Self-adaptive hard synchronization method and device for triple modular redundancy system

Abstract

The invention provides a self-adaptive hard synchronization method and device for a triple modular redundancy system, and the method comprises the steps: determining system parameters needing to be bound based on an obtained task requirement; starting synchronization signal generation, and taking a second arriving compliance signal as a system initialization synchronization reference; and the system is switched into a dynamic self-adaptive adjustment state, the input signal of the hard signal synchronization channel is monitored in real time, dynamic signal synchronization and single-mode fault isolation are completed, and dynamic real-time synchronization of the hard synchronization signal of the triple-modular redundancy system is realized. The method provided by the invention is based on a CPU + FPGA hardware architecture model, and can be realized by using in-mode resources of the triple modular redundancy system, the synchronous structure is simple to realize, a conventional inter-mode IO interface is used for synchronous communication, and the inter-mode communication resource demand is low. Under the self-adaptive synchronization algorithm planning, the synchronization system dynamically adjusts the synchronization reference, and the synchronization performance of the system is not affected by the online / offline of any model. Meanwhile, the algorithm planning ensures that the total weight value of each module is consistent, and the weight uniformity is good.

Description

Technical Field

[0001] The present invention relates to the field of modular redundancy technology, and in particular to an adaptive hard synchronization method and device for a triple modular redundancy system. Background Art

[0002] Modular redundancy design is a common design method to improve system reliability and is widely used in various types of high-reliability equipment / systems. Triple-module redundancy design belongs to hardware redundancy design but is not limited to hardware redundancy. It refers to the complete consistency of hardware and software between the three modules A, B, and C, and mutual redundancy. The core of triple-module redundancy design is to design three sets of completely identical modules and run completely identical programs on the three sets of modules to ensure that the module has the ability to resist the failure of any module. Similarly, the triple-module redundancy system is a type of system designed based on the triple-module redundancy design method. The redundant modules designed in this system generally assume the core control function of the system and assume the reliability index of the entire system task. Since control is involved, the redundant A, B, and C modules need to ensure the synchronous execution of control instructions. The existing control synchronization between the three modules is often carried out by adding a voting circuit, which increases the hardware complexity of the triple-module redundancy system design and is not conducive to improving the overall reliability of the system. Summary of the invention

[0003] The technical problem to be solved by the present invention is how to simplify the synchronization structure of a triple-module redundant system and reduce the communication resource requirements between modules; in view of this, the present invention provides an adaptive hard synchronization method and device for a triple-module redundant system.

[0004] The technical solution adopted by the present invention is an adaptive hard synchronization method for a triple-module redundant system, comprising:

[0005] Step S1, determining the system parameters to be bound based on the acquired task requirements;

[0006] Step S2, start the synchronization signal generation, and use the second arriving compliance signal as the system initialization synchronization reference;

[0007] In step S3, the system enters a dynamic adaptive adjustment state, monitors the input signal of the hard signal synchronization channel in real time, completes dynamic signal synchronization and single-mode fault isolation, and realizes dynamic real-time synchronization of the hard synchronization signal of the triple-mode redundant system.

[0008] In one embodiment, in step S1, the system parameters include: period, pulse width, tolerance parameters and control instructions.

[0009] In one embodiment, step S3 includes:

[0010] The three-mode hardware status is detected with the reference pulse as the detected source, and the faulty module is eliminated according to the hardware status to enter the synchronous state.

[0011] In one embodiment, the detecting the three-mode hardware state by using the reference pulse as the detected source, eliminating the fault module according to the hardware state, and entering the synchronization state comprises:

[0012] The three-mode status is mutually checked through the synchronization reference pulses between the three modes. If the duty cycle of the synchronization reference pulse meets the requirements, the current mode is considered normal.

[0013] The rising edge of the self-pulse is used as the counting start mark, and the rising edge of the measured pulse is used as the counting stop mark. If the count value is less than the half-cycle count value, the measured pulse is a lagging pulse relative to the self-pulse, and the larger the count value, the greater the lag; if the count value is greater than the half-cycle count value and less than the full-cycle count value, the measured pulse is an advanced pulse relative to the self-pulse, and the smaller the count value within this interval, the greater the advance; if the count value is equal to the full-cycle count value, the measured pulse is completely synchronized with the self-pulse;

[0014] When one of the three modes is damaged and then restored, the mode enters the initial detection and selects a reference from the synchronized two modes, and then enters the adaptive synchronization stage.

