A programmable controller master-slave switching and data synchronization system and method

Abstract

A programmable controller master-slave switching and data synchronization system and method, the system includes programmable master-slave controllers installed on a controller base: controller A and controller B; each controller is provided with an RS-232 circuit for master-slave switching and a Gigabit Ethernet circuit for data synchronization, and is interconnected with the corresponding circuits provided on the opposite controller. When the RS-232 circuit fails, Gigabit Ethernet takes over the master-slave arbitration function as a backup channel, and the backup controller obtains IEC user data, IEC task information, IEC task scheduling clock counter and other data from the master controller, thereby ensuring the consistency of data in the master and backup controllers and improving the reliability of the control system.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial automatic control, and in particular relates to a programmable controller master-slave switching and data synchronization system and method. Background Art

[0002] Programmable controllers are core components of industrial control systems. Controller hot standby redundancy is one of the most effective means of improving system reliability and stability. Redundant controllers use identical hardware, running identical programs and logical configurations. During operation, the primary controller synchronizes operating data with the backup controller, ensuring consistent control outputs. If the primary controller fails, the backup controller automatically switches to primary, ensuring a seamless transition and improving system reliability.

[0003] In existing control redundancy switching technology, 100M or 1000M Ethernet is generally used to achieve comparison of engineering logic and output data between the primary and standby systems, as well as synchronization of engineering logic and engineering data. However, the handling strategy for inconsistent firmware programs or engineering logic when both machines are started simultaneously has not been disclosed. However, there are significant differences in the master-slave heartbeat and switching methods. The following methods are more commonly used: 1) Reusing the Ethernet channel between the master and standby controllers and the monitoring system, or reusing the data transmission channel between the master and standby controllers. Due to the use of Ethernet channels, these two methods make the real-time performance of the master-slave controller switching low and cannot guarantee disturbance-free switching. On the other hand, when the Ethernet communication channel fails, the system will have a dual-master controller situation, which will have a fatal impact on the system operation; 2) Using dedicated master-slave switching circuits or channels, such as GPIO, FPGA synchronization interlock circuit, heartbeat pulse, etc., the external circuit design is complex and the failure rate is high; 3) Determine whether the opposite controller exists through the GPIO link, and exchange status data with the opposite controller through the 485 link. Due to the use of the 485 link, this method can only achieve half-duplex communication. If the master controller exits due to a fault during operation, the standby machine is first set to a pending state, and then the 485 link communication timeout determines that the opposite controller does not exist. The standby machine cannot immediately switch to the master, and disturbance-free switching cannot be guaranteed. Summary of the Invention

[0004] To address the deficiencies in the prior art, the present invention provides a system and method for master-slave switching and data synchronization of a programmable controller. An RS-232 circuit for master-slave switching and a Gigabit Ethernet circuit for data synchronization are provided on the controller. When the RS-232 circuit fails, the Gigabit Ethernet serves as a backup channel to take over the master-slave arbitration function. The backup controller obtains IEC user data, IEC task information, and IEC task scheduling clock counter from the master controller, thereby ensuring data consistency within the master and backup controllers and improving the reliability of the control system.

[0005] The present invention adopts the following technical solutions.

[0006] A programmable controller master / slave switching and data synchronization system includes programmable master / slave controllers installed on a controller base: controller A and controller B;

[0007] Each controller is equipped with an RS-232 circuit for active / standby switching and a Gigabit Ethernet circuit for data synchronization, and is interconnected with the corresponding circuits on the opposite controller.

[0008] Preferably, the controller base is provided with two 100M Ethernet interfaces for communicating with the monitoring system, two DP-NET interfaces for communicating with the IO modules, and a slot identification circuit.

[0009] Preferably, the hardware, program firmware and engineering configuration files of controller A and controller B are identical;

[0010] Each controller identifies the installation slot and sets the local machine as controller A or controller B, thereby completing the initialization of its respective network interface.

[0011] Preferably, the RS-232 circuit is used to periodically send the master / slave heartbeat information of the local controller during operation and receive the heartbeat information sent by the opposite controller to perform master / slave arbitration;

[0012] The Gigabit Ethernet circuit uses Ethernet physical layer protocol communication for synchronization of program firmware, engineering configuration files and operating data, and is also used as a backup channel for master-slave arbitration when the RS-232 circuit fails.

