Dual-computer hot standby system and dual-computer switching method

Abstract

The invention belongs to the technical field of dual-computer hot standby, and discloses a dual-computer hot standby system and a dual-computer switching method. The dual-machine hot standby system comprises a machine A and a machine B which are hot standby for each other, and an internal switch; one of the A machine and the B machine is a host used for performing data communication with an external system, and the other one is a slave used for backing up data of the host; the machine A and the machine B are connected with an external system through respective external communication interfaces; and the machine A and the machine B are connected with respective reflective memory cards through optical fibers to serve as main synchronization channels, and are connected with an internal switch through the Ethernet to serve as a standby synchronization channel through respective internal communication network ports, so that data synchronization and backup between the machine A and the machine B are realized. The invention further provides a corresponding switching method. According to the invention, the reliability and stability of long-time uninterrupted operation of the dual-computer hot standby system can be improved, the switching recovery time is shortened, and the requirements of different network environments and application scenes can be met.

Description

Technical Field

[0001] The present invention belongs to the technical field of dual-machine hot standby, and more specifically, relates to a dual-machine hot standby system and a dual-machine switching method. Background Art

[0002] In order to ensure that the control system in the industrial environment can run stably and continuously for a long time, a dual-machine redundant structure is usually adopted. Based on data synchronization and load balancing mechanism, when the host fails, the backup device can continue to perform tasks, thereby improving the reliability of the system.

[0003] Currently, the best dual-machine hot standby method in the industrial control field is to share storage media between the two machines. Although it can improve the real-time performance of system backup, once the shared storage medium fails, the data of the entire system will be lost, and the two devices will seize control of the storage service, which is not conducive to the reliability and stability of the system's long-term uninterrupted operation.

[0004] In addition, the recovery time of the entire system communication link must also be guaranteed after the dual-machine hot standby system performs a dual-machine switching operation, so as to avoid long-term communication interruption between the industrial computer and the entire system, thereby causing irreparable damage. However, the switching recovery time of the existing dual-machine hot standby system cannot meet the control requirements of the strong real-time system. In the existing solution, the external communication channel of the dual-machine hot standby system will be switched through the switching card, but the switching card is prone to cause single point failure of the system, and the network will be re-initialized after the switching occurs. The switching recovery time is long, and it may cause abnormal external network communication of the switched system. Summary of the invention

[0005] In view of the above defects or improvement needs of the prior art, the present invention provides a dual-machine hot standby system and a dual-machine switching method, which aims to improve the reliability and stability of the dual-machine hot standby system for long-term uninterrupted operation.

[0006] To achieve the above object, according to a first aspect of the present invention, a dual-machine hot standby system is provided, comprising: a machine A and a machine B serving as hot standby for each other, an internal switch and a switching module;

[0007] One of the A and B machines is a host machine, used for data communication with an external system, and the other is a slave machine, used for backing up the data of the host machine; both A and B machines are connected to the external system through their respective external communication interfaces;

[0008] Machine A and machine B use optical fiber to connect their respective reflective memory cards as the main synchronization channel, and use Ethernet to connect the internal switch through their respective internal communication network ports as a backup synchronization channel to achieve data synchronization and backup between machine A and machine B;

[0009] The switching module is used to switch the main synchronization channel and the backup synchronization channel when the fault switching condition is met or under external switching control instructions, and / or switch the master-slave status of machine A and machine B to achieve dual-machine hot standby.

[0010] Furthermore, each round of data synchronization and backup is performed between machine A and machine B using the main synchronization channel, including:

[0011] Determine whether the current computer is a host or a slave; where the current computer is machine A or machine B;

[0012] If it is a host, execute:

[0013] The host allocates a memory area in the memory as an intermediate data buffer area, writes the state variable information that needs to be synchronized into the intermediate data buffer area, and waits for the data write semaphore; when the data write semaphore is valid, the data in the intermediate data buffer area is packaged and CRC check is performed, and the checked data is written into the reflective memory card of the host;

[0014] If it is a slave, execute:

[0015] The slave reads the state variable information that needs to be synchronized from the reflective memory card of the host, performs CRC check, stores the checked data in the intermediate data buffer area of ​​the slave, and waits for the data write semaphore; when the data write semaphore is valid, writes the data in the intermediate data buffer area of ​​the slave into the reflective memory card of the slave; wherein the intermediate data buffer area of ​​the slave is a memory area allocated in the slave memory.

[0016] Furthermore, before determining whether the current computer is a host or a slave, the following steps are also included:

[0017] Writing the state variable information that needs to be synchronized in the application into a configuration file; storing the configuration file in the storage medium of the host; the host updates the configuration file to the storage medium of the slave;

[0018] The slave reads the state variable information that needs to be synchronized from the host's reflective memory card, including:

[0019] The slave obtains the address of the state variable information to be synchronized from the configuration file; based on the address, the slave reads the state variable information to be synchronized from the reflective memory card of the host.