[0015] Another aspect of the present invention further provides an adaptive hard synchronization device for a triple-module redundant system, comprising:

[0016] A configuration unit configured to determine system parameters to be bound based on the acquired task requirements;

[0017] an initialization unit configured to start synchronization signal generation, using the second arriving compliance signal as a system initialization synchronization reference;

[0018] The adaptive adjustment unit is configured to switch the system into a dynamic adaptive adjustment state, monitor the input signal of the hard signal synchronization channel in real time, complete dynamic signal synchronization and single-mode fault isolation, and realize dynamic real-time synchronization of the hard synchronization signal of the three-mode redundant system.

[0019] Another aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the adaptive hard synchronization method for a triple-module redundant system as described in any one of the above items.

[0020] Another aspect of the present invention further provides a computer storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the adaptive hard synchronization method for a triple-module redundant system as described in any one of the above items are implemented.

[0021] Compared with the prior art, the present invention has at least the following advantages:

[0022] The adaptive synchronization signal implementation method provided by the present invention is based on the CPU+FPGA hardware architecture model, can be implemented using the intra-module resources of the triple-module redundant system, the synchronization structure is simple to implement, the synchronous communication uses the conventional inter-module IO interface, and the inter-module communication resource requirements are low. Under the adaptive synchronization algorithm planning, the synchronization system dynamically adjusts the synchronization benchmark, and any one module goes online / offline without affecting the system synchronization performance. At the same time, the algorithm planning ensures that the total value of each module weight is consistent and the weighting is good. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic flow chart of an adaptive hard synchronization method for a triple-module redundant system according to an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a hardware framework design according to an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of the principle of generating an adaptive hard synchronization signal according to an embodiment of the present invention;

[0026] Figure 4 A schematic diagram of a time flow for initial benchmark selection according to an embodiment of the present invention;

[0027] Figure 5 A schematic diagram of an adaptive synchronization software processing flow according to an embodiment of the present invention;

[0028] Figure 6 is a schematic diagram of the positional relationship between reference pulses according to an embodiment of the present invention;

[0029] Figure 7 It is a schematic diagram of the composition of an adaptive hard synchronization device for a triple-module redundant system according to an embodiment of the present invention;

[0030] Figure 8 FIG. 1 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose, the present invention is described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0032] Unless otherwise defined, all terms (including technical terms and scientific terms) used in this article have the same meaning as commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that terms (such as terms defined in commonly used dictionaries) should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and will not be interpreted in an idealized or overly formal sense unless explicitly defined in this article.

[0033] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0034] An embodiment of the present invention provides an adaptive hard synchronization method for a triple-module redundant system, such as Figure 1 As shown, including:

[0035] Step S1, determining the system parameters to be bound based on the acquired task requirements;

[0036] Step S2, start the synchronization signal generation, and use the second arriving compliance signal as the system initialization synchronization reference;

[0037] In step S3, the system enters a dynamic adaptive adjustment state, monitors the input signal of the hard signal synchronization channel in real time, completes dynamic signal synchronization and single-mode fault isolation, and realizes dynamic real-time synchronization of the hard synchronization signal of the triple-mode redundant system.

[0038] The present invention aims to enable the triple-mode redundant system to achieve hard signal synchronization between the three modes at a lower cost and higher reliability, reduce the adverse effects of complex design on the redundant modules that bear the core functions, and devote their main computing power to the core tasks of the system. Figure 2 shown.

[0039] In the system design, the core of the hardware framework is the three modes A, B, and C, and there is a direct signal path between the three modes. The signal path between each mode is composed of 2 groups of 3-way direct-pull lines, and single-point failures are eliminated according to the "three-out-of-two logic"; it can also be downgraded to use "or" logic to process 2-way direct-pull signal lines, and the uncertainty caused by the 2-way direct-pull signal lines can be eliminated by the signal path detection mechanism. In the three modes A, B, and C, the CPU is the instruction control core, and the FPGA is an attached follow-up execution component. The design core of the present invention is realized by utilizing the internal resources of the FPGA, and the program in the CPU is only responsible for dynamic parameter binding and final signal reception.