[0013] Preferably, the master / slave heartbeat information includes master / slave status, normal / fault status, program firmware CRC value, and engineering configuration file CRC value.

[0014] A programmable controller master-slave switching and data synchronization method, comprising:

[0015] S1: Based on the RS-232 circuit and Gigabit Ethernet circuit, the controller performs fault status self-test and consistency check during the power-on startup phase, completes the master-slave arbitration, and determines the master controller and the backup controller;

[0016] S2: During the power-on startup phase, the controller firmware and engineering configuration files are synchronized, and the main controller synchronizes the running data to the standby controller, so that the main and standby controllers enter the redundant operation state;

[0017] S3: Perform a self-check of the controller's fault status during operation, complete the master-slave arbitration, and re-determine the master controller and the backup controller;

[0018] S4: During operation, the active and standby controllers simultaneously receive data from the IO modules, and the active controller automatically synchronizes the data to the standby controller.

[0019] Preferably, step S1 includes the following steps:

[0020] When the controller starts, it is set as the standby controller and monitors whether it receives the heartbeat information from the peer end within the set time.

[0021] (1) If the other end is detected as the master controller, the startup mode is set to the standby controller startup mode. In the standby controller startup mode, the controller performs a consistency check of the program firmware and engineering configuration files. If they are inconsistent, the master-standby switching and data synchronization are prohibited, and the master controller automatically synchronizes the program firmware, engineering configuration files and operating data to the standby controller;

[0022] (2) If the other end is detected as a standby controller, the startup mode is set to dual-machine startup mode. In the dual-machine startup mode, the program firmware and engineering configuration file consistency check is performed. If they are inconsistent, the master-slave switching and data synchronization are prohibited, and the controller alarm light is lit. The alarm information is sent to the engineering station. The operator re-downloads the program firmware or engineering configuration file to the controller to make the program firmware and engineering configuration file of controller A and controller B consistent. Then, the fault status self-check and master-slave arbitration are performed: if both machines are fault-free or both have faults, controller A is the master controller; if controller A is normal and controller B is faulty, controller A is the master controller; if controller B is normal and controller A is faulty, controller B is the master controller;

[0023] (3) If no heartbeat information is received from the other end within the set time, it is considered that the other end is not started and this controller is set as the main controller.

[0024] Preferably, in step S1 , the fault state of the controller includes: hardware failure and engineering configuration file error.

[0025] Preferably, in step S2, in the standby controller startup mode, if the program firmware and engineering configuration files of controller A and controller B are inconsistent, the currently running main controller automatically synchronizes the program firmware and engineering configuration files to the standby controller, so that the program firmware and engineering configuration files of the main controller and the standby controller are consistent, and then the currently running main controller automatically synchronizes the operating data to the standby controller, so that the main and standby controllers enter a redundant operating state;

[0026] In dual-machine startup mode, the currently running master controller automatically synchronizes the running data to the standby controller, so that the master and standby controllers enter redundant operation state.

[0027] Preferably, in step S3, when the active and standby controllers are in redundant operation, the controller obtains the fault status of the controller in real time and receives the heartbeat information of the peer controller via the RS-232 circuit and the Gigabit Ethernet circuit, thereby obtaining the fault status of the peer controller and performing active and standby arbitration:

[0028] If the standby controller fails or stops running, the main controller continues to run as a single machine;

[0029] If the main controller fails or stops running, the main and standby controllers will be switched over and the original standby controller will become the main controller and continue to operate as a single machine.

[0030] If both the active and standby controllers are in good working order, the current active and standby status will be maintained and execution will continue. During operation, consistency checks of the program firmware and engineering configuration files will be performed regularly. If they are consistent, the active controller will synchronize the operating data to the standby controller in each IEC logic cycle. If they are inconsistent, active and standby switching will be prohibited, and the active controller will automatically synchronize the program firmware, engineering configuration files and operating data to the standby controller. Then, active and standby switching will be allowed, and the active and standby controllers will enter the redundant operating state and execute cyclically.

[0031] Preferably, in step S3, the fault status of the controller includes: hardware failure, failure of two DP-NET interfaces, failure of two Ethernet interfaces communicating with the monitoring system, program execution abnormality and logic execution abnormality.

