A phase synchronization system for a triple redundant controller

Abstract

The application provides a phase synchronization system for a three-redundancy controller, which comprises three controllers in communication with each other, each of which comprises an MCU and an FPGA. The FPGA is used for outputting a constant clock signal and diagnosing clock signals of all the three controllers. The MCU periodically sends diagnosis data and phase data to the other two controllers through a communication module. A voting synchronization module of the MCU determines a master clock according to the diagnosis data and calculates a phase adjustment value to complete phase synchronization with the master clock according to the phase data. The three-redundancy controller phase synchronization system provided by the application has the characteristics of simple scheme and strong fault tolerance.

Description

Technical Field

[0001] This invention relates to the field of automatic control, and more particularly to a phase synchronization system for a triple redundant controller. Background Technology

[0002] Triple-redundant control systems are widely used in various high-reliability scenarios, such as nuclear power, petrochemicals, aerospace, and automotive manufacturing. In these scenarios, the system needs to possess high reliability and safety to avoid accidents or incidents caused by equipment failure or control system instability. In a triple-redundant control system, each redundant module runs the same control algorithm and processes input and output data in the same way. Through clock synchronization, the three controllers can simultaneously receive and process input and output data, and also help the system recover quickly in the event of a fault, thereby increasing the system's availability and stability.

[0003] In existing technologies, there are several methods for synchronizing triple-redundant controllers. For example, synchronization can be achieved through communication between redundant controllers; however, in this approach, the clocks of the controllers cannot diagnose each other, and when the master controller's clock malfunctions, it cannot switch to a normal controller in a timely manner. Alternatively, multiple controllers can be synchronized using a common clock signal, but if the clock source in this approach malfunctions, the entire system will fail to operate normally. Another method uses independent hardware and software clock synchronization modules to synchronize the clocks between redundant controllers; however, this approach has high development and maintenance costs and fails to make full use of the controllers' powerful communication and computational capabilities, making it uneconomical. In summary, existing controller synchronization technologies still have room for improvement in terms of system complexity, fault tolerance, and synchronization performance. Summary of the Invention

[0004] Purpose of the invention: The technical problem to be solved by the present invention is to address the shortcomings of the prior art by providing a phase synchronization system for a triple redundant controller. The system includes three redundant controllers, each controller including an MCU and an FPGA. The MCU includes a communication module, a phase counting module, and a voting synchronization module. The FPGA includes a clock output module and a clock diagnostic module. The phase refers to the operating cycle of the controller in each control cycle.

[0005] The clock output module of the FPGA outputs a clock signal at a fixed frequency. The clock signal is connected to the phase counting module for updating the phase value. The clock signal is also connected to the clock diagnostic module of the controller's own FPGA and the clock diagnostic modules of two other controller FPGAs.

[0006] The FPGA's clock diagnostic module simultaneously diagnoses the frequencies of the three clock signals to obtain the clock diagnostic data of the controller.

[0007] The MCU's communication module is used to communicate with the other two controllers and obtain communication diagnostic data for this controller based on the communication status.

[0008] The MCU's communication module sends the diagnostic data of this controller, the diagnostic data of the other two controllers, and the phase data of this controller to the other two controllers in each control cycle. The controller that receives the message data needs to send a response message within the timeout period.

[0009] The diagnostic data includes clock diagnostic data and communication diagnostic data;

[0010] The phase data includes the controller's control cycle and the controller's real-time phase value;

[0011] The voting synchronization module of the MCU votes based on the diagnostic data, determines the master clock controller, calculates the difference between the master clock phase value and the phase value of this controller, and calculates the phase adjustment value Adj, which is used to adjust the control cycle of this controller and perform phase synchronization.

[0012] The three redundant controllers are denoted as controller A, controller B, and controller C, respectively. The left-right relationship between the controllers is defined as follows: A is to the left of C and A is to the right of B; B is to the left of A and B is to the right of C; C is to the left of B and C is to the right of A.