[0040] In the three-mode redundant system, A, B, and C are modules that are mutually redundant and backed up. To ensure the redundancy effect of the system, A, B, and C need to be interchangeable. The system does not fail due to the failure of any one of the modules. There cannot be a key module in the three modules, and the weight of each module in the system should be consistent. To ensure the consistency of the weight of each module, some special constraints need to be added to the reference pulse between modules at the level of three-mode synchronization design. When each module is synchronized, there is a situation where the reference pulses of the two modules cannot be distinguished. At this time, the selection of the "second pulse reference" actually depends on the order of judgment in the program logic. If the A module is judged first, the A module is the reference; if the B module is judged first, the B module is the reference. This reference selection logic has good synchronization performance, but it objectively affects the weight value of each module. The module judged first is obviously more "important" than the module that is not judged first. This selection method will cause inconsistent weights of each module among the three modules. If the reference pulse hardware wiring is carried out according to the table below, assume that each mode is set to receive 1 with a weight of X and receive 2 with a weight of Y. For modes A, B, and C, the weight of each mode is X+Y, and the weights are consistent, thus eliminating the difference in weights between modes.

[0041] Table 1 Reference pulse selection constraints

[0042]

[0043] In terms of software processing flow, the processing framework for adaptive synchronization signal implementation consists of three parts: reference parameter binding, initial reference selection, and dynamic adaptive adjustment. The schematic diagram is shown in the figure. Figure 3 shown.

[0044] First, the superior control system sends task benchmark parameters according to actual task requirements to bind basic parameters for the adaptive hard synchronization signal generation system, guiding the start of the synchronization signal generation task.

[0045] Afterwards, the adaptive synchronization signal generation system initialization process is started. During this initialization process, the system will continuously scan and monitor the compliance of the hard signal synchronization channel input signal, and select the second incoming compliant signal monitored as the system initialization synchronization reference under the requirements of the "second pulse reference" rule.

[0046] Finally, the system enters a dynamic adaptive adjustment state, monitors the input signal of the hard signal synchronization channel in real time, extracts signal features, actively completes dynamic signal synchronization and single-mode fault isolation, and ultimately achieves dynamic real-time synchronization of the hard synchronization signal of the three-mode redundant system.

[0047] The method provided in this embodiment will be described in detail step by step below.

[0048] Step S1, determining the system parameters to be bound based on the acquired task requirements.

[0049] The benchmark parameter binding adopts the dynamic parameter binding method, and the in-module CPU software plans the system parameters to be bound this time according to the task requirements of the upper-level control system. Specific parameters include: cycle, pulse width, tolerance parameters, and control instructions. Among them, the cycle parameter specifies the cycle value of the hard synchronization signal, which is consistent with the basic cycle of the control processing of the entire system. The pulse width parameter fixes the pulse width of the hard synchronization signal. This value is related to the interrupt configuration of the in-module CPU. The interrupt pulse width value recommended by the CPU interrupt interface should be selected in the design to reduce the probability of false discarding of the hard synchronization signal. The tolerance parameter is the initialization difference tolerance parameter. Although the three modules A, B, and C adopt completely consistent hardware and software designs, there must be physical differences between the hardware. There must be time differences in the initialization process of the three modules A, B, and C. Therefore, it is necessary to complete the initialization of one module first, so as to leave time to judge whether the status of the remaining modules is normal and whether they can be included in the synchronization system. The control instruction parameter is whether the CPU controls the adaptive hard synchronization signal to run. This setting is to ensure that the hard synchronization signal does not interfere with the initial operation of the CPU software during the CPU initialization process, reducing the risk of software initialization failure.

[0050] Step S2, start the synchronization signal generation, and use the second arriving compliance signal as the system initialization synchronization reference.

[0051] The initial reference selection uses the hardware status judgment method, which depends on the physical condition of each module hardware rather than the preset priority, and the module that sends the reference pulse second in sequence is used as the initial reference source generator. Although the three modules A, B, and C are completely consistent in hardware design, there are bound to be differences due to production and processing. Due to the physical differences, when running the same program, the three modules will start in different times.

[0052] The "second pulse" is used to ensure that at least 2 of the three modes are operating normally to achieve synchronous interruption, avoiding false status reporting; it can also ensure that the hardware constitution of the initial benchmark generator is not the weak link in the entire system. When using the CPU+FPGA platform architecture, the software in the FPGA is loaded to normal operation earlier than the program in the CPU is loaded to normal operation. Therefore, this feature can be used to set up a monitoring program in the FPGA. When the entire system is powered on, the detection program in the FPGA starts monitoring immediately. After the program in the CPU is started and the synchronization benchmark parameters are bound, the FPGA starts to send out a benchmark second pulse. According to the benchmark second pulse monitoring results of the monitoring program in the FPGA, the second monitored benchmark second pulse emission module in the three modes is selected as the initial benchmark source generator. The specific time flow diagram is as follows. Figure 4 .