[0020] Furthermore, the failover condition includes:

[0021] When the slave detects that the host has an abnormality, when the external communication channel fails, and / or when the internal communication channel fails; wherein, the external communication channel is the channel for machine A or machine B to communicate with the external system, and the internal communication channel is the main synchronization channel or the backup synchronization channel.

[0022] Further, determining that the internal communication channel fails includes:

[0023] Counting the number of timeouts of the received heartbeat messages, if the number of timeouts exceeds a preset threshold, it is considered that the main synchronization channel has a fault;

[0024] The number of timeouts of the received network information is counted, and if the number of timeouts exceeds a preset threshold, it is considered that the main backup channel has a fault.

[0025] Furthermore, the health status and operating status of the host and the slave are monitored to determine whether the failover condition is met.

[0026] According to a second aspect of the present invention, there is provided a switching method of a dual-machine hot standby system as described in any one of the first aspects, comprising:

[0027] Configure the network cards for external communication of the host and slave to work in the same network segment and initialize them to the same IP address; and set the network cards for external communication of the host and slave to be closed;

[0028] Then set the host's external communication network card to enabled state;

[0029] When a fault switching condition is met or under an external switching control instruction, the main synchronization channel and the backup synchronization channel are switched, and / or the master-slave status of machine A and machine B is switched;

[0030] The switching of the master-slave status of machine A and machine B includes:

[0031] Set the host's external communication network card to closed state, and update the host's running state to slave;

[0032] Set the slave's external communication network card to enabled state, and update the slave's operating state to master.

[0033] According to a third aspect of the present invention, there is provided an industrial control computer, comprising a computer-readable storage medium and a processor;

[0034] The computer-readable storage medium is used to store executable instructions;

[0035] The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the switching method of the dual-machine hot standby system described in the second aspect.

[0036] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the switching method of the dual-machine hot standby system as described in the second aspect is implemented.

[0037] According to a fifth aspect of the present invention, a computer program product is provided. When the computer program product is run on a computer, the computer executes the switching method of the dual-machine hot standby system described in the second aspect.

[0038] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0039] (1) The dual-machine hot standby system of the present invention is directly connected to the external system through the external communication interfaces corresponding to each of the A and B machines in external communication; in terms of internal data synchronization and backup, a high-speed optical fiber is used to connect the reflective memory cards of the A and B machines as the main synchronous communication channels between the two devices, and Ethernet is used to connect the internal switch as the backup synchronous channel. At different times, the master-slave status of the A and B machines is switched by the switching module when the fault switching conditions are met or under the external switching control command to ensure that only the host communicates with the external system at the same time, and the two dedicated internal synchronous communication channels are switched. In this way, the dual-machine hot standby system of the present invention not only realizes redundant communication with the external system, but also adopts dual-channel synchronous redundancy inside the dual-machine hot standby system to ensure the reliability and stability of the connection and data interaction functions of the dual machines.

[0040] (2) In the design of the internal synchronous communication channel of the present invention, first, considering that using different communication channels for communication can reduce the impact of the same fault on the entire system, fault isolation can be achieved. If the same channel is used, the problem of switching of both channels may occur under a fault, which may easily cause repeated switching or failures that cannot be avoided after switching. Second, reflective memory cards usually have the characteristics of low latency and high bandwidth, which are suitable for data transmission with high real-time requirements. Ethernet, on the other hand, has flexibility and wide compatibility, and is suitable for general data communication. By combining the two channels, the performance of the system can be optimized to meet the needs of different types of data transmission. Third, in harsh industrial environments, factors such as electromagnetic interference and temperature changes may affect communication. The different physical and electrical characteristics of reflective memory and Ethernet make them have different sensitivities to environmental interference, thereby increasing the anti-interference ability of the system. Fourth, reflective memory cards have superior performance, and Ethernet equipment has lower cost and is easy to maintain. By using them together, costs can be controlled while ensuring performance. Therefore, based on the above considerations, the present invention designs two different types of synchronous communication channels. In addition, due to the physical isolation of the reflective memory card and Ethernet, independent communication protocols and independent hardware support, a failure in one channel will not affect the data communication of another channel, thus further ensuring the reliability and stability of communication.

[0041] (3) As a preferred method, when the main synchronization channel is used between machine A and machine B for each round of data synchronization and backup, the concept of an intermediate data buffer is introduced in the synchronization task. Only when the data write semaphore is valid, the global variables that need to be synchronized are written to avoid network communication failures caused by read-write conflicts of global data. In addition, during the synchronization task, the user can stop synchronization at any time by controlling the write semaphore, which provides the system with higher operational flexibility and security. In this way, the dual-machine hot standby system can not only maintain a high degree of data consistency and real-time updates under normal circumstances, but also respond quickly to user operation requirements under special circumstances, suspend or resume data synchronization, thereby protecting the stability of the system and the security of data.