[0013] The phase counting module is used to perform the following calculation: increment by 1 when the clock signal has a rising edge; the phase value varies within the range of [0, N], where N is the upper limit of the phase value; the calculation method is as follows:

[0014] N = T * F / 1000 - 1 + Adj

[0015] Where T is the control cycle set in the configuration engineering, F is the frequency value of the clock signal, and Adj is the phase adjustment value calculated in this case;

[0016] When the phase value is 0, it represents the start time of a single control cycle of the controller; when the phase value is N, it represents the end time of a single control cycle of the controller; when the phase value changes from N to 0 and starts increasing again, it represents the start of a new control cycle of the controller.

[0017] The control cycles of the three redundant controllers are all equal.

[0018] The communication module of controller A uses two independent gigabit Ethernet channels to communicate point-to-point with the communication modules of the other two controllers. The Ethernet packets of the controller's MCU are sent directly to the other controller through the Ethernet hardware link layer without going through the Ethernet protocol stack, so as to reduce the link transmission delay and ensure the real-time performance of the data and the stability of the link delay.

[0019] The communication diagnostic data is updated at the end of the control cycle to indicate whether the communication between this controller A and the other two controllers is normal. If controller C sends a response message in a timely manner during the control cycle, and a diagnostic data message actively sent by controller C is received during the control cycle, then controller C's communication is considered normal; otherwise, communication is abnormal. If controller B sends a response message in a timely manner during the control cycle, and a diagnostic data message actively sent by controller B is received during the control cycle, then controller B's communication is considered normal; otherwise, communication is abnormal. If no data message is received from controller C or B during the control cycle, the diagnostic data of controller C or B stored in this controller A is reset to empty.

[0020] The communication module of controller A sends data to controllers C and B, including not only its own diagnostic data and phase data, but also diagnostic data from controllers C and B. When communication between two controllers fails, they can still obtain each other's diagnostic data from a third controller. For example, if the communication link between controllers B and C fails, controller B can obtain controller C's diagnostic data from data received from controller A, and controller C can obtain controller B's diagnostic data from data received from controller A.

[0021] The formula for calculating the phase adjustment value Adj is:

[0022] Adj=Cnt1–Cnt0–TxDelay,

[0023] Where Cnt0 is the count value received from the main clock controller from the clock controller, Cnt1 is the count value of this controller, and TxDelay is the link transmission delay time;

[0024] When Adj is positive, it means that the phase of this controller is ahead of the phase of the master clock. The upper limit of the phase of this control cycle, N, will be increased by Adj, so that the current control cycle is "stretched" in order to "wait" for the master clock controller.

[0025] When Adj is negative, it means that the phase of this controller is "lagging" behind the phase of the master clock. The upper limit of the phase N in this cycle will be reduced by Adj, so that the current control cycle is "compressed" in order to "catch up" with the master clock controller.

[0026] Adj only affects the upper limit value N of the phase in the current control cycle of the controller. When the phase value is reset to 0, Adj is also reset to 0.

[0027] Each control cycle is divided into multiple phase stages, namely: input data acquisition, input data synchronous voting, configuration logic calculation, output data synchronous voting, output data refresh, controller self-diagnosis, and idle.

[0028] The idle phase phase value is set to occupy Idle. Since the current control cycle of the controller is compressed when the phase adjustment value Adj is negative, in order not to affect the normal function of the controller, the minimum value of Adj is -Idle, and the range of Adj is [-Idle, T*F / 2].

[0029] The voting synchronization module determines the master clock controller by voting based on diagnostic data, specifically including the following steps:

[0030] Step 1: When a controller is determined to have a communication error or empty data by either the left or right controller, the controller becomes a slave clock controller and no longer participates in the voting; obtain the number M of controllers participating in the voting.

[0031] Step 2: Determine the voting method based on the number M of controllers with normal communication. This method is used to vote on whether the controller clock is normal. When M is 3, the voting follows the principle of 2 out of 3, i.e., the minority obeys the majority. When M is 2, the voting follows the principle of 1 out of 2, i.e., both results must be normal for it to be considered normal. When M is 1, the diagnostic result is used directly. If the clock voting result is abnormal, the controller becomes a slave clock controller. If the clock voting result is normal, proceed to Step 3.