[0032] Preferably, in step S4, the synchronization data includes IEC user data, including non-power-off retained data, power-off retained data, local variable data, IEC task information, and IEC task scheduling clock counter data.

[0033] The beneficial effects of the present invention are as follows:

[0034] 1) RS-232 circuit is used as the main channel for heartbeat communication of the active and standby controllers, and synchronous Ethernet is used as the backup channel for heartbeat communication of the active and standby controllers to ensure that there will be no dual-master controller when a single channel fails, thereby improving the reliability of the control system.

[0035] 2) The redundant channel uses Ethernet physical layer protocol communication. Data packet reception and transmission do not go through TCP / IP protocol analysis, which reduces the interference of station control layer communication on redundant communication and ensures the reliability of redundant communication between the master and standby machines.

[0036] 3) In dual-machine startup mode, the program firmware and engineering configuration file consistency check is automatically performed. If they are inconsistent, the master-slave switching and data synchronization are prohibited, and the operator re-downloads the program firmware or engineering configuration file to the controller, avoiding synchronization errors when the controller is started.

[0037] The present invention optimizes the design of the master-slave switching and data synchronization method of the programmable controller, ensures the consistency of the controller in the redundant operation mode, and improves the security and stability of the control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a network diagram of a redundant control system when the present invention is specifically implemented;

[0039] Figure 2 This is a flow chart of a controller switching and data synchronization method for a specific implementation of the present invention;

[0040] Figure 3 A flowchart of starting arbitration and starting synchronization when the present invention is implemented;

[0041] Figure 4 This is a flowchart of running arbitration and running synchronization when the present invention is implemented. DETAILED DESCRIPTION

[0042] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without making creative efforts are all within the scope of protection of the present invention.

[0043] like Figure 1 As shown, embodiment 1 of the present invention provides a programmable controller master-slave switching and data synchronization system. In a preferred but non-limiting embodiment of the present invention, the system includes programmable master-slave controllers installed on a controller base: controller A and controller B;

[0044] Each controller is equipped with an RS-232 circuit for master-slave switching (a communication circuit using the RS-232 standard interface) and a Gigabit Ethernet circuit for data synchronization, and is interconnected with the corresponding circuits set on the opposite controller through the controller base.

[0045] Further preferably, the controller base is provided with two 100M Ethernet interfaces for communicating with the monitoring system, two DP-NET interfaces for communicating with the IO module, and a slot identification circuit.

[0046] Among them, DP-NET is a master-slave high-speed internal bus. The master controller actively calls for IO module data. When the IO module sends response data, the master controller and the standby controller can receive it at the same time to ensure the synchronization and consistency of the input data.

[0047] Controller A and controller B use exactly the same hardware, program firmware and engineering configuration files;

[0048] Each controller identifies the installation slot and sets the local machine as controller A or controller B, thereby completing the initialization of its respective network interface.

[0049] During operation, the master and standby controllers periodically send their own master and standby heartbeat information through the RS-232 circuit and receive the heartbeat information sent by the peer controller to perform master and standby arbitration.

[0050] The Gigabit Ethernet circuit uses Ethernet physical layer protocol communication for synchronization of program firmware, engineering configuration files and operating data, and is also used as a backup channel for master-slave arbitration when the RS-232 circuit fails.

[0051] The master / slave heartbeat information includes the master / slave status, normal / fault status, program firmware CRC (Cyclical Redundancy Check) value, and engineering configuration file CRC value.

[0052] like Figure 2 As shown, embodiment 2 of the present invention provides a programmable controller master-slave switching and data synchronization method based on the above system, the method comprising the following steps:

[0053] S1: Start arbitration: During the power-on startup phase, the controller performs fault status self-test and consistency check, completes master-slave arbitration, and determines the master controller and the backup controller;

[0054] More preferably, Figure 3 As shown, in step S1, initiating arbitration further includes the following steps:

[0055] When the controller starts, it is set as the standby controller and monitors whether it receives the heartbeat information from the other end within 3 seconds.