[0042] (4) Preferably, the user can specify which data needs to be synchronized simply by configuring the configuration files stored in the host and slave storage media. In this way, the user can very conveniently select key data for synchronization according to specific application requirements, thereby reducing unnecessary consumption of communication resources; and the data in the programs written by the user can be backed up, thereby increasing the flexibility and customization of the system.

[0043] (5) Furthermore, in the dual-machine hot standby system switching method of the present invention, both the host and the slave are physically connected to the external system through an external switch, but the network card for external communication in the host is set to be in an enabled state, while the network card for external communication in the slave remains in a closed state, ensuring that only the host establishes an actual communication connection with the external system at the same time, thereby avoiding network conflicts and consumption of communication resources. At the same time, since both the host and the slave are physically connected to the external system, and the network cards for external communication of the two devices before and after the switching are configured to work in the same network segment and use the same IP address, when switching is required, the operating state can be directly switched to the current state rather than the initial operating state of the system. That is, after the switching, the new host does not need to re-establish a network connection with the external system and can communicate with the external system seamlessly, which greatly reduces the network switching time and realizes the senseless switching of the master and slave machines. At the same time, it also solves the problem that the switching card easily causes a single point failure of the system.

[0044] In summary, the present invention improves the hardware structure of the dual-machine hot standby system, avoids the interruption of control tasks caused by single point failure, and ensures the high reliability and stability of the system during the switching process. In addition, a new network switching method is proposed, which can shorten the recovery time of the dual-machine hot standby system after the master and slave switching operation as much as possible, meeting the requirements of a strong real-time control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The figure is a schematic diagram of the hardware connection relationship of the dual-machine hot standby system in an embodiment of the present invention.

[0046] Figure 2 The figure is a schematic diagram of the soft module structure of the dual-machine hot standby system in an embodiment of the present invention.

[0047] Figure 3 The figure is a flowchart of different working stages of the dual-machine hot standby system in an embodiment of the present invention.

[0048] Figure 4 The figure is a schematic diagram of the operation flow of the dual-machine hot standby system entering the data synchronization task after power-on in an embodiment of the present invention.

[0049] Figure 5 Schematic diagram of the program flow of the data synchronization task in an embodiment of the present invention.

[0050] Figure 6 The figure is a flowchart of the master-slave state switching of the dual-machine hot standby system in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0052] In the present invention, the terms "first", "second", etc. in the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0053] like Figure 1 As shown, an embodiment of the present invention provides a dual-machine hot standby system, which mainly includes: machine A, machine B and an internal switch that serve as hot standby for each other; wherein machine A and machine B are computer devices with exactly the same structure and configuration; one of machine A and machine B is a host, used to maintain data communication with an external system, and the other of machine A and machine B is a slave, used to perform redundant backup of the host's data.

[0054] Both A and B have complete and independent I / O resources. Both A and B are connected to external systems through their own external serial communication interfaces. Both A and B are connected to external switches through their own external network interfaces, so that both A and B can be connected to external systems through external communication interfaces in hardware. In terms of software, external ports are shielded to ensure that only the host computer communicates with the external system at the same time.

[0055] Both A and B are equipped with a high-performance reflective memory card, and high-speed optical fiber is used to connect the reflective memory cards of A and B as the main synchronous communication channel between the two devices; and both A and B are equipped with a Gigabit network port for internal communication. Through the Gigabit network port for internal communication, Ethernet is used to connect the internal switch as a backup synchronous communication channel between the two devices; dual-channel synchronous redundancy ensures the reliability of the connection and data interaction functions of the two machines. In addition, A and B are connected to the same internal switch through their respective internal communication network ports for Ethernet communication. Since the switch is always in an active state, A or B can establish a connection with the switch when their respective systems are started, without waiting for the other device to respond after starting, ensuring the stability of the network interaction between A and B.

[0056] By monitoring the health status and operating status of machine A and machine B (to determine whether the fault switching conditions are met), or arbitrating the main synchronization channel and the backup synchronization channel under external switching control instructions, the internal communication channel can be selected and switched, and the master-slave status of machine A and machine B can be switched to ensure that only the host communicates with the external system at the same time.

[0057] The dual-machine hot standby system of the present invention is directly connected to the external system through the external communication interfaces corresponding to the A and B machines respectively; in terms of synchronization and backup of internal data, high-speed optical fiber is used to connect the reflective memory cards of the A and B machines respectively as the main synchronous communication channels between the two devices, and Ethernet is used to connect the internal switch as the backup synchronous channel. At different times, according to the health status and operating status of the A and B machines, the master-slave status of the A and B machines is selected to ensure that only the host communicates with the external system at the same time, and two dedicated internal synchronous communication channels are selected to realize the internal data interaction between the A and B machines. In this way, the dual-machine hot standby system of the present invention not only realizes redundant communication with the external system, but also adopts dual-channel synchronous redundancy inside the dual-machine hot standby system, ensuring the reliability and stability of the connection and data interaction functions of the dual machines.

