Dual-computer hot backup system and dual-computer switching method

Abstract

The application belongs to the technical field of dual-computer hot backup, and discloses a dual-computer hot backup system and a dual-computer switching method. The dual-computer hot backup system comprises A computer and B computer which are hot backup to each other, and an internal switch; one of the A computer and the B computer is a master computer for data communication with an external system, and the other is a slave computer for data backup of the master computer; the A computer and the B computer are connected with the external system through respective external communication interfaces; the A computer and the B computer are connected with respective reflective memory cards through optical fibers as main synchronization channels, and are connected with the internal switch through respective internal communication network interfaces as backup synchronization channels, so as to realize synchronization and backup of data between the A computer and the B computer. The application further provides a corresponding switching method. The application can improve the reliability and stability of long-time uninterrupted operation of the dual-computer hot backup system, reduce switching recovery time, and adapt to the needs of different network environments and application scenarios.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of dual-computer hot backup, and more particularly to a dual-computer hot backup system and a dual-computer switching method. BACKGROUND

[0002] To ensure that the control system in an industrial environment can run continuously and stably for a long time, a dual-computer redundant structure is usually adopted, and based on a data synchronization and load balancing mechanism, when the main computer fails, the standby device can continue to execute the task, thereby improving the reliability of the system.

[0003] The best dual-computer hot backup method in the current industrial control field is to share the storage medium between the two computers, which can improve the real-time performance of system backup, but once the shared storage medium fails, the data of the entire system will be lost, and the two devices will compete for the control right of the storage service, which is not conducive to the reliability and stability of long-term uninterrupted operation of the system.

[0004] In addition, the recovery time of the communication link of the entire system after the dual-computer hot backup system performs the dual-computer switching operation must also be guaranteed, so as to avoid the communication interruption between the industrial computer and the entire system for a long time, thereby causing irreparable damage. However, the switching recovery time of the existing dual-computer hot backup system cannot meet the control requirements of the strong real-time system. In the existing scheme, the communication channel of the dual-computer hot backup system to the outside will be switched and selected through a switching card, but the switching card is easy to cause a single point failure of the system, and after switching, the network will be initialized again, the switching recovery time is long, and the network communication of the system after switching may be abnormal. SUMMARY

[0005] In view of the above defects or improvement needs of the prior art, the present application provides a dual-computer hot backup system and a dual-computer switching method, which aims to improve the reliability and stability of long-term uninterrupted operation of the dual-computer hot backup system.

[0006] To achieve the above-mentioned purpose, according to the first aspect of the present application, a dual-computer hot backup system is provided, comprising: A computer and B computer which are hot backup to each other, an internal switch and a switching module;

[0007] One of the A computer and the B computer is a master computer for communicating data with an external system, and the other is a slave computer for backing up data of the master computer; the A computer and the B computer are connected with the external system through respective external communication interfaces;

[0008] The A computer and the B computer are connected by optical fibers to connect respective reflective memory cards as main synchronization channels, and are connected to the internal switch through respective internal communication network interfaces using Ethernet as backup synchronization channels, so as to realize the synchronization and backup of data between the A computer and the B computer;

[0009] The switching module is configured to switch the primary synchronization channel and the backup synchronization channel, and / or switch the master and slave states of the A machine and the B machine, to realize dual-computer hot backup when a fault switching condition is met or under an external switching control instruction.

[0010] Further, the A machine and the B machine perform data synchronization and backup in each round of data synchronization via the primary synchronization channel, including:

[0011] determining whether the current computer is a master or a slave, wherein the current computer is the A machine or the B machine;

[0012] if the current computer is the master, performing:

[0013] allocating a memory region in the memory of the master as an intermediate data buffer, writing state variable information to be synchronized into the intermediate data buffer, and waiting for a data write semaphore; when the data write semaphore is valid, packing data in the intermediate data buffer and performing CRC check, and writing the data passing the check into a reflective memory card of the master;

[0014] if the current computer is the slave, performing:

[0015] reading state variable information to be synchronized from the reflective memory card of the master, performing CRC check, storing the data passing the check into an intermediate data buffer of the slave, and waiting for a data write semaphore; when the data write semaphore is valid, writing data in the intermediate data buffer of the slave into a reflective memory card of the slave; wherein the intermediate data buffer of the slave is a memory region allocated in the memory of the slave.

[0016] Further, before determining whether the current computer is the master or the slave, further comprising:

[0017] writing state variable information to be synchronized in an application into a configuration file, storing the configuration file into a storage medium of the master, and updating the configuration file into a storage medium of the slave by the master;

[0018] reading state variable information to be synchronized from the reflective memory card of the master by the slave, comprising:

[0019] obtaining, by the slave, an address of state variable information to be synchronized from the configuration file, and reading, by the slave, state variable information to be synchronized from the reflective memory card of the master based on the address.

