Industrial control system and control method thereof

Abstract

The present application discloses an industrial control system, comprising: an input-output module and at least two mutually redundant controllers, characterized in that each of the at least two controllers comprises at least two mutually redundant central processors; wherein each central processor is used to: execute a first task; receive the result of other central processors executing the first task through a communication interface between at least two controllers; determine the final result of the first task by voting on the result of the central processor executing the first task plus the received result of other central processors executing the first task; and output the final result of the first task to the input-output module corresponding to the first task. The system can avoid the instability of the system during the master-slave switching. A control method for an industrial control system is also disclosed.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to an industrial control system and a control method thereof. Background Art

[0002] At present, many control systems use active-standby switching redundancy. Under this design, the IEC tasks in the controller run asynchronously in the redundant controllers. When the main controller fails, a hot standby switch is performed. The original standby controller is promoted to the main operation, and the failed main controller is downgraded to the standby to achieve active-standby switching. However, during the active-standby switching process, there is data disturbance, which causes jitter in the controller system.

[0003] Under normal system operation, the CPU of the host dispatches multiple IEC tasks to execute the user's control program, and the CPU of the standby dispatches multiple IEC tasks to execute the user's control program. However, the host and the standby are executed asynchronously and only the host's operation data will be sent to the input and output module (IO module) through the IOBUS bus. The IO module implements on-site control according to the host's control instructions. When the host sends a fault, the host is downgraded to the standby and the standby is promoted to the master to realize the master-slave switch. The newly promoted controller dispatches IEC tasks and sends the operation data to the IO module through the IOBUS bus. According to the current technical solution of the control system, there is data disturbance in the master-slave switch, which affects the on-site control; when the host has an undetected fault, the fault data has already taken effect, which will cause unpredictable risks to the site; after the master-slave switch function fails, the system will not be able to work. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides an industrial control system and a control method thereof, which can avoid the instability of the system during the master-slave switching.

[0005] In order to achieve the purpose of this application, an embodiment of the present invention provides an industrial control system, including: an input / output module and at least two mutually redundant controllers, each of the at least two controllers including at least two mutually redundant central processing units; wherein,

[0006] Each CPU is used to:

[0007] Execute the first task;

[0008] receiving, via a communication interface between at least two controllers, a result of other central processors executing the first task;

[0009] Determine the final result of the first task by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task; and

[0010] Output the final result of the first task to the input / output module corresponding to the first task.

[0011] In an optional embodiment, the final result of the first task is determined by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task, including:

[0012] If the result of one or more central processors executing the first task is not received within a preset time, each central processor performs a downgrade vote based on the number of remaining central processors except the one or more central processors, on the result of the central processor executing the first task plus the result of the execution of the first task received from the remaining central processors, to determine the result of the first task.

[0013] In an optional embodiment, each controller further includes a synchronous logic processor, each synchronous logic processor being configured to:

[0014] Exchange clock signals and master enable signals with other synchronous logic processors; wherein the master enable signals are generated by the synchronous logic controller according to the results of self-detection performed by each central processor in the controller in which it is located and the synchronous logic controller;

[0015] If it is detected that the flag bit in the received main enable signal indicates that the controller corresponding to the main enable signal is faulty, then when determining the clock of the industrial control system, the clock of the central processor in the faulty controller is excluded as the clock of the industrial control system.

[0016] In an optional embodiment, the final result of the first task is determined by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task, including:

[0017] Eliminate the result of executing the first task by the central processor whose corresponding central processor fault is indicated by the flag bit in the received master enable signal;

[0018] The results of executing the first task by other central processors other than the excluded processor are voted on to determine the result of the first task to be output to the input / output module corresponding to the first task.

[0019] In an optional embodiment, each synchronous logical processor is further configured to:

[0020] When the controller in which it is located serves as the main controller of the industrial control system according to the preset priority, the clock of the default central processing unit in the controller is used as the clock of the industrial control system.