[0056] (1) If the other end is detected as the master controller, the startup mode is set to the standby controller startup mode; in the standby controller startup mode, the controller performs a consistency check of the program firmware and engineering configuration files. If they are inconsistent, the master-slave switching and data synchronization are prohibited. The master controller automatically synchronizes the program firmware, engineering configuration files and operating data to the standby controller, and then allows the master-slave switching, and the master and standby controllers enter the redundant operation state.

[0057] (2) If the other end is detected as a standby controller, the startup mode is set to dual-machine startup mode. In dual-machine startup mode, a consistency check is performed on the program firmware and engineering configuration files. If they are inconsistent, the master-slave switching and data synchronization are prohibited, and the controller alarm light is turned on. The alarm information is sent to the engineering station, and the operator re-downloads the program firmware or engineering configuration files to the controller to make the program firmware and engineering configuration files of controller A and controller B consistent. The next step is to perform master-slave arbitration. If both controllers are normal or both have faults, controller A becomes the master controller. If controller A is normal and controller B is faulty, controller A becomes the master controller. If controller B is normal and controller A is faulty, controller B becomes the master controller.

[0058] (3) If no heartbeat information is received from the other end within 3 seconds, it is considered that the other end is not started and the controller is set as the main controller;

[0059] The main controller then automatically synchronizes the operating data to the standby controller, allowing the main and standby controllers to switch, and the main and standby controllers enter the redundant operating state.

[0060] The fault conditions for the controller to start arbitration include: hardware failure and engineering configuration file error.

[0061] S2: Startup synchronization: During the power-on startup phase, the controller firmware and engineering configuration files are synchronized according to the startup mode, and the main controller synchronizes the operation data to the standby controller, so that the main and standby controllers enter the redundant operation state;

[0062] Further preferably, starting synchronization further includes the following steps:

[0063] In the standby controller startup mode, if the program firmware and engineering configuration files of controller A and controller B are inconsistent, the currently running main controller will automatically synchronize the program firmware and engineering configuration files to the standby controller to make the program firmware and engineering configuration files of the main controller and standby controller consistent. Then the currently running main controller will automatically synchronize the operating data to the standby controller, so that the main and standby controllers enter the redundant operation state;

[0064] In the dual-machine startup mode, after step S1, the currently running master controller automatically synchronizes the running data to the standby controller, so that the master and standby controllers enter a redundant running state.

[0065] S3: Operation arbitration: During operation, the controller performs a self-check of the fault status, completes the master-slave arbitration, and re-determines the master controller and the backup controller;

[0066] More preferably, Figure 4 As shown, in step S3, running arbitration further includes the following steps:

[0067] In the active / standby redundant operation state, the controller obtains the fault status of the controller in real time and receives the heartbeat information of the peer controller through the RS-232 channel and the Gigabit Ethernet channel, thereby obtaining the fault status of the peer controller and performing active / standby arbitration;

[0068] If the standby controller fails or stops running, the main controller continues to run as a single machine;

[0069] If the main controller fails or stops running, the main and standby controllers will be switched over and the original standby controller will become the main controller and continue to operate as a single machine.

[0070] If both the active and standby controllers are in good working order, the current active and standby status will be maintained and execution will continue. During operation, consistency checks of the program firmware and engineering configuration files will be performed regularly. If the checks are the same, the active controller will synchronize the operating data to the standby controller in each IEC logic cycle. If they are not the same, the active and standby switching will be prohibited, and the active controller will automatically synchronize the program firmware, engineering configuration files and operating data to the standby controller. Then, the active and standby switching will be allowed, and the active and standby controllers will enter the redundant operating state and execute cyclically.

[0071] Further preferably, the fault states of the controller running arbitration include: hardware failure, failure of two DP-NET interfaces, failure of two Ethernet interfaces communicating with the monitoring system, abnormal program execution and abnormal logic execution.

[0072] S4: Operation synchronization: During operation, the main and standby controllers receive data from the IO modules at the same time, and the main controller automatically synchronizes the timing, remote control, remote control commands and operation data to the standby controller.

[0073] Further preferably, in step S4, the synchronous operation data includes IEC (standard industrial control programming language IEC) user data, including non-power-down retained data, power-down retained data, local variable data, IEC task information, and IEC task scheduling clock counter data.