[0020] Further, the fault switching condition comprises:

[0021] The slave detects that the master is abnormal, the external communication channel is faulty, and / or the internal communication channel is faulty; wherein the external communication channel is a channel for the A machine or the B machine to communicate with an external system, and the internal communication channel is the primary synchronization channel or the standby synchronization channel.

[0022] Further, the judging that the internal communication channel is faulty comprises:

[0023] The number of times of receiving the heartbeat packet is counted, and if the number of times of the timeout exceeds a preset threshold, it is considered that the primary synchronization channel is faulty;

[0024] The number of times of receiving the network information is counted, and if the number of times of the timeout exceeds a preset threshold, it is considered that the primary standby channel is faulty.

[0025] Further, the health status and the running state of the master and the slave are monitored to determine whether the fault switching condition is met.

[0026] According to a second aspect of the present application, a switching method of the dual-computer hot backup system according to any one of the first aspect is provided, comprising:

[0027] The network cards for external communication of the master and the slave are configured to work in the same network segment and are initialized to the same IP address, and the network cards for external communication of the master and the slave are both set to a closed state;

[0028] Then, the network card for external communication of the master is set to an enabled state;

[0029] When the fault switching condition is met or under an external switching control instruction, the primary synchronization channel and the standby synchronization channel are switched, and / or the master-slave state of the A machine and the B machine is switched;

[0030] When the master-slave state of the A machine and the B machine is switched, it comprises:

[0031] The network card for external communication of the master is set to a closed state, and the running state of the master is updated to a slave;

[0032] The network card for external communication of the slave is set to an enabled state, and the running state of the slave is updated to a master.

[0033] According to a third aspect of the present application, an industrial control computer is provided, comprising a computer readable storage medium and a processor;

[0034] The computer readable storage medium is used to store executable instructions;

[0035] The processor is configured to read the executable instructions stored in the computer readable storage medium to execute the switching method of the dual hot-standby system.

[0036] According to a fourth aspect of the present application, a computer readable storage medium is provided, which stores a computer program, and the program is executed by a processor to implement the switching method of the dual hot-standby system according to the second aspect.

[0037] According to a fifth aspect of the present application, a computer program product is provided, which, when executed on a computer, causes the computer to execute the switching method of the dual hot-standby system according to the second aspect.

[0038] In general, the above technical solutions conceived by the present application can achieve the following beneficial effects:

[0039] (1) In the dual hot-standby system of the present application, in external communication, the A machine and the B machine are each directly connected with the external system through the corresponding external communication interface; in the synchronization and backup of internal data, the high-speed optical fiber is used to connect the reflection memory cards of the A machine and the B machine as the main synchronization communication channel between the two devices, and the Ethernet is used to connect the internal switch as the backup synchronization channel. At different times, the switching module is used to switch the master-slave state of the A machine and the B machine when the fault switching condition is met or under the external switching control instruction, so as to ensure that only the master machine communicates with the external system at the same time, and the two dedicated internal synchronization communication channels are switched. In this way, the dual hot-standby system of the present application not only realizes redundant communication with the external system, but also adopts dual-channel synchronization redundancy inside the dual hot-standby system, thereby ensuring the reliability and stability of the connection and data interaction function of the dual machine.

[0040] (2) In the design of internal synchronous communication channels, first, considering that using different communication channels can reduce the impact of the same fault on the entire system, fault isolation can be achieved. If the same channel is used, the problem of switching both channels under a fault may occur, which is easy to cause repeated switching or failure to avoid the problem after switching. Second, reflective memory cards usually have low latency and high bandwidth characteristics, which are suitable for real-time data transmission. Ethernet has flexibility and wide compatibility, which is suitable for general data communication. By combining the two channels, the performance of the system can be optimized to meet the needs of different types of data transmission. Third, in harsh industrial environments, electromagnetic interference, temperature changes and other factors may affect communication. The different physical and electrical characteristics of reflective memory and Ethernet make them different in their sensitivity to environmental interference, thereby increasing the anti-interference ability of the system. Fourth, reflective memory cards have superior performance, and Ethernet devices have lower cost and are easy to maintain. By combining their use, performance can be guaranteed while controlling costs. Therefore, based on the above considerations, the application designs two different types of synchronous communication channels. And because of the physical isolation of reflective memory cards and Ethernet, independent communication protocols and independent hardware support, the failure of one channel will not affect the data communication of the other channel, so as to further ensure the reliability and stability of communication.

[0041] (3) As a preferred, in the process of data synchronization and backup between A machine and B machine in each round, the concept of intermediate data buffer area is introduced in the synchronization task, and only when the data write semaphore is valid, the write operation is performed on the global variable that needs to be synchronized, avoiding the read-write conflict of global data causing network communication failure. And in the process of synchronization task, users can stop synchronization at any time by controlling the write semaphore, which provides higher operation flexibility and safety for the system. In this way, the dual-machine hot standby system not only maintains the high consistency and real-time update of data under normal circumstances, but also quickly responds to the operation needs of users in special circumstances, suspends or resumes data synchronization, thereby protecting the stability of the system and the safety of the data.