[0058] In the design of the internal synchronous communication channel of the present invention, first, considering that using different communication channels for communication can reduce the impact of the same fault on the entire system, fault isolation can be achieved. If the same channel is used, the problem of switching of both channels under a fault may occur, which may easily cause repeated switching or failure problems that cannot be avoided after switching. Second, the reflective memory card usually has the characteristics of low latency and high bandwidth, which is suitable for data transmission with high real-time requirements. Ethernet has flexibility and wide compatibility, which is suitable for general data communication. By combining the two channels, the performance of the system can be optimized to meet the needs of different types of data transmission. Third, in harsh industrial environments, factors such as electromagnetic interference and temperature changes may affect communication. The different physical and electrical characteristics of reflective memory and Ethernet make them have different sensitivities to environmental interference, thereby increasing the anti-interference ability of the system. Fourth, the reflective memory card has superior performance, and the Ethernet device has lower cost and is easy to maintain. By using it in combination, the cost can be controlled while ensuring performance. Therefore, based on the above considerations, the present invention designs two different types of synchronous communication channels. In addition, due to the physical isolation of the reflective memory card and Ethernet, independent communication protocols and independent hardware support, when one channel fails, it will not affect the data communication of another channel, thus further ensuring the reliability and stability of communication.

[0059] Specifically, reflective memory cards and Ethernet are two different physical communication media. Reflective memory cards usually use dedicated hardware interfaces, while Ethernet uses network interface cards (NICs) and network cables. This physical isolation means that a physical failure of one channel (such as cable breakage, interface damage) will not affect the other channel, and physical isolation can be achieved. Reflective memory cards and Ethernet use different communication protocols. Reflective memory cards usually use dedicated high-speed data transmission protocols, while Ethernet uses standard network protocols (such as TCP / IP). Protocol independence means that protocol failures of one channel (such as packet loss, protocol conflicts) will not affect the other channel. Reflective memory cards and Ethernet devices are usually supported by independent hardware. Even if the hardware of one channel fails, the other channel can still work normally. In this way, when one channel fails, it will not affect the data communication of another channel.

[0060] Machine A and machine B realize the above synchronization, communication, monitoring and switching through corresponding soft modules. Figure 2 As shown, in the embodiment of the present invention, the software structures of machine A and machine B are exactly the same, both including but not limited to four functional modules, namely, synchronization module, communication module, monitoring module, and switching module.

[0061] The synchronization module is used to use the reflective memory cards of the two machines connected by optical fiber as the main synchronization channel, and use the Ethernet connection switch as the backup synchronization channel to achieve data synchronization and backup between machine A and machine B. Specifically, it includes: 1) Dual synchronization channel collaboration: In the dual-machine hot standby system, two dedicated communication channels are established between machine A and machine B. The main synchronization channel uses the reflective memory cards of machine A and machine B to connect to the high-speed optical fiber for communication. This technology can achieve high-speed data exchange and low-latency communication, greatly improving the system response speed and data processing capabilities. The backup synchronization channel uses the Ethernet ports of machine A and machine B to connect to the switch for communication, ensuring that when the main channel fails, the system can also use the backup channel for data synchronization tasks. 2) Master-slave task synchronization mechanism: Under the control of the corresponding synchronization module, the tasks of the host and the slave can achieve precise synchronous operation. The tasks in the host use a high-precision onboard clock to drive the running program to ensure the timing accuracy of task execution. The tasks in the slave perform synchronous operation according to the clock signal sent by the host to the slave. This design effectively ensures that the master and slave can maintain consistency of operation at any time. 3) Global state quantity backup and recovery: The synchronization module is responsible for the backup of global state quantities. Therefore, after any device fails and restarts, the synchronization module can quickly obtain the state variable information that the system currently needs to synchronize from another device, and switch the operating state to the current state of the system instead of the initial operating state. This fast state recovery function significantly shortens the system's switching recovery time and the overall stability of the system. In addition, users can also set the global state variables that need to be synchronized, which increases the flexibility and customization of the system. Through this function, users can select key global state variables for synchronization according to the needs of specific application scenarios, reducing unnecessary consumption of communication resources. 4) Master-slave data cross transmission: At the same time, only the host of the system can communicate with the external system, but the data between the two devices is cross-transmitted. This design ensures that the host and the slave can receive and process the same input at any time, achieving a high degree of data consistency and synchronization of task execution between the master and the slave, avoiding calculation errors caused by data inconsistency, and the inability of the system's tasks to be performed continuously after the switching operation.

