on a two-by-two-out-of-two structure based on the on-off state of the communication object. Summary of the invention

[0005] The purpose of the present invention is to provide a method for switching the active and standby computers of a secure computer platform with a two-by-two-out-of-two structure based on the judgment of the communication object status, which solves the problems existing in the prior art. Based on the communication status between the known secure computer platform and the external communication object, and according to the redundant structure, communication mode, control device type and other factors of the communication object, a method for switching the active and standby computers of a secure computer platform with a two-by-two-out-of-two structure is designed to achieve the purpose of avoiding accidental failure, and improve the reliability of the system while ensuring the safety of the system.

[0006] The technical solution adopted by the present invention is a method for master-slave switching of a two-by-two security computer platform based on communication object status judgment. The security computer platform is based on a two-by-two-out-of-two structure and includes two independent logical computing units. The two independent logical computing units are divided into a master control system and a backup system according to the working status. The master-slave switching method is based on the master control system of the security computer platform and the backup system of the security computer platform and the status of external communication objects, and the communication objects are divided into priority levels, and the inversion values ​​of the master control system of the security computer platform and the backup system of the security computer platform are calculated respectively, so as to decide whether to perform master-slave switching between the master control system of the security computer platform and the backup system of the security computer platform.

[0007] The downtime value refers to the value calculated by the priority level value and the number of communication objects with normal communication in the priority level by the master control system or the backup system. The downtime value is a 32-bit unsigned integer, and the specific calculation formula is: downtime value = priority level * 223 + number of objects with normal communication.

[0008] The priority level refers to dividing the communication objects into multiple levels from high to low according to the devices controlled by the communication objects, and there may be multiple communication objects in each priority level.

[0009] The active / standby switching method of the secure computer platform includes the following active / standby switching rules:

[0010] Rule 1: For the communication objects of the same priority level, if the communication between the backup system of the security computer platform and the main control system of the communication object is completely normal, and the communication between the main control system of the security computer platform and the main control system of the communication object is partially interrupted, the main control system of the security computer platform will shut down.

[0011] Rule 2: For the communication objects of the same priority level, if the communication between the main control system of the security computer platform and the main control system of the communication object is completely interrupted, and the communication between the backup system of the security computer platform and the main control system of the communication object is partially interrupted, the main control system of the security computer platform will shut down.

[0012] Rule 3: For the communication objects of the same priority level, if the communication between the main control system of the security computer platform and the main control system of the communication object is partially interrupted, and the communication between the backup system of the security computer platform and the main control system of the communication object is partially interrupted, the main control system of the security computer platform will not fail.

[0013] Rule 4: The communication status between the secure computer platform and the communication object of a low priority level does not affect the shutdown decision of the communication status with the communication object of a high priority level.

[0014] Rule 5: When setting up normal communication, the backup system of the security computer platform should set up a normal communication state with the communication object later than the main control system of the security computer platform sets up a normal communication state.

[0015] Formulating rules for determining whether communication with the communication object is interrupted includes:

[0016] Rule 6: When the periodic communication with the communication object is interrupted, the backup system of the secure computer platform should be set to the communication interruption state earlier than the main control system of the secure computer platform.

[0017] Rule 7: If the main control system of the secure computer platform sends data normally in this cycle, the time when the main control system of the secure computer platform sets the communication interruption state should be earlier than the time when the backup system of the secure computer platform sets the communication interruption state.

[0018] Rule 8: If the main control system of the secure computer platform has not made a call in this cycle, the time when the main control system of the secure computer platform sets the communication interruption state should be later than the time when the backup system of the secure computer platform sets the communication interruption state.

[0019] Rule 9: For the communication object with a dual-system redundant structure, if one system of the security computer platform communicates normally with one system of the communication object and communication with the other system of the communication object is interrupted, it is considered that the security computer platform communicates normally with both systems of the communication object.

[0020] Rule 10: The communication status between the secure computer platform and the communication object is based only on the communication status with the communication object's main control system;

[0021] Rule 11: If the main control system of the secure computer platform and the backup system of the secure computer platform lose all communication with a certain communication object, the communication object cannot affect other main-backup switching rules.

[0022] The beneficial effect of the present invention is to provide a method for active-standby switching of a secure computer platform with a two-by-two-out-of-two structure based on communication object status judgment, thereby achieving timely switching of system status when external communication is interrupted, while reducing the probability of erroneous active-standby switching and avoiding the expansion of the impact of failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of a two-by-two-out-of-two secure computer platform active-standby switching based on communication object status judgment provided by an embodiment of the present invention.