[0053] In step S3, the system enters a dynamic adaptive adjustment state, monitors the input signal of the hard signal synchronization channel in real time, completes dynamic signal synchronization and single-mode fault isolation, and realizes dynamic real-time synchronization of the hard synchronization signal of the triple-mode redundant system.

[0054] Dynamic adaptive adjustment is designed to adapt to the fault shielding and self-elimination design of the triple-mode redundant system. The core is to adjust the reference source in real time under the premise of ensuring synchronization stability to adapt to sudden software and hardware failures or software and hardware failure recovery, and improve the robustness of the inter-mode synchronization function. Since the bottom line of the triple-mode redundant system is the normal operation of the second mode, it is still necessary to select the reference according to the "second pulse" at this stage to reduce the risk of the third mode being disabled.

[0055] When the system completes the initial reference selection, each module successfully enters the synchronization state or the other two modules complete the timeout waiting after one module fails, then the whole system enters the dynamic adaptive adjustment state. In this state, the monitoring program implemented in the FPGA continues to work to monitor the reference pulse state of each module. At this time, since the reference pulses of each module are already in the synchronization state, the phase difference is small, but at the same time, since there is always a possibility of one module being disabled or restored after being disabled, the dynamic reference measurement must comply with the adaptive synchronization algorithm to successfully identify the "second pulse".

[0056] The adaptive synchronization algorithm first uses the reference pulse as the detected source to detect the hardware status of the three modes, eliminates the faulty module according to the hardware status, and then enters the synchronization state. The specific process is as follows: Figure 5 shown.

[0057] The state mutual check is determined by the synchronous reference pulses between the three modes. If the duty cycle of the synchronous reference pulse meets the requirements, the mode change is considered normal. Other mutual check quantities issued by the CPU software can also be used as judgment conditions, which is highly flexible. Then enter the "second pulse reference" selection process. If the three modes are fault-free, the three-way reference pulses are generated using the local crystal oscillator clock, and the accuracy of the crystal oscillator is relatively low, so there is a synchronization error. The position relationship between the three-way reference pulses is shown as follows Figure 6 .

[0058] The monitoring program is located in the FPGA of each module, so the monitoring is based on its own perspective. Taking its own reference pulse as the reference point, it is divided into three situations: lagging, leading, and synchronous. Since the reference pulse is a periodic signal, when counting according to the counting rules in the module, the count value of the leading pulse will always be greater than the half-cycle count value, and the count value of the lagging pulse will be less than the half-cycle count value. Therefore, the order of the three modules can be determined by comparing the counting result with the half-cycle count value. Since the reference selection has been synchronized at least once at this time, the lead and lag are small.

[0059] The rising edge of its own pulse is used as the start mark of counting, and the rising edge of the measured pulse is used as the stop mark of counting. If the count value is less than the half-cycle count value, the measured pulse is a lagging pulse relative to its own pulse, and the larger the count value, the greater the lag; if the count value is greater than the half-cycle count value and less than the full-cycle count value, the measured pulse is an advanced pulse relative to its own pulse, and the smaller the count value in this interval, the greater the advance; if the count value is equal to the full-cycle count value, the measured pulse is completely synchronized with its own pulse. When one of the three modes is damaged and then restored, the mode will inevitably select the benchmark from the two synchronized modes when it enters the first detection, and then enters the adaptive synchronization stage. At this time, the conditions are consistent with no fault, and the overall synchronization state of the system is not affected.

[0060] Compared with the prior art, this embodiment has at least the following effects:

[0061] 1) The embodiment of the present invention implements "two out of three" processing based on the internal resources of the logic device. The three modes of the logic processing circuit are mutually redundant and no external voting circuit is introduced, which has low implementation difficulty and cost;

[0062] 2) The embodiment of the present invention can realize adaptive dynamic reference adjustment, and can quickly remove the fault from the system when a fault occurs, and can quickly add the synchronization system when the fault is restored, without affecting the synchronization accuracy of the system control;

[0063] 3) In the embodiment of the present invention, the three modes are weighted equally, and no artificial weight setting is introduced.

[0064] The second embodiment of the present invention corresponds to the first embodiment. This embodiment introduces an adaptive hard synchronization device for a triple-module redundant system, such as Figure 7 As shown, it includes the following components:

[0065] A configuration unit configured to determine system parameters to be bound based on the acquired task requirements;

[0066] an initialization unit configured to start synchronization signal generation, using the second arriving compliance signal as a system initialization synchronization reference;

[0067] The adaptive adjustment unit is configured to switch the system into a dynamic adaptive adjustment state, monitor the input signal of the hard signal synchronization channel in real time, complete dynamic signal synchronization and single-mode fault isolation, and realize dynamic real-time synchronization of the hard synchronization signal of the three-mode redundant system.