[0032] Step 3, determine the master clock controller: if only one controller's clock signal is voted as normal, then that controller is the master clock controller; if two or more controllers' clock signals are voted as normal, then the master clock controller is determined based on the controller's position, with the priority being: controller A > controller B > controller C.

[0033] Beneficial effects:

[0034] The three controllers described in this invention can diagnose each other's clocks and communication links in real time, promptly detect abnormalities in the master clock, and select the normal controller as the master clock through a voting process, thus exhibiting high fault tolerance.

[0035] This invention fully utilizes the controller's gigabit Ethernet high-speed link to transmit diagnostic messages, thereby achieving phase synchronization and high synchronization performance.

[0036] The phase synchronization system described in this invention only requires an MCU and an FPAG in its hardware configuration, making the system solution relatively simple and the cost low. Attached Figure Description

[0037] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0038] Figure 1This is a schematic diagram of the triple redundancy control system structure of the present invention.

[0039] Figure 2 This is a flowchart illustrating the composition of diagnostic data.

[0040] Figure 3 This is a schematic diagram of the data message content.

[0041] Figure 4 This is a flowchart for communication diagnostics.

[0042] Figure 5 This is a flowchart for clock diagnostics.

[0043] Figure 6 This is a schematic diagram of the phase phase of each controller. Detailed Implementation

[0044] See Figure 1 In one embodiment of the present invention, a phase synchronization system for a triple-redundant controller is provided. The system includes three redundant controllers, namely controller A, controller B, and controller C. Each controller consists of an MCU and an FPGA. The MCU includes a communication module 101, a phase counting module 102, and a voting synchronization module 103. The FPGA includes a clock output module 201 and a clock diagnostic module 202.

[0045] The FPGA's clock output module 201 outputs a fixed-frequency clock signal 203, which is a square wave signal. This clock signal 203 is connected to the MCU's phase counting module 102 for phase value updates. Simultaneously, the clock signal 203 is also connected to the controller's own FPGA's clock diagnostic module 202, as well as the clock diagnostic modules 202 of two other controller FPGAs. The FPGA's clock diagnostic module 202 simultaneously diagnoses the three clock signals 203 to obtain the controller's clock diagnostic data.

[0046] The MCU's communication module 101 communicates with the left and right controllers, obtaining communication diagnostic data for the controller based on the communication status. Within each control cycle, the MCU's communication module 101 sends the diagnostic data of the controller, the diagnostic data of the left and right controllers, and the phase data of the controller to the other two controllers. Controllers receiving the data are required to send a response message within the timeout period.

[0047] See Figure 2 The diagnostic data includes diagnostic data of the controller for the three clock signals 203 and communication diagnostic data of the controller for the left and right controllers.

[0048] The phase data includes the controller's control cycle and the controller's real-time phase value.

[0049] The voting synchronization module 103 of the MCU votes based on the diagnostic data, determines the master clock controller, calculates the difference between the master clock phase value and the phase value of this controller, and calculates the phase adjustment value Adj, which is used to adjust the control cycle of this controller and perform clock synchronization.

[0050] The three redundant controllers are controller A, controller B, and controller C. The left-right relationship between the controllers is defined as follows: A is to the left of C and A is to the right of B; B is to the left of A and B is to the right of C; C is to the left of B and C is to the right of A.

[0051] The phase counting module of the MCU is used for phase value updates. The GPIO port of the MCU connected to the clock signal 203 is set to rising edge interrupt mode. When the clock signal 203 has a rising edge, the phase value is incremented by 1 in the interrupt service function. The range of the phase value is [0, N], where N is the upper limit of the phase value. If the current phase value is N, the phase value will become 0 when the clock signal 203 has a rising edge next time. The upper limit value N is calculated as follows:

[0052] N=T*F / 1000-1+Adj (1)

[0053] Where: T is the control cycle set in the configuration project, in milliseconds. The configuration project is usually edited by the user in configuration programming software and then downloaded to the controller, including hardware configuration, logic algorithm, and other data. F is the frequency value of clock signal 203, in Hertz. Adj is the phase adjustment value calculated in this case. For example, when the frequency of clock signal 203 is 1000Hz and the user-set controller cycle is 100ms, when Adj is 0, the value of N is 99, that is, the phase value increases from 0 to 99 and then increases again from 0.