[0024] Figure 2A schematic diagram of setting normal communication between communication objects provided by an embodiment of the present invention.

[0025] Figure 3 A schematic diagram of determining whether communication with a communication partner is interrupted provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

[0027] The embodiment of the present invention provides a two-by-two-out-of-two secure computer platform active-standby switching method based on communication object status judgment, such as Figure 1 As shown, the method calculates the failure values ​​of the two systems comprehensively through the communication status of the two systems' external communication objects, and finally decides whether to perform the master-slave switch.

[0028] The priority level refers to the classification of all communication objects into multiple levels from high to low according to the devices controlled by the external communication objects. There can be multiple communication objects in each priority level. The priority level is assigned a specific value, from high to low, which is key information (such as operation display command information), general information (such as input and output information) and ordinary information (such as communication information with other adjacent devices).

[0029] The "all normal communication with the priority level" refers to a scenario where each priority level may contain multiple communication objects, and the security computer platform communicates normally with the main control systems of all communication objects in the priority level. The "all interrupted communication with the priority level" refers to a scenario where the security computer platform has interrupted communication with the main control systems of all communication objects in the priority level. The "partial interrupted communication with the priority level" refers to a scenario where the security computer platform communicates normally with the main control systems of some communication objects in the priority level and has interrupted communication with the main control systems of the remaining objects.

[0030] The reverse operation refers to the working status of two independent logical computing units of the two-by-two safety computer platform being divided into the main control and the backup. When the main control system fails and the backup system operates normally, the backup system will be upgraded to the main control system, and the original main control system will be downgraded to the backup system and be in an offline or backup state.

[0031] The downtime value refers to a 32-bit unsigned integer calculated by the priority level value and the number of objects in the priority level that communicate normally with the main control system or the backup system. The specific calculation formula is: downtime value = priority level * 223 + number of objects in normal communication.

[0032] The priority level refers to dividing the communication objects into multiple levels from high to low according to the devices controlled by the communication objects, and there are one or more communication objects in each priority level.

[0033] The two-by-two-out-of-two secure computer platform active-standby switching rules based on communication object status judgment are formulated as follows:

[0034] Rule 1: For communication objects of the same priority level, if the communication between the backup system of the security computer platform and the main control system of the communication object is normal, and the communication between the main control system of the security computer platform and the main control system of the communication object is partially interrupted, the main control system will fail because the external communication status of the backup system is better than that of the main control system.

[0035] Rule 2: For communication objects of the same priority level, if the communication between the main control system of the security computer platform and the main control system of the communication object is completely interrupted, and the communication between the backup system of the security computer platform and the main control system of the communication object is partially interrupted, since the external communication status of the backup system is better than that of the main control system, the main control system will fail.

[0036] Rule 3: For communication objects of the same priority level, if the communication between the main control system of the security computer platform and the main control system of the communication object is partially interrupted, and the communication between the backup system of the security computer platform and the main control system of the communication object is partially interrupted, since both the backup system and the main control system have faults in external communication status, in order to prevent the expansion of the fault scope and the occurrence of unknown faults, the main control system will not shut down.

[0037] Rule 4: The communication status of the secure computer platform with a low-priority object may not affect the shutdown decision of the communication status with a high-priority object. That is, since the high-priority communication object has been determined not to be shut down by Rule 3, even if the low-priority communication object is determined to be shut down by Rule 1 or Rule 2, the shutdown action will not occur.

[0038] according to Figure 1As shown in the flowchart, loop through each priority level object, first determine whether the two systems of the security computer platform have a partial interruption scenario with the objects in this level. If both have partial interruptions, then the decision not to shut down the system is made according to the third rule at this priority level. If the low priority invalid flag is set according to the fourth rule, the shutdown values ​​of the main control system and the backup system are calculated for comparison. If the main control system and the backup system are in other communication states with the priority level object, the shutdown values ​​are calculated separately according to the communication states of the main control system and the backup system with the object. In the scenario based on the judgment of the state of the communication object of this priority level, the shutdown values ​​of the main control system and the backup system at this priority level are obtained, and compared and updated with the previously stored maximum shutdown value. After looping through all priority levels, the maximum shutdown values ​​of the main control system and the backup system are finally obtained. If the maximum shutdown value of the main control system is greater than the maximum shutdown value of the backup system, the shutdown action is completed, otherwise, the current state is maintained.