[0062] The communication module includes the communication between machine A and machine B in the dual-machine hot standby system, and the communication between the dual-machine hot standby system and external subsystems. The module provides the communication channel within the dual-machine hot standby system, the communication channel between the dual-machine hot standby system and external devices, and the channel for remotely updating the dual-machine hot standby system program. Specifically, it includes: 1) External communication interface configuration. The communication module is equipped with a variety of external communication interfaces, including high-speed Ethernet interface and serial interface, to achieve flexible and stable data exchange with external devices or networks. The Ethernet channel is used to transmit large amounts of data, while the serial channel is used to transmit control signals or small batches of data. 2) Internal synchronous communication mechanism: The module provides a communication channel between machine A and machine B in the dual-machine hot standby system, including a reflective memory channel and an Ethernet channel. The high-speed reflective memory channel provides extremely low data transmission latency and is the main communication channel, while the Ethernet channel provides the system with higher communication flexibility and reliability and is used as an auxiliary communication path. 3) System remote update channel: The communication module supports remote updates of the software of the dual-machine hot standby system, allowing remote deployment of new software versions or updates of system configurations through a dedicated program update channel without physical contact with the hardware. This function improves the system's maintenance efficiency and reduces maintenance costs. For example, you can use FTP to update the .out file inside the dual-machine hot standby industrial computer through the dual-machine hot standby system's external Ethernet communication channel. The industrial computer of the dual-machine hot standby system transfers files through its external Ethernet interface and the connection with the FTP server; after the transfer is completed, the system will perform data integrity verification to ensure that the file has not been damaged or tampered with during the transmission process; the system will automatically execute the update program to replace the old version of the .out file. This process may involve restarting the system or reloading the service to ensure that the new program file can be executed correctly; after the update is completed, the system will feedback the update status through the same Ethernet communication channel.

[0063] The monitoring module monitors the health status and operating status of the machine, reports the results to the remote monitoring terminal, and can receive commands from the remote monitoring terminal for the dual-machine hot standby system. Specifically, it includes: 1) System status monitoring function: The monitoring module tracks and analyzes the health status and operating status of the machine in real time, including but not limited to the master and slave identities of the machine under the current conditions, the communication status and communication quality of the communication channels between the master and slave (including the main channel and the backup channel), etc.; ensures real-time monitoring of the system operation status, timely discovers and handles potential problems, and maintains stable operation of the system. 2) Remote command response mechanism: The monitoring module also has the ability to receive and execute commands issued by the remote monitoring system, including but not limited to the switching operation of the master and slave. This mechanism allows remote administrators to quickly adjust system configurations or restore system functions when necessary, enhancing the flexibility and response speed of the system.

[0064] The switching module determines the status of the machine based on the health status and operation status information provided by the monitoring module, so as to arbitrate (switch) the synchronous communication channel between machine A and machine B in the dual-machine hot standby system to ensure the continuity and reliability of data transmission. When a channel failure or performance degradation occurs, the switching module can quickly evaluate and switch to the backup channel to ensure that data synchronization and system operation are not affected. The switching module is also used to arbitrate (switch) the master-slave status of machine A and machine B. When it is detected that a dual-machine switch is required, the module can automatically start the master-slave switching mechanism, promote the slave to the new master, and downgrade the original master to a slave. And when the host switches, the switching module ensures that the external communication channel can be seamlessly transferred to the new host, maintaining uninterrupted communication with the external system; including rapid adjustment of network configuration and communication protocols to ensure that the new host can take over all external communication tasks. Arbitrate the switching control mode of the communication channel between the host and the external system.

[0065] like Figure 3 The figure is a schematic diagram of the process of different working stages of the dual-machine hot standby system in the embodiment of the present invention, including the initial stage, the synchronization stage, the normal working stage and the switching stage. The specific process includes:

[0066] After power-on, it enters the initial stage. Machines A and B run the same program, including the dual-machine framework program and the user application. First, the dual-machine framework program is initialized, and then the user application is loaded. The master-slave identity and the state variables of the local machine are initialized. Device A is initialized and set as the host, and device B is initialized and set as the slave; and a connection is established with each other through heartbeat communication messages. The host periodically sends heartbeat signals to the slave and receives heartbeat signals from the slave, while the slave periodically receives the heartbeat signals from the host and sends heartbeat signals to the host. Heartbeat communication connections are established between the reflective memory channel and the Ethernet channel to determine the communication quality of the internal dual channels, so as to switch to the backup communication channel when the main channel communication fails. Start the master-slave data synchronization task and enter the synchronization stage. Figure 4 As shown, Figure 4 The diagram is a schematic diagram of the operation flow of the data synchronization task after the dual-machine hot standby system is powered on, showing the operation flow of the data synchronization task started from the initial stage to the synchronization stage after the dual-machine hot standby system is powered on.

[0067] After the heartbeat connection is established, the dual-machine hot standby system enters the synchronization stage, the synchronization module starts working, the host communicates with the external system continuously, updates the data obtained from the external system in real time, and the data of the host and the slave are cross-transmitted and synchronously executed. The host processes the program tasks according to the onboard clock and sends the clock signal to the slave for clock synchronization. The slave processes the program tasks according to the clock signal of the host and the data transmitted by the host. In this way, the master and slave can effectively maintain the consistency of operation at any time.