[0054] The frequency value F of clock signal 203 is determined during product design and is related to the computing power of the MCU. When the computing power of the MCU is strong, the frequency value F can be designed to be larger. With the control period T remaining unchanged, according to Formula 1, N will become larger, thereby improving the phase granularity of the phase counting module.

[0055] The control cycle of the controller is determined by the engineering designer and distributed to the three controllers through a configuration file. A shorter control cycle results in higher real-time control. When the three controllers are powered on together, if their configuration files are identical, their control cycles will be identical. If the configurations of one controller differ from those of its left and right counterparts, the configuration files will be synchronized via the communication module according to the majority rule. After synchronization, the control cycles of the three controllers will be identical. If the configuration files of any pair of controllers are different, synchronization between controllers is impossible, and the configuration files must be downloaded again.

[0056] The MCU's communication module uses two independent gigabit Ethernet channels to communicate point-to-point with the communication modules of the other two controllers. The MCU of each controller assembles packets in a buffer and then directly sends them to the other controllers using its Ethernet peripheral. The MCUs of the other controllers receive the packets from their Ethernet peripherals and immediately parse and process them. From the OSI communication model perspective, this packet sending process directly transmits application-layer packets to other controllers through the data link layer. The received packets from the controllers directly reach the application layer for processing, thereby improving the real-time performance of data transmission and reducing jitter in the packet transmission link.

[0057] See Figure 3 The message data consists of: message header, phase data of this controller, diagnostic data of the left controller, diagnostic data of the right controller, and check value. The check value is the MD5 check result from the message header to the diagnostic data of the right controller.

[0058] See Figure 4 The aforementioned communication diagnostic data is updated at the end of the control cycle, and the determination process is as follows:

[0059] S100: Check whether the other party responds promptly after sending message data to the other party controller in this cycle. If the response is timely, proceed to S101; if the response times out, proceed to S103 to determine that the other party controller is experiencing communication problems.

[0060] S101, check whether the other party controller actively sends a data packet in this cycle. If it is received, proceed to S102 to determine that the other party controller is communicating normally. If it is not received, proceed to S103 to determine that the other party controller is communicating abnormally, and set the diagnostic data of the other party controller to "empty".

[0061] See Figure 5 The FPGA's clock diagnostic module monitors the signal periods of three clock signals in real time. If the difference between the measured signal period and the designed signal period does not exceed the judgment threshold, the clock signal is considered normal; otherwise, the clock signal is considered abnormal. Assuming the clock signal frequency is 1kHz, i.e., the designed signal period is 1ms, and the error threshold is 0.5%, the workflow is as follows:

[0062] S200, the theoretical signal period of the clock signal is known to be 1000us, and the error threshold of 0.5% corresponds to a difference of ±5us;

[0063] S201, save the current timestamp Stamp1 on the first rising edge of the clock signal;

[0064] S202, save the current timestamp Stamp2 on the second rising edge of the clock signal;

[0065] S203, the calculation error Err = Stamp2 - Stamp1;

[0066] S204. Compare whether the error Err is less than ±5us. If it is within ±5us, proceed to S205 to determine that the other party's controller clock is normal. If it exceeds ±5us, proceed to S206 to determine that the other party's controller clock is abnormal.

[0067] The phase adjustment value Adj is calculated as follows:

[0068] Adj=Cnt1–Cnt0–TxDelay (2)

[0069] Where Cnt0 is the count value sent by the master clock controller, Cnt1 is the phase value of the slave clock controller, and TxDelay is the phase value corresponding to the link transmission delay time.

[0070] TxDelay can be calculated by averaging the link delays of multiple messages. A specific GPIO pin of the MCU is toggled at the moment the message is sent and again at the moment the message is received by the receiver. The link delay time for this data transmission can be calculated by measuring the time difference between the two GPIO pins using an oscilloscope.

[0071] Here is an example to illustrate the phase adjustment process:

[0072] The controller's control cycle is set to 50ms, the clock signal frequency is 4kHz, and the link transmission delay is 50us. Controller B is assumed to be the master clock, and controller A to be the slave clock. Without phase adjustment, according to Formula 1, N ranges from [0, 199], meaning N increases from 0 to 199 and then restarts from 0. The phase value corresponding to 50us is 0.2, i.e., TxDelay is 0.2.