[0039] Preferably, the above method involves determining whether the communication status is normal and calculating the number of communications. Due to the redundant structure of the communication objects and the different communication modes, rules need to be formulated.

[0040] Preferably, Figure 2 As shown, the normal communication rules for setting the communication object are as follows:

[0041] Rule 5: When setting up normal communication, the backup system of the security computer platform should set up normal communication with the object later than the main control system of the security computer platform.

[0042] This rule can prevent network delays that occur during the communication establishment phase between the secure computer platform and the communication partner, the backup system being established before the main control system, and unnecessary downtime due to the first or second rule.

[0043] Preferably, Figure 3 As shown, the rules for determining whether the communication object is disconnected are formulated as follows:

[0044] Rule 6: When an interruption occurs with a periodic communication object, the backup system of the secure computer platform should set the communication interruption state earlier than the main control system sets the communication interruption state.

[0045] This rule corresponds to Rule 5 and is intended to prevent unnecessary downtime caused by the main control system of the security computer platform being interrupted before the backup system due to network delays when communication is interrupted or the communication partner is shut down.

[0046] Rule 7: The communication between the secure computer platform and the communication object is call-response communication, the main control system is the calling end, and the backup system is only for receiving but not sending. If the main control system of the secure computer platform sends data normally in this cycle, the time when the main control system sets the communication interruption state should be earlier than the time when the backup system sets the communication interruption state;

[0047] Since the backup system does not send data, it is impossible to determine whether the channel between the backup system and the communication object is normal. If the main control system determines that the communication is interrupted earlier than the backup system, it can be reversed to try whether the original backup system and the communication object can communicate normally.

[0048] Rule 8: The communication between the secure computer platform and the communication object is call-response communication, the main control system is the calling end, and the backup system is only for receiving but not sending. If the main control system of the secure computer platform does not make a call in this cycle, the time when the main control system sets the communication interruption state should be later than the time when the backup system sets the communication interruption state;

[0049] This rule is mainly aimed at the special situation of Rule 7. If the main control system has no data to send out, the communication partner will not reply. According to Rule 7, the main control system will set a communication interruption before the backup system, resulting in unnecessary downtime.

[0050] Preferably, based on the known communication status and according to different redundancy modes of communication objects, a rule for calculating the number of communication objects is formulated as follows:

[0051] Rule 9: For communication objects with a redundant structure that uses both a main control system and a backup system, both systems are equivalent to the main control system, and the communication information is in an "or" relationship. Therefore, if one system of the security computer platform communicates normally with one system of the communication object, and the communication with the other system of the communication object is interrupted, it is considered that the security computer platform communicates normally with both systems of the communication object.

[0052] This rule is to prevent normal shutdown in the following scenarios. When the main control system of the security computer platform is interrupted with one system of the dual-system object, and the backup control system is also interrupted with one system of the object, that is, both systems are partially interrupted, the system will not be shut down according to Rule 3. If the main control system and the next priority level object are all interrupted at this time, and the backup control system communicates normally with the safety network, it will not be able to shut down according to Rule 4. However, if it is judged according to Rule 9, it can be shut down, which is in line with expectations; at the same time, this rule can also avoid the error of wrong shutdown caused by the interruption of communication with one of the systems of this type of object.

[0053] Rule 10: For a communication object with a redundant structure of two times two, its dual systems are divided into a main control system and a backup system. Since the communication information only uses the main control system information, the communication status between the secure computer platform and the communication object is only based on the on-off status with the main control system of the communication object.

[0054] Rule 11: If the master control system and backup system of the secure computer platform lose all communication with a certain communication object, the communication object cannot affect other master-slave switching rules.

[0055] This rule is a method for improving reliability and availability for special scenarios in actual applications. If a communication object loses communication with both the primary and backup systems of the secure computer platform, the object may be shut down for transformation or dismantled. In this transitional stage, according to Rule 3, the primary and backup systems of the secure computer platform will maintain their current status and may not fail even if other communication failures occur.