[0021] In an optional embodiment, each synchronous logical processor is further configured to:

[0022] Outputting a master-slave status signal to other synchronous logic controllers in the industrial control system; wherein the master-slave status signal indicates whether the clock of the central processor in the controller where the synchronous logic controller is located is used as the clock of the industrial control system;

[0023] and

[0024] Each synchronous logical processor is also used to:

[0025] According to the received master-slave state signal, the master enable signal and the preset priority of the controller, a controller where a central processor whose clock is used as the clock of the industrial control system is located is determined.

[0026] In an optional embodiment, performing the same first task includes:

[0027] After the clocks of the central processors in the industrial control system are synchronized, if the accumulated number of second pulse signals received by each central processor from the synchronous logic processor in the controller where it is located reaches a preset threshold, the same first task is started to be executed.

[0028] In an optional embodiment, each controller further includes a coprocessor, the coprocessor is connected to at least two mutually redundant controllers in the controller and an input-output module in the industrial control system, and the coprocessor is used to output the result of the first task from the central processor in the controller to the corresponding input-output module;

[0029] and

[0030] The coprocessor is also used to receive input signals from the input and output modules.

[0031] In order to achieve the above object, an embodiment of the present invention provides a control method of an industrial control system, wherein the industrial control system includes an input / output module and at least two mutually redundant controllers, each of the at least two controllers includes at least two mutually redundant central processing units; the control method includes:

[0032] Each central processing unit performs a first task;

[0033] Each central processor receives the result of executing the first task by other central processors through the communication interface between at least two controllers;

[0034] Each central processor determines the final result of the first task by voting on the result of the first task performed by the central processor itself plus the received results of the first task performed by other central processors; and

[0035] Each central processing unit outputs the final result of the first task to the input / output module corresponding to the first task.

[0036] In an optional embodiment, each central processor determines the final result of the first task by voting on the result of the first task performed by the central processor itself plus the received results of the first task performed by other central processors, including:

[0037] If the result of one or more central processors executing the first task is not received within a preset time, each central processor performs a downgrade vote based on the number of remaining central processors except the one or more central processors, on the result of the central processor executing the first task plus the result of the execution of the first task received from the remaining central processors, to determine the result of the first task.

[0038] In this way, the mutually redundant CPUs in at least two controllers can process the same task and obtain calculation results. Then each CPU can aggregate its own calculation results with the results of other processors and then vote on them, thereby avoiding system instability caused by active / standby switching when a processor fails, and voting on the aggregated results can also minimize the adverse effects caused by calculation errors of a single CPU.

[0039] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0041] Figure 1 A block diagram of an industrial control system provided by an embodiment of the present invention;

[0042] Figure 2 A flow chart of a control method for an industrial control system provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clear, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other arbitrarily without conflict.

[0044] The steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions. Also, although a logical sequence is shown in the flowchart, in some cases, the steps shown or described can be performed in a sequence different from that shown here.

[0045] In order to solve the above technical problems, an embodiment of the present invention provides an industrial control system, such as Figure 1 As shown, the industrial control system includes: input and output modules (such as Figure 1 310, 320, 330 and 340) and at least two controllers (such as Figure 1 100 and 200), each of the at least two controllers includes at least two central processors that are mutually redundant; wherein,

[0046] Each CPU is used to:

[0047] Execute the first task;

[0048] receiving, via a communication interface between at least two controllers, a result of other central processors executing the first task;

[0049] Determine the final result of the first task by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task; and

[0050] Output the final result of the first task to the input / output module corresponding to the first task.

[0051] In this way, the mutually redundant CPUs in at least two controllers can process the same task and obtain calculation results. Then each CPU can aggregate its own calculation results with the results of other processors and then vote on them, thereby avoiding system instability caused by active / standby switching when a processor fails, and voting on the aggregated results can also minimize the adverse effects caused by calculation errors of a single CPU.

[0052] In an optional embodiment, the final result of the first task is determined by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task, including:

[0053] If the result of one or more central processors executing the first task is not received within a preset time, each central processor performs a downgrade vote based on the number of remaining central processors except the one or more central processors, on the result of the central processor executing the first task plus the result of the execution of the first task received from the remaining central processors, to determine the result of the first task.