[0073] Scenario 1: At a certain moment, controller A receives a data message from controller B. By parsing the message data, the phase value of controller B is found to be 95. At this time, the phase value of controller A is read as 100, indicating that the phase of controller A is "leading" that of controller B. According to formula 2, we calculate: Adj = 100 - 95 - 0.2 = 4.8. According to formula 1, N for this cycle is 203.8. Since N is a positive integer, it is rounded to 204. That is, the upper limit of the phase of controller A in this cycle, N, was originally 199, but it has been expanded to 204. The cycle has been "stretched," and it takes longer for this cycle to enter the next cycle in order to "wait" for the master clock controller.

[0074] Scenario 2: At a certain moment, controller A receives a data message from controller B. By parsing the message data, the phase value of controller B is found to be 105. At this time, the phase value of controller A is read as 100. It can be seen that the phase of controller A is "lagging" behind that of controller B. According to formula 2, we calculate: Adj = 100 - 105 - 0.2 = -5.2. According to formula 1, N for this cycle is 193.8. Since N is a positive integer, it is rounded to 194. That is, the upper limit of the phase of controller A in this cycle, N, was originally 199, but it has been reduced to 193.8. The cycle has been "compressed". This cycle requires a shorter time to enter the next cycle in order to "catch up" with the master clock controller.

[0075] See appendix Figure 6 The controller is divided into multiple phase stages, specifically:

[0076] S300, input data acquisition;

[0077] S301, Input data synchronized voting;

[0078] S302, Configuration Logic Calculation;

[0079] S303, output data to synchronize voting;

[0080] S304, Output data refresh;

[0081] S305, controller self-diagnosis;

[0082] S306, idle;

[0083] The "lengthening" and "compression" of the controller's control cycle only adjusts the phase occupied by the idle phase and cannot affect the time of other phase phases; otherwise, it will affect the normal operation of the controller. Assuming that the idle phase phase value occupies Idle, the phase adjustment value Adj given in this invention is limited to the range of [-Idle, T*F / 2].

[0084] The voting process of the master clock controller is as follows:

[0085] Voting Step 1: Exclude controllers with communication anomalies or "empty" diagnostic data. If a controller is determined to have a communication anomaly or "empty" data by either its left or right controllers, that controller becomes a slave clock controller and will not participate in the voting in Step 2. Controllers with normal communication participate in the voting in Step 2.

[0086] Voting Step Two: Determine the voting method based on the number M of controllers with normal communication. This method is used to vote on whether the controller clock is normal. When M is 3, the voting follows the principle of 2 out of 3, i.e., the minority obeys the majority. When M is 2, the voting follows the principle of 1 out of 2, i.e., both results must be normal for it to be considered normal. When M is 1, the diagnostic result is used directly. If the clock voting result is "abnormal", then the controller is a slave clock controller. If the clock voting result is "normal", proceed to Step Three.

[0087] Voting Step 3: Determine the Master Clock Controller: If only one controller's clock signal is voted "normal", then that controller is the master clock controller; if two or more controllers' clock signals are voted "normal", then the master clock controller is determined based on the controller's position, with the priority being: controller A > controller B > controller C.

[0088] The following will provide examples illustrating the normal operation and single-point-of-failure scenarios of the triple-redundant control system described in this invention. A single-point-of-failure means that only one type of fault occurs in the system, and the project site will immediately conduct troubleshooting and repairs to eliminate the fault. Multiple fault scenarios are not within the scope of this invention. Faults or anomalies are marked as "Bad," normal operation as "Good," and empty data as "Empty."

[0089] Scenario 1: The three-redundant control system is completely normal. Tables 1 and 2 show the communication diagnostics and clock diagnostics data for the three controllers, respectively.

[0090] Table 1

[0091]

[0092] Table 2

[0093]

[0094] Voting Step 1: If no controller data is "empty", proceed to Step 2.

[0095] Voting Step Two: Communication between all three controllers is normal; proceed to Step Three.