[0068] Preferably, users can simply specify which data needs to be synchronized by configuring the paramSave.xml file. In this way, users can easily select key data for synchronization according to specific application requirements, reducing unnecessary consumption of communication resources; and can back up data in user-written programs, increasing the flexibility and customization of the system. This custom synchronization mechanism is particularly important for dealing with complex industrial control systems because it allows operators to optimize system performance for specific operating or environmental conditions.

[0069] As a preference, Figure 5 As shown, reflective memory is used internally for data synchronization tasks, and the synchronization module includes the following steps:

[0070] S1. Write the data to be backed up (state variable information to be synchronized) in the application (program tasks to be executed) into a configuration file. In the embodiment of the present invention, the configuration file is a paramSave.xml file; and transmit the paramSave.xml file to the host through the remote transmission function of the synchronization module of the host. As shown in Table 1 below, the meaning of each field in the paramSave.xml file in the embodiment of the present invention is shown.

[0071] Table 1 Meaning of each field in paramSave.xml file

[0072]

[0073] S2. Update the paramSave.xml file to the slave through the synchronization function of the host; the host and the slave read the paramSave.xml file, obtain the state variable information to be synchronized (including the name, address, type and length of the variable), and update the data obtained from the external system in real time; wherein, the paramSave.xml file is stored in the storage medium corresponding to each of the host and the slave;

[0074] S3, determine whether the current computer is a host or a slave, if it is a host, execute S4; if it is a slave, execute S5;

[0075] S4, the host allocates a memory area in the memory as an intermediate data buffer area, writes the state variable information that needs to be synchronized into the intermediate data buffer area, and waits for the data write semaphore; when the data write semaphore is valid, the data in the intermediate data buffer area is packaged and CRC check is performed, and the data after the check is passed is written into the reflective memory card of the host;

[0076] S5. The slave obtains the address information of the state variable information to be synchronized from the paramSave.xml file stored in its own storage medium, and reads the state variable information to be synchronized from the reflective memory card of the host based on the address information; performs CRC check on the state variable information to be synchronized, stores the checked data in the intermediate data buffer area of ​​the slave (if the check fails, the data is discarded), and waits for the data write semaphore; when the data write semaphore is valid, writes the data in the intermediate data buffer area to the reflective memory card of the slave; wherein the intermediate data buffer area of ​​the slave is a memory area allocated in the slave memory.

[0077] After the master and slave machines complete data reception (after the corresponding data is written to the reflective memory cards of the master and slave machines), the state quantities of the local machines are updated respectively, including the reflective memory, network communication state and working state of the other device and the control mode of link switching. The control modes of link switching include manual control mode and program control mode.

[0078] In this way, the master and slave complete a round of synchronization and backup, and then return to repeat S3-S5 to perform cyclic synchronization.

[0079] The data synchronization method in the embodiment of the present invention introduces the concept of an intermediate data buffer in the synchronization task, and only when the data write semaphore is valid, the global variables that need to be synchronized are written to avoid network communication failures caused by read and write conflicts of global data. In addition, during the synchronization task, the user can stop synchronization at any time by controlling the write semaphore, which provides the system with higher operational flexibility and security. In this way, the dual-machine hot standby system can not only maintain a high degree of data consistency and real-time updates under normal circumstances, but also quickly respond to user operation requirements under special circumstances, suspend or resume data synchronization, thereby protecting the stability of the system and the security of the data.

[0080] When Ethernet is used for synchronization, synchronization and backup communication between machine A and machine B can be established directly through Ethernet.

[0081] After completing the first round of data synchronization and backup, the dual-machine hot standby system enters the normal working stage, and the monitoring module monitors the health status and operating status of the master and slave in real time; wherein, the health status and operating status of the master and slave include whether the master and slave fail, and whether the current external communication channel and internal communication channel fail. By judging whether the heartbeat message sent by the other party is timed out, and counting the number of timeouts, if the number of timeouts exceeds the preset threshold, it is considered that the internal main synchronization channel fails. By judging whether the network information sent by the other party is timed out, and counting the number of timeouts, if the number of timeouts exceeds the preset threshold, it is considered that the internal standby synchronization communication channel fails. In the embodiment of the present invention, the dual-machine hot standby system detects the communication quality between the master and slave in the normal working stage. If the slave fails to receive the heartbeat message sent by the host reflective memory for 7 consecutive times, it is determined to be a reflective memory communication failure. If the slave fails to receive the heartbeat data transmitted by the Ethernet communication channel for 5 consecutive times, that is, the abnormal time exceeds 500 milliseconds, it is determined to be a network communication failure. At this time, the dual-machine hot standby system will enter the switching stage.