[0042] (4) As a preferred, users can simply specify which data needs to be synchronized by configuring the configuration file stored in the storage medium of the master and slave machines, so that users can very conveniently select key data for synchronization according to specific application requirements, reducing unnecessary consumption of communication resources; and the data in the program written by the user can be backed up, increasing the flexibility and customization of the system.

[0043] (5) Further, the dual-computer hot backup system switching method of the present application is physically connected with the external system through the external switch by the master computer and the slave computer, but the network card for external communication in the master computer is in the enabled state, and the network card for external communication in the slave computer is kept in the closed state, so that the system has only the master computer connected with the external system to establish the actual communication connection at the same time, avoiding the network conflict and the consumption of communication resources. At the same time, since the master computer and the slave computer are physically connected with the external system, and the network cards for external communication of the two devices before and after switching are configured to work in the same network segment and use the same IP address, when switching is needed, the running state can be directly switched to the current state instead of the initial running state of the system. That is, the new master computer does not need to reestablish the network connection with the external system, and can seamlessly communicate with the external system, greatly reducing the network switching time, realizing the seamless switching of the master and slave computers, and solving the problem of single point failure caused by the switching card.

[0044] In summary, the present application improves the hardware structure of the dual-computer hot backup system, avoids the interruption of control task caused by single point failure, and ensures the high reliability and stability of the system during the switching process. And a new network switching method is proposed, which can shorten the recovery time of the dual-computer hot backup system after switching operation of the master and slave computers as much as possible, meeting the needs of strong real-time control system. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The figure is a schematic diagram of the hardware connection relationship of the dual-computer hot backup system in the embodiment of the present application.

[0046] Figure 2 The figure is a schematic diagram of the software module structure of the dual-computer hot backup system in the embodiment of the present application.

[0047] Figure 3 The figure is a schematic diagram of the flow of different working stages of the dual-computer hot backup system in the embodiment of the present application.

[0048] Figure 4 The figure is a schematic diagram of the running flow of the data synchronization task after power-on of the dual-computer hot backup system in the embodiment of the present application.

[0049] Figure 5 The figure is a schematic diagram of the program flow of the data synchronization task in the embodiment of the present application.

[0050] Figure 6 The figure is a schematic diagram of the master-slave state switching flow of the dual-computer hot backup system in the embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application. In addition, the technical features involved in the various embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0052] In the present application, the terms "first", "second", and the like in the present application and the drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0053] As shown in Figure 1 The embodiment of the present application provides a dual-computer hot backup system, mainly comprising: A machine, B machine and internal switch which are hot backup to each other; wherein, the A machine and the B machine are computer devices which are completely same in structure and configuration; one of the A machine and the B machine is a master machine for maintaining data communication with an external system, and the other one is a slave machine for redundantly backing up data of the master machine.

[0054] The A machine and the B machine both have complete independent I / O resources, the A machine and the B machine are connected with the external system through respective external serial communication interfaces, and the A machine and the B machine are connected with the external switch through respective external network interfaces, so that the A machine and the B machine can be connected with the external system through the external communication interfaces in hardware. In software, the same time is ensured to have only the master machine to communicate with the external system by shielding the external port.

[0055] The A machine and the B machine are both equipped with a high-performance reflective memory card, and the reflective memory cards of the A machine and the B machine are connected by high-speed optical fiber as the main synchronous communication channel between the two devices; and the A machine and the B machine are both equipped with a gigabit network port for internal communication, and the internal switch is connected as a standby synchronous communication channel between the two devices by Ethernet through the gigabit network port for internal communication; the dual-channel synchronous redundancy ensures the reliability of the connection and data interaction function of the dual-computer. Moreover, the A machine and the B machine are connected to the same internal switch for Ethernet communication through the respective network ports for internal communication. Since the switch is always in an active state, the A machine or the B machine can establish a connection with the switch when the respective system is started, without waiting for the other device to start and respond, thereby ensuring the stability of the network interaction between the A machine and the B machine.

[0056] By monitoring the health status and running status of the A machine and the B machine (to determine whether the fault switching condition is met), or under the external switching control instruction, the main synchronous channel and the standby synchronous channel are arbitrated to realize the selection and switching of the internal communication channel, and the master-slave state of the A machine and the B machine is switched to ensure that only the master machine communicates with the external system at the same time.

[0057] The dual-machine hot backup system in the application, in external communication, is directly connected with external systems through respective external communication interfaces of A machine and B machine; in internal data synchronization and backup, high-speed optical fiber is used to connect the reflection memory cards of A machine and B machine as the main synchronization communication channel between the two devices, and Ethernet is used to connect the internal switch as a backup synchronization channel. At different times, according to the health status and running state of A machine and B machine, the master-slave state of A machine and B machine is selected to ensure that only the master machine communicates with the external system at the same time, and the two dedicated internal synchronization communication channels are selected to realize the internal data interaction between A machine and B machine. In this way, the dual-machine hot backup system in the application not only realizes redundant communication with the external system, but also adopts dual-channel synchronization redundancy in the dual-machine hot backup system to ensure the reliability and stability of the connection and data interaction function of the dual machine.