[0054] In an optional embodiment, each controller further includes a synchronous logic processor, each synchronous logic processor being configured to:

[0055] Exchange clock signals and master enable signals with other synchronous logic processors; wherein the master enable signals are generated by the synchronous logic controller according to the results of self-detection performed by each central processor in the controller in which it is located and the synchronous logic controller;

[0056] If it is detected that the flag bit in the received main enable signal indicates that the controller corresponding to the main enable signal is faulty, then when determining the clock of the industrial control system, the clock of the central processor in the faulty controller is excluded as the clock of the industrial control system.

[0057] In an optional embodiment, the final result of the first task is determined by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task, including:

[0058] Eliminate the result of executing the first task by the central processor whose corresponding central processor fault is indicated by the flag bit in the received master enable signal;

[0059] The results of executing the first task by other central processors other than the excluded processor are voted on to determine the result of the first task to be output to the input / output module corresponding to the first task.

[0060] In an optional embodiment, each synchronous logical processor is further configured to:

[0061] When the controller in which it is located serves as the main controller of the industrial control system according to the preset priority, the clock of the default central processing unit in the controller is used as the clock of the industrial control system.

[0062] In an optional embodiment, each synchronous logical processor is further configured to:

[0063] Outputting a master-slave status signal to other synchronous logic controllers in the industrial control system; wherein the master-slave status signal indicates whether the clock of the central processor in the controller where the synchronous logic controller is located is used as the clock of the industrial control system;

[0064] and

[0065] Each synchronous logical processor is also used to:

[0066] According to the received master-slave state signal, the master enable signal and the preset priority of the controller, a controller where a central processor whose clock is used as the clock of the industrial control system is located is determined.

[0067] In an optional embodiment, performing the same first task includes:

[0068] After the clocks of the central processors in the industrial control system are synchronized, if the accumulated number of second pulse signals received by each central processor from the synchronous logic processor in the controller where it is located reaches a preset threshold, the same first task is started to be executed.

[0069] In an optional embodiment, each controller further includes a coprocessor, the coprocessor is connected to at least two mutually redundant controllers in the controller and an input-output module in the industrial control system, and the coprocessor is used to output the result of the first task from the central processor in the controller to the corresponding input-output module;

[0070] and

[0071] The coprocessor is also used to receive input signals from the input and output modules.

[0072] In order to solve the above technical problems, an embodiment of the present invention provides a control method of an industrial control system, wherein the industrial control system includes an input / output module and at least two mutually redundant controllers, each of the at least two controllers includes at least two mutually redundant central processing units; Figure 2 As shown, the control method includes steps S101 to S107.

[0073] Step S101, each central processing unit executes a first task.

[0074] In step S103, each central processor receives the result of executing the first task by other central processors through the communication interface between at least two controllers.

[0075] In step S105, each central processor determines the final result of the first task by voting on the result of the first task performed by the central processor itself plus the received results of the first task performed by other central processors.

[0076] Step S107: each central processing unit outputs the final result of the first task to the input / output module corresponding to the first task.

[0077] In an optional embodiment, step S105 includes:

[0078] If the result of one or more central processors executing the first task is not received within a preset time, each central processor performs a downgrade vote based on the number of remaining central processors except the one or more central processors, on the result of the central processor executing the first task plus the result of the execution of the first task received from the remaining central processors, to determine the result of the first task.

[0079] Although the embodiments disclosed in the present invention are as above, the above contents are only embodiments adopted to facilitate understanding of the present invention and are not intended to limit the present invention. Any technician in the field to which the present invention belongs can make any modifications and changes in the form and details of implementation without departing from the spirit and scope disclosed in the present invention, but the patent protection scope of the present invention shall still be subject to the scope defined in the attached claims.

Claims

1. An industrial control system, comprising: An input / output module and at least two mutually redundant controllers, each of the controllers further comprising a synchronous logic processor, wherein each of the at least two controllers comprises at least two mutually redundant central processors; wherein each of the central processors is used to: Execute the first task; receiving, via a communication interface between the at least two controllers, a result of other central processors executing the first task; Determine a final result of the first task by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task; and Outputting the final result of the first task to the input-output module corresponding to the first task; Each of the synchronous logic processors is used to: exchange clock signals with other synchronous logic processors, and when the controller in which it is located serves as the main controller of the industrial control system according to a preset priority, use the clock of the default central processor in the controller as the clock of the industrial control system; Each of the central processors executes a first task, including: after the clocks of the central processors in the industrial control system are synchronized, if the cumulative number of second pulse signals received by each central processor from the synchronous logic processor in the controller where it is located reaches a preset threshold, it starts to execute the same first task.