[0082] The monitoring module detects fault information and sends it to the switching module. The switching module evaluates the fault according to the set fault evaluation algorithm. When the fault level meets the switching condition, or the CPU of the host receives a switching control instruction from the outside, the dual-machine hot standby system enters the switching stage. The switching includes the master-slave state switching between the host and the slave, and / or the switching between the main synchronization channel and the backup synchronization channel. The master-slave state switching conditions between the host and the slave include:

[0083] When the slave detects that the host is abnormal, the current slave actively switches to the host, and the host passively downgrades to the slave; at this time, the slave will take over all the tasks and communication channels of the host to ensure the continuous operation of the system. This process includes the slave taking over the control of the external system by the dual-machine hot standby system and updating its own operating status to the host. Alternatively, when the CPU of the host receives a program-controlled switching instruction sent by an external network port or serial port, the current host will actively downgrade to a slave, and the current slave will automatically upgrade to a master. Regardless of whether the switching instruction is received through the network port or the serial port, the system will execute the same switching process to ensure the seamless switching of the master and slave roles and the communication channels.

[0084] It should be noted that the resources switched during the switching process of the dual-machine hot standby system include USB, RS485, network port, VGA, etc., among which the USB and VGA interfaces are mainly used for interacting with the system during equipment debugging and do not require switching processing; RS232 / 485 and network port are responsible for data communication of system peripheral devices, and the stability and real-time performance of the data link must be ensured during operation. When switching the communication links of RS232 / 485 and network port to system peripheral devices, the present invention can ensure that the communication recovery time is less than 20 milliseconds.

[0085] It should be noted that the serial bus of the master and slave machines are both connected to the system. At the same time, only the master machine is allowed to communicate with external devices. Although the slave machine is connected to the communication link with the external system, it does not communicate.

[0086] With regard to the master-slave state switching of the dual-machine hot standby system, the present invention is based on the idea of ​​time-sharing multiplexing. Through program configuration, the network card information of the master and slave machines for external communication is controlled, and the states of the network cards of the master and slave machines for external communication are controlled to achieve the purpose of accessing the same network with the same IP address, but only one device communicates with the outside at the same time.

[0087] like Figure 6 As shown, the master-slave state switching of the dual-machine hot standby system provided in the embodiment of the present invention includes:

[0088] The network cards for external communication of the host and the slave are configured to work in the same network segment and initialized to the same IP address, so that the network configurations (including IP address, subnet mask, gateway and DNS) of the host and the slave are consistent; and the network cards for external communication of the host and the slave are both set to the DOWN state to avoid IP address conflicts when the system starts. In the embodiment of the present invention, the network configurations of the two devices are initialized to be exactly the same using the ifconfig command.

[0089] And initialize data synchronization and backup between machine A and machine B through the main synchronous communication channel.

[0090] Under normal working conditions, the network card of the host for external communication is set to the enabled (UP) state, and the network card of the slave for external communication is set to the disabled (DOWN) state;

[0091] When a fault occurs, the master-slave state is switched according to the switching instruction issued by the switching module, and / or the main synchronization channel and the backup synchronization channel are switched; wherein, when the master-slave state is switched, the network card for external communication of the host is set to the closed (DOWN) state, and the operating state of the host is updated to the slave; and the network card for external communication of the slave is set to the enabled (UP) state, and the operating state of the slave is updated to the master.

[0092] The time-division multiplexing method is used to solve the network conflict problem caused by the same IP accessing the same network.

[0093] In the dual-machine hot standby system switching method of the present invention, both the host and the slave are physically connected to the external system through an external switch, but the network card for external communication in the host is set to be in an enabled state, while the network card for external communication in the slave remains in a closed state, ensuring that only the host establishes an actual communication connection with the external system at the same time, thereby avoiding network conflicts and consumption of communication resources. At the same time, since both the host and the slave are physically connected to the external system, and the network cards for external communication of the two devices before and after the switching are configured to work in the same network segment and use the same IP address, when switching is required, the operating state can be directly switched to the current state rather than the initial operating state of the system. That is, after the switching, the new host does not need to re-establish a network connection with the external system, and can communicate with the external system seamlessly, which greatly reduces the network switching time, realizes the senseless switching of the master and slave machines, and also solves the problem that the switching card easily causes a single point failure of the system.

[0094] In the switching method of the present invention, external devices do not need to perceive the switching process of the master and slave machines, and the system can maintain continuous operation, avoiding interruption of control tasks caused by single point failures, thereby ensuring high availability and stability of the system during the switching process. In addition, the present invention also has high flexibility and adaptability, can adapt to the needs of different network environments and application scenarios, and further enhances the reliability and practicality of the dual-machine hot standby system.

[0095] The present invention proposes a dual-machine hot standby system and a network switching method, which not only ensures the stability and reliability of data backup, but also improves the real-time performance of data synchronization and communication between the two machines. Experiments have shown that after the two machines perform a switching operation, the recovery time of the system and the external communication link is less than 20 milliseconds, ensuring the stability of the long-term continuous operation of the industrial control system.