[0058] In the design of internal synchronization communication channel, first, considering that using different communication channels for communication can reduce the impact of the same fault on the entire system, fault isolation can be achieved. If the same channel is used, the problem of switching of both channels may occur under a kind of fault, which is easy to cause repeated switching or switching after the fault cannot be avoided. Second, reflection memory cards usually have the characteristics of low delay and high bandwidth, which are suitable for real-time data transmission. Ethernet has flexibility and wide compatibility, which is suitable for general data communication. By combining the two channels, the performance of the system can be optimized to meet the data transmission needs of different types. Third, in harsh industrial environments, electromagnetic interference, temperature changes and other factors may affect communication. The different physical and electrical characteristics of reflection memory and Ethernet make them different in sensitivity to environmental interference, thereby increasing the anti-interference ability of the system. Fourth, reflection memory cards have superior performance, and Ethernet devices have lower cost and are easy to maintain. By combining the use, the performance can be guaranteed while the cost is controlled. Therefore, based on the above considerations, the application designs two different types of synchronization communication channels. And because of the physical isolation of reflection memory cards and Ethernet, independent communication protocols and independent hardware support, the failure of one channel will not affect the data communication of the other channel, so as to further ensure the reliability and stability of the communication.

[0059] Specifically, reflective memory cards and Ethernet are two different physical communication media. Reflective memory cards typically use dedicated hardware interfaces, while Ethernet uses network interface cards (NICs) and network cables. This physical isolation means that a physical failure in one channel (such as a broken cable or damaged interface) will not affect the other channel, achieving physical isolation. Reflective memory cards and Ethernet use different communication protocols. Reflective memory cards typically use dedicated high-speed data transmission protocols, while Ethernet uses standard network protocols (such as TCP / IP). Protocol independence means that a protocol failure in one channel (such as packet loss or protocol conflicts) will not affect the other channel. Reflective memory cards and Ethernet devices are typically supported by independent hardware. Even if the hardware in one channel fails, the other channel can still function normally. Thus, a failure in one channel will not affect data communication in the other channel.

[0060] Machine A and Machine B achieve the aforementioned synchronization, communication, monitoring, and switching through corresponding software modules. For example... Figure 2 As shown in the embodiment of the present invention, the software structures of machine A and machine B are completely identical, both including but not limited to four functional modules, namely, a synchronization module, a communication module, a monitoring module, and a switching module.

[0061] The synchronization module uses a fiber optic connection between the two machines' respective reflective memory cards as the primary synchronization channel and an Ethernet connection to a switch as a backup synchronization channel to achieve data synchronization and backup between machine A and machine B. Specifically, it includes: 1) Dual Synchronization Channel Collaboration: In a dual-machine hot standby system, two dedicated communication channels are established between machine A and machine B. The primary synchronization channel uses the reflective memory cards of both machines A and B connected to a high-speed fiber optic cable for communication. This technology enables high-speed data exchange and low-latency communication, greatly improving system response speed and data processing capabilities. The backup synchronization channel uses the Ethernet ports of both machines A and B connected to a switch for communication, ensuring that the system can use the backup channel for data synchronization tasks even if the primary channel fails. 2) Master-Slave Task Synchronization Mechanism: Under the control of the corresponding synchronization module, the tasks of the master and slave machines can achieve precise synchronous operation. The tasks in the master machine use a high-precision onboard clock to drive the running program, ensuring the timing accuracy of task execution. The tasks in the slave machine run synchronously according to the clock signal sent from the master machine. This design effectively ensures that the master and slave machines maintain operational consistency at all times. 3) Global State Backup and Recovery: The synchronization module is responsible for backing up global state variables. Therefore, after any device fails and restarts, the synchronization module can quickly obtain the current state variable information that needs to be synchronized from another device and switch the operating state to the current state instead of the initial state. This rapid state recovery function significantly shortens the system's switching and recovery time and overall system stability. Furthermore, users can set the global state variables that need to be synchronized, increasing the system's flexibility and customizability. This function allows users to select key global state variables for synchronization based on the specific application scenario, reducing unnecessary consumption of communication resources. 4) Master-Slave Data Cross-Transmission: At any given time, only the master device can communicate with external systems, but data is transmitted cross-linked between the two devices. This design ensures that the master and slave devices can receive and process the same input at any time, achieving high data consistency and task execution synchronization between the master and slave devices. This avoids computational errors caused by data inconsistency and prevents the system's tasks from being interrupted after a switching operation.