[0074] The beneficial effects of the present invention are as follows:

[0075] 1) RS-232 circuit is used as the main channel for heartbeat communication of the active and standby controllers, and synchronous Ethernet is used as the backup channel for heartbeat communication of the active and standby controllers to ensure that there will be no dual-master controller when a single channel fails, thereby improving the reliability of the control system.

[0076] 2) The redundant channel uses Ethernet physical layer protocol communication. Data packet reception and transmission do not go through TCP / IP protocol analysis, which reduces the interference of station control layer communication on redundant communication and ensures the reliability of redundant communication between the master and standby machines.

[0077] 3) In dual-machine startup mode, the program firmware and engineering configuration file consistency check is automatically performed. If they are inconsistent, the master-slave switching and data synchronization are prohibited, and the operator re-downloads the program firmware or engineering configuration file to the controller, avoiding synchronization errors when the controller is started.

[0078] The present invention optimizes the design of the master-slave switching and data synchronization method of the programmable controller, ensures the consistency of the controller in the redundant operation mode, and improves the security and stability of the control system.

[0079] The present disclosure may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0080] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0081] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0082] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., utilizing an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions. The electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A programmable controller master-slave switching and data synchronization system, characterized in that: The system includes programmable master and standby controllers installed on a controller base: controller A and controller B; Each controller is provided with an RS-232 circuit for active / standby switching and a Gigabit Ethernet circuit for data synchronization, and is interconnected with the corresponding circuits provided on the opposite controller; The RS-232 circuit is used to periodically send the master / slave heartbeat information of the local controller during operation, and receive the heartbeat information sent by the opposite controller to perform master / slave arbitration; The Gigabit Ethernet circuit uses Ethernet physical layer protocol communication for synchronization of program firmware, engineering configuration files and operating data, and is also used as a backup channel for primary and backup arbitration when the RS-232 circuit fails; Based on RS-232 circuit and Gigabit Ethernet circuit, the controller fault status self-check and consistency check are performed during the power-on startup phase, the master-slave arbitration is completed, and the master controller and the standby controller are determined, including: When the controller is started, it is set as the standby controller and monitors whether the heartbeat information of the other end is received within the set time; (1) If the other end is detected as the master controller, the startup mode is set to the standby controller startup mode. In the standby controller startup mode, the controller performs a consistency check on the program firmware and engineering configuration files. If they are inconsistent, the master-standby switching and data synchronization are prohibited, and the master controller automatically synchronizes the program firmware, engineering configuration files and operating data to the standby controller; (2) If the other end is detected as a standby controller, the startup mode is set to the dual-machine startup mode. In the dual-machine startup mode, the consistency check of the program firmware and engineering configuration files is performed. If they are inconsistent, the master-slave switching and data synchronization are prohibited, and the controller alarm light is turned on. The alarm information is sent to the engineering station. The operator re-downloads the program firmware or engineering configuration file to the controller to make the program firmware and engineering configuration file of controller A and controller B consistent. Then, the fault status self-check and master-slave arbitration are performed: if both machines are fault-free or both have faults, controller A is the master controller; if controller A is normal and controller B is faulty, controller A is the master controller; if controller B is normal and controller A is faulty, controller B is the master controller; (3) If no heartbeat information is received from the other end within the set time, it is considered that the other end has not started and this controller is set as the main controller.

2. A programmable controller master-slave switching and data synchronization system according to claim 1, characterized in that: The controller base is provided with two 100M Ethernet interfaces for communicating with the monitoring system, two DP-NET interfaces for communicating with the IO module, and a slot identification circuit.

3. A programmable controller master-slave switching and data synchronization system according to claim 1, characterized in that: The hardware, program firmware and engineering configuration files of controller A and controller B are the same; Each controller identifies the installation slot and sets the local machine as controller A or controller B, thereby completing the initialization of the respective network interfaces.

4. A programmable controller master-slave switching and data synchronization system according to claim 1, characterized in that: The master / slave heartbeat information includes the master / slave status, normal / fault status, program firmware CRC value, and engineering configuration file CRC value.