[0096] Voting Step 3: The number of controllers with normal communication, M, is 3. The clock diagnosis results are voted on using the 3-out-of-2 method. If the result is that the clocks of all 3 controllers are normal, proceed to Step 4.

[0097] Voting Step 4: If all three controller clocks are functioning normally, controller A is determined to be the master clock controller based on position priority, and the remaining controllers are slave clock controllers.

[0098] Scenario 2: Ethernet connection between controller A and controller B is lost. Tables 3 and 4 show the communication and clock diagnostic data for the three controllers, respectively.

[0099] Table 3

[0100]

[0101] Table 4

[0102]

[0103] Voting Step 1: If no controller data is "empty", proceed to Step 2.

[0104] Voting Step Two: Since controllers A and N mutually determine that the other's communication is abnormal, only controller C is involved, proceeding to Step Three.

[0105] Voting Step 3: The number of controllers with normal communication, M, is 1. The clock diagnosis results are voted on using a 1-out-of-1 method, that is, only the clock diagnosis results of controller C to controller C are considered. If the result is Good, proceed to Step 4.

[0106] Voting Step 4: If only controller C is Good, then controller C is the master clock controller, and the other controllers are slave clock controllers.

[0107] Scenario 3: Controller A is removed, leaving only controllers B and C in the system. Tables 5 and 6 show the communication and clock diagnostic data for the three controllers, respectively.

[0108] Table 5

[0109]

[0110] Table 6

[0111]

[0112] Voting Step 1: Controller A's data is "empty" and it does not participate in the vote. Going forward, we only need to focus on the data of controllers B and C, and proceed to Step 2.

[0113] Voting Step Two: Communication between Controller B and Controller C is normal; proceed to Step Three.

[0114] Voting Step 3: The number of controllers with normal communication, M, is 2. The clock diagnosis results are voted on using a 2-out-of-1 method. If the result is that the clocks of both controllers are normal, proceed to Step 4.

[0115] Voting Step 4: If both controller clocks are functioning normally, controller B is determined to be the master clock controller according to the principle of position priority, and the remaining controllers are slave clock controllers.

[0116] Scenario 4: The clock signal of controller A is abnormal. Tables 7 and 8 show the communication diagnosis and clock diagnosis data for the three controllers, respectively.

[0117] Table 7

[0118]

[0119] Table 8

[0120]

[0121] Voting Step 1: If no controller data is "empty", proceed to Step 2.

[0122] Voting Step Two: All controllers communicate normally, proceed to Step Three.

[0123] Voting Step 3: The number of controllers with normal communication, M, is 3. The clock diagnostic results are voted on using the 3-out-of-2 method. Controller A is determined to be abnormal, while controllers B and C are normal. Proceed to Step 4.

[0124] Voting Step 4: If both controller clocks are functioning normally, controller B is determined to be the master clock controller according to the principle of position priority, and the remaining controllers are slave clock controllers.