[0096] An embodiment of the present invention also provides an industrial control computer, including a computer-readable storage medium and a processor;

[0097] Computer-readable storage media for storing executable instructions;

[0098] The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the switching method of the dual-machine hot standby system.

[0099] The embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the switching method of the dual-machine hot standby system as described above is implemented.

[0100] A computer program product is also provided in an embodiment of the present invention. When the computer program product is run on a computer, the computer is enabled to execute the switching method of the dual-machine hot standby system.

[0101] For details, please refer to the specific description of the switching method of the dual-machine hot standby system above, which will not be repeated here.

[0102] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A dual-machine hot standby system, characterized in that: include: Machine A and machine B are hot backup for each other, with internal switches and switching modules; One of the A and B machines is a host machine, used for data communication with an external system, and the other is a slave machine, used for backing up the data of the host machine; both A and B machines are connected to the external system through their respective external communication interfaces; Machine A and machine B use optical fiber to connect their respective reflective memory cards as the main synchronization channel, and use Ethernet to connect the internal switch through their respective internal communication network ports as a backup synchronization channel to achieve data synchronization and backup between machine A and machine B; The switching module is used to switch the main synchronization channel and the backup synchronization channel when the fault switching condition is met or under external switching control instructions, and / or switch the master-slave status of machine A and machine B to achieve dual-machine hot standby.

2. The dual-machine hot standby system according to claim 1, characterized in that: The main synchronization channel is used between machine A and machine B to perform each round of data synchronization and backup, including: Determine whether the current computer is a host or a slave; where the current computer is machine A or machine B; If it is a host, execute: The host allocates a memory area in the memory as an intermediate data buffer area, writes the state variable information that needs to be synchronized into the intermediate data buffer area, and waits for the data write semaphore; when the data write semaphore is valid, the data in the intermediate data buffer area is packaged and CRC check is performed, and the checked data is written into the reflective memory card of the host; If it is a slave, execute: The slave reads the state variable information that needs to be synchronized from the reflective memory card of the host, performs CRC check, stores the checked data in the intermediate data buffer area of ​​the slave, and waits for the data write semaphore; when the data write semaphore is valid, writes the data in the intermediate data buffer area of ​​the slave into the reflective memory card of the slave; wherein the intermediate data buffer area of ​​the slave is a memory area allocated in the slave memory.

3. The dual-machine hot standby system according to claim 2, characterized in that: Before determining whether the current computer is a host or a slave, it also includes: Writing the state variable information that needs to be synchronized in the application into a configuration file; storing the configuration file in the storage medium of the host; and updating the configuration file by the host to the storage medium of the slave; The slave reads the state variable information that needs to be synchronized from the host's reflective memory card, including: The slave obtains the address of the state variable information to be synchronized from the configuration file; based on the address, the slave reads the state variable information to be synchronized from the reflective memory card of the host.

4. The dual-machine hot standby system according to claim 1, characterized in that: The failover conditions include: When the slave detects that the host has an abnormality, when the external communication channel fails, and / or when the internal communication channel fails; wherein, the external communication channel is the channel for machine A or machine B to communicate with the external system, and the internal communication channel is the main synchronization channel or the backup synchronization channel.

5. The dual-machine hot standby system according to claim 4, characterized in that: Determining that the internal communication channel fails includes: Counting the number of timeouts of the received heartbeat messages, if the number of timeouts exceeds a preset threshold, it is considered that the main synchronization channel has a fault; The number of timeouts of the received network information is counted, and if the number of timeouts exceeds a preset threshold, it is considered that the main backup channel has a fault.

6. The dual-machine hot standby system according to claim 4 or 5, characterized in that: By monitoring the health status and operating status of the master and slave machines, it is determined whether the failover condition is met.

7. A switching method for a dual-machine hot standby system according to any one of claims 1 to 6, characterized in that: include: Configure the network cards for external communication between the host and slave to work in the same network segment and initialize them to the same IP address; And set the network cards for external communication of the host and slave machines to closed state; Then set the host's external communication network card to enabled state; When a fault switching condition is met or under an external switching control instruction, the main synchronization channel and the backup synchronization channel are switched, and / or the master-slave status of machine A and machine B is switched; The switching of the master-slave status of machine A and machine B includes: Set the host's external communication network card to closed state, and update the host's running state to slave; Set the slave's external communication network card to enabled state, and update the slave's operating state to master.

8. An industrial control computer, characterized in that: comprising a computer readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is used to read the executable instructions stored in the computer-readable storage medium to execute the switching method of the dual-machine hot standby system according to claim 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, the switching method of the dual-machine hot standby system as claimed in claim 7 is implemented.

10. A computer program product, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the switching method of the dual-machine hot standby system according to claim 7.

Images