[0062] The communication module includes communication between machine A and machine B within the dual-machine hot standby system, as well as communication between the dual-machine hot standby system and external subsystems. This module provides communication channels within the dual-machine hot standby system, communication channels between the dual-machine hot standby system and external devices, and channels for remotely updating the dual-machine hot standby system program. Specifically, it includes: 1) External communication interface configuration: This communication module is equipped with multiple external communication interfaces, including high-speed Ethernet and serial interfaces, to achieve flexible and stable data exchange with external devices or networks. The Ethernet channel is used to transmit large amounts of data, while the serial channel is used to transmit control signals or small batches of data. 2) Internal synchronous communication mechanism: This module provides a communication channel between machine A and machine B in the dual-machine hot standby system, including a reflective memory channel and an Ethernet channel. The high-speed reflective memory channel provides extremely low data transmission latency and is the primary communication channel, while the Ethernet channel provides higher communication flexibility and reliability and serves as a secondary communication path. 3) System remote update channel: The communication module supports remote software updates for the dual-machine hot standby system, allowing the remote deployment of new software versions or system configuration updates through a dedicated program update channel without physical contact with the hardware. This feature improves system maintenance efficiency and reduces maintenance costs. For example, the .out file inside the dual-machine hot standby industrial PC can be updated via FTP through the external Ethernet communication channel of the dual-machine hot standby system. The industrial PC of the dual-machine hot standby system transfers files through its external Ethernet interface to the FTP server; after the transfer is complete, the system will perform data integrity verification to ensure that the file has not been corrupted or tampered with during the transfer; the system will automatically execute the update program to replace the old version of the .out file. This process may involve a system restart or service reloading to ensure that the new program file can be executed correctly; after the update is completed, the system will report the update status through the same Ethernet communication channel.

[0063] The monitoring module monitors the health and operational status of the local machine and reports the results to the remote monitoring terminal. It can also receive commands from the remote monitoring terminal for the dual-machine hot standby system. Specifically, this includes: 1) System status monitoring function: The monitoring module tracks and analyzes the health and operational status of the local machine in real time, including but not limited to the current master / slave status, the communication status and quality of the communication channels between the master and slave (including the primary and backup channels), etc.; ensuring real-time monitoring of the system's operational status, timely detection and handling of potential problems, and maintaining stable system operation. 2) Remote command response mechanism: The monitoring module also has the ability to receive and execute commands issued by the remote monitoring system, including but not limited to master / slave switching operations. This mechanism allows remote administrators to quickly adjust system configurations or restore system functions when necessary, enhancing system flexibility and response speed.

[0064] The switching module determines the status of the local machine based on the health and operational status information provided by the monitoring module. It then arbitrates (switches over) the synchronous communication channel between machine A and machine B within the dual-machine hot standby system, ensuring the continuity and reliability of data transmission. In the event of channel failure or performance degradation, the switching module can quickly assess and switch to the backup channel, ensuring that data synchronization and system operation are unaffected. The switching module also arbitrates (switches over) the master-slave status of machines A and B. When a dual-machine switchover is detected, this module can automatically initiate the master-slave switchover mechanism, promoting the slave to the new master and demoting the original master to a slave. Furthermore, during master switching, the switching module ensures that the external communication channel can be seamlessly transferred to the new master, maintaining uninterrupted communication with external systems. This includes rapid adjustments to network configuration and communication protocols to ensure that the new master can take over all external communication tasks. The module also arbitrates the switching control mode of the communication channel between the master and external systems.

[0065] like Figure 3 The diagram shown illustrates the flow of the dual-machine hot standby system in different operating stages according to an embodiment of the present invention, including the initial stage, synchronization stage, normal operation stage, and switching stage. The specific process includes:

[0066] After power-on, the system enters the initial phase, where both devices A and B run the same program, including the dual-machine framework program and the user application. First, the dual-machine framework program is initialized, followed by the loading of the user application. The master / slave identities and local state variables are initialized; device A is initialized and set as the master, and device B is initialized and set as the slave. They establish a connection through heartbeat communication messages. The master periodically sends and receives heartbeat signals from the slave, while the slave periodically receives and sends heartbeat signals from the master. Heartbeat communication connections are established between the reflective memory channel and the Ethernet channel to determine the communication quality of the internal dual channels, facilitating switching to the backup communication channel in case of a primary channel failure. The master-slave data synchronization task is then initiated, entering the synchronization phase. Figure 4 As shown, Figure 4 This is a schematic diagram of the operation process of a dual-machine hot standby system after power-on, showing the operation process of the dual-machine hot standby system from the initial stage of starting the data synchronization task to the synchronization stage after power-on.

[0067] After establishing a heartbeat connection, the dual-machine hot standby system enters the synchronization phase. The synchronization module begins operation, and the master unit continuously communicates with the external system, updating data acquired from the external system in real time. Data is interleaved between the master and slave units, and the necessary program tasks are executed synchronously. The master unit processes program tasks according to the onboard clock and sends clock signals to the slave unit for clock synchronization. The slave unit processes program tasks according to the master unit's clock signal and the data transmitted from the master unit. In this way, the consistency of operation between the master and slave units is effectively ensured at all times.

