Double-master-redundancy logic voting processing system and method
By adopting dual-main redundancy logical voting processing system and FPGA technology in DCS systems, the shortcomings in hardware resource consumption, cost and data throughput of existing DCS systems are solved, and high communication speed and security are achieved.
Patent Information
- Application Number
- CN202411270005.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-11
- Publication Date
- 2025-02-25
AI Technical Summary
Existing DCS systems with high security integrity have shortcomings in hardware resource consumption, cost and data throughput, especially inefficiency in communication rates.
The logical voting processing system with dual main redundancy is adopted, and the acquisition input unit, logical operation processing unit and output driver unit are realized using FPGA technology. Communication and transmission are carried out through the redundant bus and the predefined token bus time slot method to improve the communication rate.
On the basis of ensuring security integrity and availability, the overhead of hardware resources is reduced, the communication rate of the system is improved, and due to the natural advantages of FPGA, the reliability and network security of the system are improved.
Smart Images
Figure CN119511797A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of functional safety of nuclear industrial control systems, and in particular to a dual-master redundant logic voting processing system and method. Background Art
[0002] At present, high safety integrity DCS systems generally use 2oo4 architecture and parallel bus communication between components. This architecture consumes a lot of hardware resources, is costly, and has low data throughput. In recent years, safety-level platforms have conducted research on this, and most of them use CPU technology to achieve high safety-level DCS, but the communication rate has not improved, and the data throughput is still low. Summary of the invention
[0003] The purpose of the present application is to provide a dual-master redundant logic voting processing system and method, which can improve the communication rate on the basis of safety integrity and availability.
[0004] To achieve the above objectives, this application provides the following solutions:
[0005] In a first aspect, the present application provides a dual-master redundant logic voting processing system, the dual-master redundant logic voting processing system comprising: an acquisition input unit, a logic operation processing unit and an output drive unit;
[0006] The acquisition input unit is connected to the logic operation processing unit; the output drive unit is connected to the logic operation processing unit; the acquisition input unit, the logic operation processing unit and the output drive unit all adopt FPGA technology;
[0007] The acquisition input unit includes: a channel A input module and a channel B input module; the channel A input module and the channel B input module are both connected to the logic operation processing unit;
[0008] The acquisition input unit is used to acquire information data; the information data includes: signal data of channel A input module and signal data of channel B input module; the signal data includes: switch data and analog data; the switch data and the analog data both correspondingly include acquisition data, quality bit and status information;
[0009] The logic operation processing unit is used to perform logic processing according to the information data to obtain output control data; the logic processing includes: logic operation, logic voting and data comparison;
[0010] The output driving unit is used for performing data output according to the output control data.
[0011] Optionally, the logic operation processing unit includes: a channel A control module, a channel B control module and a redundant controller module;
[0012] The channel A control module is connected to the channel A input module; the channel B control module is connected to the channel B input module; the channel A control module and the channel B control module are also connected to the redundant controller module; the redundant controller module is connected to the output drive unit;
[0013] The channel A control module is used for:
[0014] According to the signal data of the channel A input module, the signal data is analyzed based on the quality bit to obtain the channel A processing data;
[0015] Transmitting first control data to the redundant controller module; the first control data includes: diagnostic status information of channel A and processing data of channel A;
[0016] The channel B control module is used for:
[0017] According to the signal data of the channel B input module, the signal data is analyzed based on the quality bit to obtain the channel B processing data;
[0018] Transmitting second control data to the redundant controller module; the second control data includes: diagnostic status information of channel B and processing data of channel B;
[0019] The redundant controller module is used for:
[0020] According to the diagnostic status information of channel A and the diagnostic status information of channel B, a logical operation is performed based on a set logical operation processing mechanism to obtain logical operation information;
[0021] According to the data processed by channel A and the data processed by channel B, data comparison is performed to obtain comparison data;
[0022] Based on the set voting mechanism, logical voting processing is performed according to the comparison data and the logic operation information to obtain voting processing information; the voting processing information is channel mutual cutting or channel locking;
[0023] Control the channel A control module and the channel B control module to perform channel processing according to the voting processing information, and determine output control data according to the processed channels.
[0024] Optionally, the output driving unit includes: a channel A output driving module and a channel B output driving module;
[0025] The channel A output driver module is connected to the channel A control module; the channel B output driver module is connected to the channel B control module;
[0026] The channel A output driving module and the channel B output driving module both output data according to the set output principle and the output control data.
[0027] Optionally, the dual-master redundant logic voting processing system further comprises: a redundant bus;
[0028] The acquisition input unit, the logic operation processing unit and the output driving unit are all based on the redundant bus and adopt a bus communication network determined by a predefined token bus time slot method to perform communication transmission.
[0029] In a second aspect, the present application provides a dual-active redundant logic voting processing method, which is implemented by a dual-active redundant logic voting processing system according to any one of claims 1 to 4; the dual-active redundant logic voting processing method includes:
[0030] Acquire information data; the information data includes: signal data of channel A input module and signal data of channel B input module; the signal data includes: switch data and analog data; the switch data and the analog data both correspondingly include acquisition data, quality bit and status information;
[0031] Performing logic processing on the information data to obtain output control data; the logic processing includes: logic operation, logic voting and data comparison;
[0032] Data output is performed according to the output control data.