5. A method for programmable controller master-slave switching and data synchronization implemented by the system according to any one of claims 1 to 4, characterized in that: The following steps are involved: S1: Based on RS-232 circuit and Gigabit Ethernet circuit, the controller fault status self-check and consistency check are performed during the power-on startup phase, the master-slave arbitration is completed, and the master controller and the backup controller are determined; S2: During the power-on startup phase, the controller firmware and engineering configuration files are synchronized, and the main controller synchronizes the running data to the standby controller, so that the main and standby controllers enter a redundant running state; S3: Perform a self-check of the fault status of the controller during operation, complete the master-slave arbitration, and re-determine the master controller and the standby controller; S4: During operation, the active and standby controllers simultaneously receive data from the IO modules, and the active controller automatically synchronizes the data to the standby controller.

6. A method for programmable controller master-slave switching and data synchronization according to claim 5, characterized in that: Step S1 includes the following steps: When the controller is started, it is set as the standby controller and monitors whether the heartbeat information of the other end is received within the set time; (1) If the other end is detected as the master controller, the startup mode is set to the standby controller startup mode. In the standby controller startup mode, the controller performs a consistency check on the program firmware and engineering configuration files. If they are inconsistent, the master-standby switching and data synchronization are prohibited, and the master controller automatically synchronizes the program firmware, engineering configuration files and operating data to the standby controller; (2) If the other end is detected as a standby controller, the startup mode is set to dual-machine startup mode. In the dual-machine startup mode, the consistency check of the program firmware and engineering configuration files is performed. If they are inconsistent, the master-slave switching and data synchronization are prohibited, and the controller alarm light is turned on. The alarm information is sent to the engineering station. The operator re-downloads the program firmware or engineering configuration file to the controller to make the program firmware and engineering configuration file of controller A and controller B consistent. Then, the fault status self-check and master-slave arbitration are performed: if both machines are fault-free or both have faults, controller A is the master controller; If controller A is normal and controller B is faulty, controller A is the main controller; if controller B is normal and controller A is faulty, controller B is the main controller; (3) If no heartbeat information is received from the other end within the set time, it is considered that the other end has not started and this controller is set as the main controller.

7. A method for programmable controller master-slave switching and data synchronization according to claim 6, characterized in that: In step S1, the fault status of the controller includes: hardware failure and engineering configuration file error.

8. A method for programmable controller master-slave switching and data synchronization according to claim 5, characterized in that: In step S2, in the standby controller startup mode, if the program firmware and engineering configuration files of controller A and controller B are inconsistent, the currently running main controller automatically synchronizes the program firmware and engineering configuration files to the standby controller, so that the program firmware and engineering configuration files of the main controller and the standby controller are consistent, and then the currently running main controller automatically synchronizes the operation data to the standby controller, so that the main and standby controllers enter a redundant operation state; In the dual-machine startup mode, the currently running master controller automatically synchronizes the running data to the standby controller, so that the master and standby controllers enter the redundant running state.

9. A method for programmable controller master-slave switching and data synchronization according to claim 5, characterized in that: In step S3, when the active and standby controllers are in redundant operation, the controller obtains the fault status of the controller in real time, and receives the heartbeat information of the opposite controller through the RS-232 circuit and the Gigabit Ethernet circuit, thereby obtaining the fault status of the opposite controller and performing active and standby arbitration: If the standby controller fails or stops running, the main controller continues to run as a single machine; If the main controller fails or stops running, the main and standby controllers will be switched, and the original standby controller will become the main controller and continue to run as a single machine. If both the active and standby controllers are fault-free, the current active and standby status will be maintained and continued to execute. During operation, the consistency check of the program firmware and engineering configuration files will be performed regularly. If they are consistent, the active controller will synchronize the operating data to the standby controller in each IEC logic cycle. If they are inconsistent, the active and standby switching will be prohibited, and the active controller will automatically synchronize the program firmware, engineering configuration files and operating data to the standby controller. Then the active and standby switching will be allowed, and the active and standby controllers will enter the redundant operating state and execute cyclically.

10. A method for programmable controller master-slave switching and data synchronization according to claim 9, characterized in that: In step S3, the fault status of the controller includes: hardware fault, two DP-NET interface faults, two Ethernet interface faults for communicating with the monitoring system, program execution abnormality and logic execution abnormality.

11. A method for programmable controller master-slave switching and data synchronization according to claim 5, characterized in that: In step S4, the synchronization data includes IEC user data, including non-power-off retention data, power-off retention data, local variable data, IEC task information, and IEC task scheduling clock counter data.

Images