[0068] Preferably, users can easily specify which data needs to be synchronized by configuring the paramSave.xml file. This allows users to conveniently select key data for synchronization based on specific application needs, reducing unnecessary consumption of communication resources; and it also allows for the backup of data in user-written programs, increasing the system's flexibility and customizability. This custom synchronization mechanism is particularly important for complex industrial control systems because it allows operators to optimize system performance for specific operating or environmental conditions.

[0069] As a preferred option, such as Figure 5 As shown, the internal data synchronization task is performed using reflected memory. The synchronization module includes the following steps:

[0070] S1. Write the data to be backed up (the state variable information to be synchronized) in the application (the program task to be executed) into the configuration file. In this embodiment of the invention, the configuration file is the paramSave.xml file. Then, transmit the paramSave.xml file to the host through the remote transmission function of the host's synchronization module. As shown in Table 1 below, the meaning of each field in the paramSave.xml file in this embodiment of the invention is as follows.

[0071] Table 1 shows the meaning of each field in the paramSave.xml file.

[0072]

[0073] S2. The host updates the paramSave.xml file to the slave device through the synchronization function; the host and slave devices read the paramSave.xml file, obtain the status variable information to be synchronized (including the variable name, address, type and length), and update the data obtained from the external system in real time; the paramSave.xml file is stored in the corresponding storage media of the host and slave devices respectively.

[0074] S3. Determine whether the current computer is a master or a slave. If it is a master, execute S4; if it is a slave, execute S5.

[0075] S4. The host allocates a memory area in memory as an intermediate data buffer, writes the state variable information that needs to be synchronized into the intermediate data buffer, and waits for the data write semaphore; when the data write semaphore is valid, the data in the intermediate data buffer is packaged and CRC checked, and the data after the check passes is written to the host's reflective memory card.

[0076] S5. The slave device obtains the address information of the state variable information to be synchronized from the paramSave.xml file stored in its own storage medium. Based on the address information, it reads the state variable information to be synchronized from the host's reflective memory card. It performs CRC verification on the state variable information to be synchronized and stores the verified data in the slave device's intermediate data buffer (if the verification fails, the data is discarded), and waits for the data write semaphore. When the data write semaphore is valid, it writes the data in the intermediate data buffer to the slave device's reflective memory card. The intermediate data buffer of the slave device is a memory area allocated in the slave device's memory.

[0077] After the master and slave devices complete data reception (after the corresponding data is written to the reflective memory cards of the master and slave devices), they update their own status variables, including the reflective memory of the other device, network communication status, working status, and link switching control mode. The link switching control modes include manual mode and programmable mode.

[0078] In this way, the master and slave complete one round of synchronization and backup, and then return to repeat S3-S5 to perform cyclical synchronization.

[0079] The data synchronization method in this embodiment introduces the concept of an intermediate data buffer in the synchronization task. Write operations on global variables requiring synchronization are only performed when the data write semaphore is valid, avoiding network communication failures caused by read / write conflicts of global data. Furthermore, during the synchronization task, users can stop synchronization at any time by controlling the write semaphore, providing the system with greater operational flexibility and security. In this way, the dual-machine hot standby system can not only maintain high data consistency and real-time updates under normal circumstances, but also quickly respond to user operational needs in special circumstances, pausing or resuming data synchronization, thereby protecting system stability and data security.

[0080] When using Ethernet for synchronization, synchronization and backup communication between machine A and machine B can be established directly via Ethernet.

[0081] After completing the first round of data synchronization and backup, the dual-machine hot standby system enters the normal operation phase. The monitoring module monitors the health status and operating status of the master and slave machines in real time. This includes whether the master and slave machines have malfunctioned, and whether the current external and internal communication channels are faulty. By determining whether the acquired heartbeat messages sent by the other party time out and counting the number of timeouts, if the number of timeouts exceeds a preset threshold, the internal primary synchronization channel is considered to have failed. By determining whether the acquired network information sent by the other party times out and counting the number of timeouts, if the number of timeouts exceeds a preset threshold, the internal backup synchronization communication channel is considered to have failed. In this embodiment of the invention, during the normal operation phase, the dual-machine hot standby system detects the communication quality between the master and slave machines. If the slave machine fails to receive heartbeat messages sent by the master's reflected memory seven consecutive times, it is considered a reflected memory communication failure. If the slave machine fails to receive heartbeat data transmitted through the Ethernet communication channel five consecutive times, i.e., the abnormal time exceeds 500 milliseconds, it is considered a network communication failure. At this time, the dual-machine hot standby system will enter the switching phase.