[0056] The above method of the embodiment of the present invention provides a method for master-slave switching of a two-by-two safety computer platform based on the on-off status of the known communication object. Different judgment bases for the main control system and the backup system are formulated in the communication establishment stage, the periodic judgment communication interruption stage, and the calculation of the normal number of communications. This reduces unnecessary shutdowns due to network delays and other reasons, and avoids the phenomenon of erroneous shutdowns caused by different communication methods. The shutdown priority level and the shutdown value calculation formula are designed. According to the analysis of the different communication states of the main control system and the backup system to the communication object, by calculating and comparing the size of the shutdown value, it is decided whether to perform the master-slave switching, which solves the problems of erroneous shutdowns and unnecessary shutdowns of the two-by-two safety computer platform when communicating with objects with different communication methods, different redundant structures, and different control devices.

[0057] The above is an exemplary description of the present invention. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various improvements are made using the method concept and technical solution of the present invention, or they are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A two-by-two-out-of-two secure computer platform active-standby switching method based on communication object status judgment, characterized in that: The secure computer platform is based on a two-by-two-take-two structure and includes two independent logic computing units, which are divided into a main control system and a backup system according to the working status; the main-backup switching method is based on the judgment of the main control system of the secure computer platform and the backup system of the secure computer platform and the status of the external communication object, the communication objects are divided into priority levels, and the downtime values ​​of the main control system of the secure computer platform and the backup system of the secure computer platform are calculated respectively, so as to determine whether to perform the main-backup switching between the main control system of the secure computer platform and the backup system of the secure computer platform; The downtime value refers to a value calculated by the priority level value and the number of communication objects with normal communication in the priority level by the main control system and the backup system; The active / standby switching method of the secure computer platform includes the following active / standby switching rules: Rule 1: For the communication objects of the same priority level, if the communication between the backup system of the security computer platform and the main control system of the communication object is completely normal, and the communication between the main control system of the security computer platform and the main control system of the communication object is partially interrupted, the main control system of the security computer platform will be shut down; Rule 2: For the communication object of the same priority level, if the communication between the main control system of the secure computer platform and the main control system of the communication object is completely interrupted, and the communication between the backup system of the secure computer platform and the main control system of the communication object is partially interrupted, the main control system of the secure computer platform will shut down; Rule 3: For the communication objects of the same priority level, if the communication between the main control system of the secure computer platform and the main control system of the communication object is partially interrupted, and the communication between the backup system of the secure computer platform and the main control system of the communication object is partially interrupted, the main control system of the secure computer platform will not fail; Rule 4: The communication status of the secure computer platform with the communication object of a low priority level does not affect the shutdown decision of the communication status with the communication object of a high priority level; Rule 5: When setting up the normal communication state, the backup system of the secure computer platform shall set up the normal communication state with the communication object later than the main control system of the secure computer platform sets up the normal communication state; Formulating rules for determining whether communication with the communication object is interrupted includes: Rule 6: When the communication with the communication object of the periodic communication type is interrupted, the backup system of the secure computer platform sets the communication interruption state earlier than the master system of the secure computer platform sets the communication interruption state; Formulating a rule for determining whether communication with the communication object is interrupted also includes: Rule 7: If the main control system of the secure computer platform sends data normally in this cycle, the time when the main control system of the secure computer platform sets the communication interruption state should be earlier than the time when the backup system of the secure computer platform sets the communication interruption state; Rule 8: If the main control system of the secure computer platform does not make a call in this cycle, the time when the main control system of the secure computer platform sets the communication interruption state should be later than the time when the backup system of the secure computer platform sets the communication interruption state; Formulating a rule for determining whether communication with the communication object is interrupted also includes: Rule 9: For the communication object with a redundant structure of both a main control system and a backup system, if one system of the security computer platform communicates normally with one system of the communication object and the communication with the other system of the communication object is interrupted, it is considered that the security computer platform communicates normally with both systems of the communication object; The rules for determining whether the communication object has been disconnected also include: Rule 10: The communication status between the secure computer platform and the communication object is based only on the communication status with the communication object's main control system; Rule 11: If the main control system of the secure computer platform and the backup system of the secure computer platform lose all communication with a certain communication object, the communication object cannot affect other main-backup switching rules.

2. The method for switching between active and standby security computer platforms according to claim 1, characterized in that: The downtime value is a 32-bit unsigned integer, and the specific calculation formula is: downtime value = priority level * 223 + the number of objects with normal communication.

3. The method for switching between active and standby security computer platforms according to claim 1, characterized in that: The priority level refers to dividing the communication objects into multiple levels from high to low according to the devices controlled by the communication objects, and there are one or more communication objects in each priority level.

Images