[0068] A third embodiment of the present invention is an electronic device, such as Figure 8 As shown, it can be understood as a physical device, including a processor and a memory storing instructions executable by the processor. When the instructions are executed by the processor, the following operations are performed:

[0069] Step S1, determining the system parameters to be bound based on the acquired task requirements;

[0070] Step S2, start the synchronization signal generation, and use the second arriving compliance signal as the system initialization synchronization reference;

[0071] In step S3, the system enters a dynamic adaptive adjustment state, monitors the input signal of the hard signal synchronization channel in real time, completes dynamic signal synchronization and single-mode fault isolation, and realizes dynamic real-time synchronization of the hard synchronization signal of the triple-mode redundant system.

[0072] The fourth embodiment of the present invention, the process of the adaptive hard synchronization method for a triple-module redundant system in this embodiment is the same as that of the first, second or third embodiment, except that, in terms of engineering implementation, this embodiment can be implemented by means of software plus a necessary general hardware platform, or of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the method of the present invention can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, an optical disk), and includes a number of instructions for enabling a device to execute the method described in the embodiment of the present invention.

[0073] Through the description of the specific implementation methods, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the predetermined purpose should be obtained. However, the accompanying drawings are only for reference and illustration purposes and are not intended to limit the present invention.

Claims

1. An adaptive hard synchronization method for a triple-module redundant system, characterized in that: include: Step S1, determining the system parameters to be bound based on the acquired task requirements; Step S2, start the synchronization signal generation, and use the second arriving compliance signal as the system initialization synchronization reference; In step S3, the system enters a dynamic adaptive adjustment state, monitors the input signal of the hard signal synchronization channel in real time, completes dynamic signal synchronization and single-mode fault isolation, and realizes dynamic real-time synchronization of the hard synchronization signal of the triple-mode redundant system.

2. The adaptive hard synchronization method for triple-module redundancy system according to claim 1, characterized in that: In step S1, the system parameters include: period, pulse width, tolerance parameters and control instructions.

3. The adaptive hard synchronization method for triple-module redundancy system according to claim 1, characterized in that: The step S3 comprises: The three-mode hardware status is detected with the reference pulse as the detected source, and the faulty module is eliminated according to the hardware status to enter the synchronous state.

4. The adaptive hard synchronization method for triple-module redundancy system according to claim 3, characterized in that: The detecting of the three-mode hardware state by using the reference pulse as the detected source, eliminating the fault module according to the hardware state, and entering the synchronization state comprises: The three-mode status is mutually checked through the synchronization reference pulses between the three modes. If the duty cycle of the synchronization reference pulse meets the requirements, the current mode is considered normal. The rising edge of the self-pulse is used as the counting start mark, and the rising edge of the measured pulse is used as the counting stop mark. If the count value is less than the half-cycle count value, the measured pulse is a lagging pulse relative to the self-pulse, and the larger the count value, the greater the lag; if the count value is greater than the half-cycle count value and less than the full-cycle count value, the measured pulse is an advanced pulse relative to the self-pulse, and the smaller the count value within this interval, the greater the advance; if the count value is equal to the full-cycle count value, the measured pulse is completely synchronized with the self-pulse; When one of the three modes is damaged and then restored, the mode enters the initial detection and selects a reference from the synchronized two modes, and then enters the adaptive synchronization stage.

5. An adaptive hard synchronization device for a triple-module redundant system, characterized in that: include: A configuration unit configured to determine system parameters to be bound based on the acquired task requirements; an initialization unit configured to start synchronization signal generation, using the second arriving compliance signal as a system initialization synchronization reference; The adaptive adjustment unit is configured to switch the system into a dynamic adaptive adjustment state, monitor the input signal of the hard signal synchronization channel in real time, complete dynamic signal synchronization and single-mode fault isolation, and realize dynamic real-time synchronization of the hard synchronization signal of the three-mode redundant system.

6. An electronic device, characterized in that: The electronic device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the adaptive hard synchronization method for a triple-module redundant system as claimed in any one of claims 1 to 4.

7. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the adaptive hard synchronization method for a triple modular redundancy system as claimed in any one of claims 1 to 4.

Images