[0082] The monitoring module detects fault information and sends it to the switching module. The switching module evaluates the fault according to the set fault assessment algorithm. When the fault level meets the switching conditions, or when the master CPU receives a switching control command from an external source, the dual-machine hot standby system enters the switching phase. The switching includes a master-slave state switch between the master and slave, and / or a switch between the primary synchronization channel and the backup synchronization channel. The master-slave state switch conditions between the master and slave include:

[0083] When a slave device detects an anomaly in the master device, the slave device proactively switches to master, while the master device passively degrades to slave. At this time, the slave device takes over all tasks and communication channels of the master, ensuring continuous system operation. This process includes the slave device taking over control of the external system from the dual-machine hot standby system and updating its own operating status to master. Alternatively, when the master's CPU receives a programmable switching command from an external network port or serial port, the current master will proactively degrade to slave, while the current slave device will automatically upgrade to master. Regardless of whether the switching command is received via network port or serial port, the system will execute the same switching procedure, ensuring seamless master-slave role transitions and communication channel switching.

[0084] It should be noted that the resources switched during the switchover process of the dual-machine hot standby system include USB, RS485, Ethernet, and VGA. Among them, the USB and VGA interfaces are mainly used for interaction with the system during device debugging and do not require switching. The RS232 / 485 and Ethernet interfaces are responsible for data communication between the system's peripheral devices. It is necessary to ensure the stability and real-time performance of the data link during operation. When switching the communication link between the RS232 / 485 and Ethernet interfaces and the system's peripheral devices, this invention can guarantee that the communication recovery time is less than 20 milliseconds.

[0085] It should be noted that both the master and slave serial buses are connected to the system. At any given time, only the master is allowed to communicate with external devices. Although the slave is connected to the communication link with the external system, it does not communicate.

[0086] For master-slave state switching in a dual-machine hot standby system, this invention is based on the concept of time-division multiplexing. It configures the network card information of the master and slave machines for external communication through the program and controls the status of the network cards of the master and slave machines for external communication, so as to achieve the purpose of accessing the same network with the same IP address, but only one device communicating with the outside at any given time.

[0087] like Figure 6 As shown, the master-slave state switching of the dual-machine hot standby system provided in this embodiment of the invention includes:

[0088] Configure the network interface cards (NICs) for external communication of both the master and slave devices to operate on the same network segment and initialize them with the same IP address, ensuring that the network configurations (including IP address, subnet mask, gateway, and DNS) of the master and slave devices are consistent. Also, set both NICs for external communication of the master and slave devices to a DOWN state to avoid IP address conflicts during system startup. In this embodiment of the invention, the ifconfig command is used to initialize the network configurations of the two devices to be exactly the same.

[0089] It also initializes data synchronization and backup between machine A and machine B through the main synchronous communication channel.

[0090] Under normal operating conditions, the network card for external communication of the host is set to the UP state, and the network card for external communication of the slave is set to the DOWN state.

[0091] In the event of a fault, the master-slave status is switched according to the switching command issued by the switching module, and / or the primary synchronization channel and the backup synchronization channel are switched. When switching the master-slave status, the network card for external communication of the master is set to the DOWN state and the master's running status is updated to slave. The network card for external communication of the slave is set to the UP state and the slave's running status is updated to master.

[0092] The time-division multiplexing method is used to solve the network conflict problem that can occur when the same IP address accesses the same network.

[0093] The dual-machine hot standby system switching method of this invention physically connects both the master and slave devices to the external system via an external switch. However, the network interface card (NIC) for external communication in the master device is enabled, while the NIC for external communication in the slave device is disabled. This ensures that only the master device establishes an actual communication connection with the external system at any given time, avoiding network conflicts and the consumption of communication resources. Furthermore, since both the master and slave devices are physically connected to the external system, and the NICs for external communication on both devices are configured to operate on the same network segment and use the same IP address before and after the switch, the operating state can be directly switched to the current state rather than the initial operating state when a switch is required. That is, after the switch, the new master device does not need to re-establish a network connection with the external system and can communicate seamlessly with it, greatly reducing network switching time and achieving seamless master-slave switching. It also solves the problem of single points of failure caused by switching cards.

[0094] The switching method of this invention eliminates the need for external devices to be aware of the master-slave switching process, allowing the system to maintain continuous operation and avoiding control task interruptions due to single points of failure. This ensures high availability and stability of the system during the switching process. Furthermore, this invention offers high flexibility and adaptability, meeting the needs of different network environments and application scenarios, further enhancing the reliability and practicality of the dual-machine hot standby system.

[0095] This invention proposes a dual-machine hot standby system and network switching method, which not only ensures the stability and reliability of data backup but also improves the real-time performance of data synchronization and communication between the two machines. Experiments demonstrate that after a switching operation, the recovery time of the system's external communication link is less than 20 milliseconds, ensuring the stability of the industrial control system during long-term continuous operation.

[0096] This invention also provides an industrial control computer, including a computer-readable storage medium and a processor;

[0097] Computer-readable storage media are used to store executable instructions;

[0098] The processor is used to read executable instructions stored in a computer-readable storage medium and execute the switching method of the dual-machine hot standby system described above.