[0125] This invention provides a triple-redundant control system for phase synchronization. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A phase synchronization system for a triple-redundant controller, characterized in that, The system includes three redundant controllers, each of which includes an MCU and an FPGA. The MCU includes a communication module, a phase counting module, and a voting synchronization module. The FPGA includes a clock output module and a clock diagnostic module. The phase refers to the operating cycle of the controller in each control cycle. The clock output module of the FPGA outputs a clock signal at a fixed frequency. The clock signal is connected to the phase counting module for updating the phase value. The clock signal is also connected to the clock diagnostic module of the controller's own FPGA and the clock diagnostic modules of two other controller FPGAs. The FPGA's clock diagnostic module simultaneously diagnoses the frequencies of the three clock signals to obtain the clock diagnostic data of the controller. The MCU's communication module is used to communicate with the other two controllers and obtain communication diagnostic data for this controller based on the communication status. The MCU's communication module sends the diagnostic data of this controller, the diagnostic data of the other two controllers, and the phase data of this controller to the other two controllers in each control cycle. The controller that receives the message data needs to send a response message within the timeout period. The diagnostic data includes clock diagnostic data and communication diagnostic data; The phase data includes the controller's control cycle and the controller's real-time phase value; The voting synchronization module of the MCU votes based on diagnostic data, determines the master clock controller, calculates the difference between the master clock phase value and the phase value of this controller, and calculates the phase adjustment value Adj, which is used to adjust the control cycle of this controller and perform phase synchronization. The three redundant controllers are denoted as controller A, controller B, and controller C, respectively. The left-right relationship between the controllers is defined as follows: A is to the left of C and A is to the right of B; B is to the left of A and B is to the right of C; C is to the left of B and C is to the right of A. The phase counting module is used to perform the following calculation: increment by 1 when the clock signal has a rising edge; the phase value varies within the range of [0, N], where N is the upper limit of the phase value; the calculation method is as follows: N = T * F / 1000 - 1 + Adj Where T is the control cycle set in the configuration engineering, F is the frequency value of the clock signal, and Adj is the phase adjustment value calculated in this case; When the phase value is 0, it represents the start time of a single control cycle of the controller; when the phase value is N, it represents the end time of a single control cycle of the controller; when the phase value changes from N to 0 and starts increasing again, it represents the start of a new control cycle of the controller. The control cycles of the three redundant controllers are all equal. The communication module of controller A uses two independent Ethernet paths to communicate point-to-point with the communication modules of the other two controllers respectively; the Ethernet packets of the controller's MCU are sent directly to the other controller through the Ethernet hardware link layer without going through the Ethernet protocol stack. The communication diagnostic data is updated at the end of the control cycle to indicate whether the communication between this controller A and the other two controllers is normal. If controller C sends a response message in a timely manner during the control cycle, and a diagnostic data message actively sent by controller C is received during the control cycle, then controller C's communication is considered normal; otherwise, communication is abnormal. If controller B sends a response message in a timely manner during the control cycle, and a diagnostic data message actively sent by controller B is received during the control cycle, then controller B's communication is considered normal; otherwise, communication is abnormal. If no data message is received from controller C or B during the control cycle, the diagnostic data of controller C or B stored in this controller A is reset to empty. The communication module of controller A sends data to controllers C and B, including not only the diagnostic data and phase data of controller A, but also the diagnostic data of controllers C and B. The formula for calculating the phase adjustment value Adj is: Adj = Cnt1 -Cnt0-TxDelay, Where Cnt0 is the count value received from the main clock controller from the clock controller, Cnt1 is the count value of this controller, and TxDelay is the link transmission delay time; When Adj is positive, it means that the phase of this controller is ahead of the phase of the master clock, and the upper limit of the phase N of this control cycle will increase Adj. When Adj is negative, it indicates that the phase of this controller lags behind the phase of the master clock, and the upper limit of the phase N in this cycle will decrease Adj. Adj only affects the upper limit value N of the phase in the current control cycle of the controller. When the phase value is reset to 0, Adj is also reset to 0. Each control cycle is divided into multiple phase stages, namely: input data acquisition, input data synchronous voting, configuration logic calculation, output data synchronous voting, output data refresh, controller self-diagnosis, and idle. The idle phase phase value is set to occupy Idle. Since the current control cycle of the controller is compressed when the phase adjustment value Adj is negative, the minimum value of Adj is -Idle, and the range of Adj is [-Idle, T * F / 2]. The voting synchronization module determines the master clock controller by voting based on diagnostic data, specifically including the following steps: Step 1: When a controller is determined to have a communication error or empty data by either the left or right controller, the controller becomes a slave clock controller and no longer participates in the voting; obtain the number M of controllers participating in the voting. Step 2: Determine the voting method based on the number M of controllers with normal communication. This method is used to vote on whether the controller clock is normal. When M is 3, vote according to the 3-out-of-2 rule; when M is 2, vote according to the 2-out-of-1 rule; when M is 1, directly use the diagnostic result. If the clock voting result is abnormal, the controller becomes a slave clock controller; if the clock voting result is normal, proceed to Step 3. Step 3, determine the master clock controller: If only one controller's clock signal is voted as normal, then that controller is the master clock controller; if two or more controllers' clock signals are voted as normal, then the master clock controller is determined based on the controller's position, with the priority being: controller A > controller B > controller C.

Images