2. The industrial control system according to claim 1, wherein: The method of determining the final result of the first task by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task comprises: If the result of one or more of the central processors executing the first task is not received within a preset time, each of the central processors performs a downgrade vote based on the number of remaining central processors other than the one or more central processors, adding the result of the execution of the first task by the central processor itself and the results received from the remaining central processors to determine the result of the first task.

3. The industrial control system according to claim 1, characterized in that: Each of the synchronous logic processors is further configured to: Exchange a master enable signal with other synchronous logic processors; wherein the master enable signal is generated by the synchronous logic processor according to the results of self-detection performed by each central processor in the controller where the synchronous logic processor is located and the synchronous logic processor; If it is detected that the flag bit in the received main enable signal indicates that the controller corresponding to the main enable signal is faulty, then when determining the clock of the industrial control system, the clock of the central processor in the faulty controller is excluded as the clock of the industrial control system.

4. The industrial control system according to claim 3, wherein: The method of determining the final result of the first task by voting on the result of the CPU executing the first task plus the received results of other CPUs executing the first task comprises: Excluding the result of executing the first task by the central processor whose corresponding central processor fault is indicated by the flag bit in the received master enable signal; Voting is performed on results of executing the first task by other central processors except the excluded processor to determine the result of the first task to be output to an input / output module corresponding to the first task.

5. The industrial control system according to claim 3, characterized in that: Each of the synchronous logic processors is further configured to: Outputting a master-slave status signal to other synchronous logic processors in the industrial control system; wherein the master-slave status signal indicates whether the clock of the central processor in the controller where the synchronous logic processor is located is used as the clock of the industrial control system; and Each of the synchronous logic processors is further configured to: According to the received master-slave state signal, the master enable signal and the preset priority of the controller, a controller where a central processor whose clock is used as the clock of the industrial control system is located is determined.

6. The industrial control system according to claim 1, characterized in that: Each of the controllers further includes a coprocessor, the coprocessor being connected to the at least two mutually redundant controllers in the controller and the input / output module in the industrial control system, and the coprocessor being used for the central processor in the controller to output the result of the first task to the corresponding input / output module; and The coprocessor is also used to receive input signals from the input / output module.

7. A control method for an industrial control system, the industrial control system comprising an input / output module and at least two mutually redundant controllers, each of the controllers further comprising a synchronous logic processor, and each of the at least two controllers comprising at least two mutually redundant central processing units; characterized in that: The control method comprises: Each of the central processors performs a first task; Each of the central processors receives the result of executing the first task by other central processors through the communication interface between the at least two controllers; Each of the central processors determines the final result of the first task by voting on the result of the first task performed by the central processor itself plus the received results of the first task performed by other central processors; and Each of the central processing units outputs a final result of the first task to an input / output module corresponding to the first task; Each of the synchronization logics exchanges clock signals with other synchronization logic processors, and when the controller in which it is located serves as the main controller of the industrial control system according to a preset priority, the clock of the default central processor in the controller is used as the clock of the industrial control system; Each of the central processors executes a first task, including: after the clocks of the central processors in the industrial control system are synchronized, if the cumulative number of second pulse signals received by each central processor from the synchronous logic processor in the controller where it is located reaches a preset threshold, it starts to execute the same first task.

8. The control method according to claim 7, wherein: Each of the central processors determines a final result of the first task by voting on a result of the central processor executing the first task plus a result of other central processors executing the first task, including: If the result of one or more of the central processors executing the first task is not received within a preset time, each of the central processors performs a downgrade vote based on the number of remaining central processors other than the one or more central processors, adding the result of the execution of the first task by the central processor itself and the results received from the remaining central processors to determine the result of the first task.

Images