[0099] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the switching method of the dual-machine hot standby system as described above.

[0100] This invention also provides a computer program product that, when run on a computer, causes the computer to execute the aforementioned switching method for a dual-machine hot standby system.

[0101] For details, please refer to the specific description of the switching method for the dual-machine hot standby system mentioned above; it will not be repeated here.

[0102] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A dual-machine hot standby system for industrial environments, characterized in that, include: Machines A and B, which serve as hot backups for each other, have internal switches and switching modules; One of the two machines, A and B, is the master machine, used for data communication with external systems, and the other is the slave machine, used for backing up the data of the master machine; both machines A and B are connected to external systems through their respective external communication interfaces. Machine A and Machine B are connected by optical fiber to their respective reflective memory cards as the primary synchronization channel, and are connected via Ethernet to the internal switch through their respective internal communication ports as a backup synchronization channel, so as to realize the synchronization and backup of data between Machine A and Machine B. The switching module is used to switch the main synchronization channel and the backup synchronization channel when the fault switching conditions are met or under the external switching control command, and / or to switch the master-slave status of machine A and machine B, so as to realize dual-machine hot standby. Data synchronization and backup between machine A and machine B are performed in each round using the aforementioned main synchronization channel, including: Determine whether the current computer is a master or slave; where the current computer is either machine A or machine B. If it is the host, then execute: The host allocates a memory area in memory as an intermediate data buffer, writes the state variable information that needs to be synchronized into the intermediate data buffer, and waits for the data write semaphore; when the data write semaphore is valid, the data in the intermediate data buffer is packaged and CRC checked, and the data that passes the check is written into the host's reflective memory card. If it is a slave device, then execute: The slave device reads the state variable information that needs to be synchronized from the host's reflective memory card and performs CRC verification. The data that passes the verification is stored in the slave device's intermediate data buffer and waits for the data write semaphore. When the data write semaphore is valid, the data in the slave device's intermediate data buffer is written into the slave device's reflective memory card. The intermediate data buffer of the slave device is a memory area allocated in the slave device's memory.

2. The dual-machine hot standby system in an industrial environment according to claim 1, characterized in that, Before determining whether the current computer is a master or slave, the following steps are also included: Write the state variable information that needs to be synchronized in the application into the configuration file; store the configuration file in the host's storage medium; the host updates the configuration file in the slave's storage medium; The slave device reads the state variable information that needs to be synchronized from the host's reflective memory card, including: The slave device obtains the address of the state variable information that needs to be synchronized from the configuration file; based on the address, the slave device reads the state variable information that needs to be synchronized from the host's reflective memory card.

3. The dual-machine hot standby system in an industrial environment according to claim 1, characterized in that, The fault switching conditions include: When the slave device detects an abnormality in the host, when the external communication channel fails, and / or when the internal communication channel fails; wherein, the external communication channel is the channel through which machine A or machine B communicates with an external system, and the internal communication channel is the main synchronization channel or the backup synchronization channel.

4. The dual-machine hot standby system in an industrial environment according to claim 3, characterized in that, Determining that the internal communication channel is malfunctioning includes: The number of timeouts of received heartbeat messages is counted. If the number of timeouts exceeds a preset threshold, the main synchronization channel is considered to have failed. The number of times the received network information times out is counted. If the number of times the timeout exceeds a preset threshold, the backup synchronization channel is considered to have failed.

5. The dual-machine hot standby system in an industrial environment according to claim 3 or 4, characterized in that, By monitoring the health and operating status of the master and slave devices, it can be determined whether the fault switching conditions are met.

6. A switching method for a dual-machine hot standby system in an industrial environment as described in any one of claims 1-5, characterized in that, include: Configure the network cards for external communication of the master and slave devices to work on the same network segment and initialize them with the same IP address to make the network configurations of the master and slave devices consistent. The network configuration includes IP address, subnet mask, gateway, and DNS. Use the ifconfig command to initialize the network configurations of the two masters and slave devices to be consistent. Then set the network cards for external communication of both the master and slave devices to the off state. Then enable the network card for external communication on the host. When the fault switching conditions are met or under an external switching control command, the main synchronization channel and the backup synchronization channel are switched, and / or the master-slave status of machine A and machine B is switched; The process of switching between the master and slave states of machines A and B includes: Set the network card for external communication of the host to the off state, and update the host's running status to slave; The network card for external communication of the slave device will be enabled, and the running status of the slave device will be updated to master.

7. An industrial control computer, characterized in that, Includes computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is used to read executable instructions stored in the computer-readable storage medium and execute the switching method of the dual-machine hot standby system in an industrial environment as described in claim 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the switching method of a dual-machine hot standby system in an industrial environment as described in claim 6.

9. A computer program product, characterized in that, When the computer program product is run on the computer, the computer executes the switching method of the dual-machine hot standby system in the industrial environment as described in claim 6.

Images