[0033] Optionally, performing logical processing according to the information data to obtain output control data specifically includes:
[0034] According to the signal data of the channel A input module, the signal data is analyzed based on the quality bit to obtain the channel A processing data;
[0035] According to the signal data of the channel B input module, the signal data is analyzed based on the quality bit to obtain the channel B processing data;
[0036] According to the diagnostic status information of channel A and the diagnostic status information of channel B, a logical operation is performed based on a set logical operation processing mechanism to obtain logical operation information;
[0037] According to the data processed by channel A and the data processed by channel B, data comparison is performed to obtain comparison data;
[0038] Based on the set voting mechanism, logical voting processing is performed according to the comparison data and the logic operation information to obtain voting processing information; the voting processing information is channel mutual cutting or channel locking;
[0039] Control the channel A control module and the channel B control module to perform channel processing according to the voting processing information, and determine output control data according to the processed channels.
[0040] Optionally, data comparison is performed according to the channel A processed data and the channel B processed data to obtain comparison data, specifically including:
[0041] If the signal data is switch data, a numerical comparison is performed based on the input value of the collected data according to the channel A processing data and the channel B processing data to obtain comparison data;
[0042] If the signal data is analog data, a difference calculation is performed based on the input signal of the collected data according to the channel A processing data and the channel B processing data to obtain a first difference;
[0043] Determine whether the first difference is not greater than a preset tolerance deviation threshold, and obtain a first determination result;
[0044] If the first judgment result is yes, then according to the channel A processing data and the channel B processing data, based on the input signal of the collected data, difference calculation is performed with the first difference value respectively to obtain a second difference value and a third difference value;
[0045] Compare the second difference value with the third difference value, and use the channel A processed data and the channel B processed data corresponding to the smaller value as the comparison data;
[0046] If the first judgment result is no, then there is an error level difference in the analog data.
[0047] Optionally, if the signal data is switch data, setting the voting mechanism specifically includes:
[0048] If the input value of the collected data in the channel A processing data is the same as the input value of the collected data in the channel B processing data, the channel A control module adopts the input value of the collected data in the channel A processing data, and the channel B control module adopts the input value of the collected data in the channel B processing data;
[0049] If the input value of the collected data in the channel A processing data is different from the input value of the collected data in the channel B processing data, and the quality bit of the channel A processing data is poor, or the diagnostic status information of the channel A is abnormal, the channel A control module adopts the input value of the collected data in the channel B processing data, and the channel B control module adopts the input value of the collected data in the channel B processing data;
[0050] If the input value of the collected data in the channel A processing data is different from the input value of the collected data in the channel B processing data, and the quality bit of the channel B processing data is poor, or the diagnostic status information of the channel B is abnormal, the channel A control module adopts the input value of the collected data in the channel A processing data, and the channel B control module adopts the input value of the collected data in the channel A processing data;
[0051] If the diagnostic status information of channel A and the diagnostic status information of channel B are both abnormal, or the quality bits of the channel A processing data and the quality bits of the channel B processing data are both poor, the fail-safe value is output according to the pre-configured processing method.
[0052] Optionally, if the signal data is analog data, setting the voting mechanism specifically includes:
[0053] If the input data in the channel A processing data is the same as the input data in the channel B processing data, the channel A control module adopts the input signal of the data collected in the channel A processing data in the comparison data, and the channel B control module adopts the input signal of the data collected in the channel B processing data; the input data is the data that satisfies the first judgment result;
[0054] If the input data in the channel A processing data is different from the input data in the channel B processing data, and the quality bit of the channel A processing data is poor, or the diagnostic status information of the channel A is abnormal, the channel A control module adopts the input signal of the data collected in the channel B processing data in the comparison data, and the channel B control module adopts the input signal of the data collected in the channel B processing data;
[0055] If the input data in the channel A processing data is different from the input data in the channel B processing data, and the quality bit of the channel B processing data is poor, or the diagnostic status information of the channel B is abnormal, the channel A control module adopts the input signal of the collected data in the channel A processing data in the comparison data, and the channel B control module adopts the input signal of the collected data in the channel A processing data;
[0056] If the diagnostic status information of channel A and the diagnostic status information of channel B are both abnormal, or the quality bits of the channel A processing data and the quality bits of the channel B processing data are both poor, the fail-safe value is output according to the pre-configured processing method.
[0057] Optionally, the dual-active redundancy logic voting processing method further includes:
[0058] According to the set output principle, data output is performed according to the output control data.
[0059] According to the specific embodiments provided in this application, this application discloses the following technical effects:
[0060] The present application provides a dual-master redundant logic voting processing system and method. Aiming at the cost and communication rate of high-security DCS systems, a 3-level 1oo2D is adopted, that is, based on the acquisition input unit, the logic operation processing unit and the output drive unit, and FPGA technology is adopted to reduce the hardware resource overhead and effectively improve the system communication rate on the basis of ensuring high security integrity and availability. Compared with CPU, FPGA has natural advantages in transplantation, reliability and network security, so the communication rate can be improved on the basis of security integrity and availability. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0062] Figure 1 It is a structural block diagram of a dual-active redundant logic voting processing system;
[0063] Figure 2 This is a schematic diagram of the 1oo2D architecture based on FPGA technology;
[0064] Figure 3 It is a schematic diagram of redundant bus topology architecture based on FPGA technology;
[0065] Figure 4 It is a schematic diagram of a predefined token bus time slot method based on FPGA technology;
[0066] Figure 5 This is a typical data flow diagram of the 1oo2D architecture;
[0067] Figure 6 This is a schematic diagram of the architecture of a nuclear power project currently in practical application;
[0068] Figure 7 A schematic diagram of an improved architecture of a nuclear power project using the dual-active redundant logic voting processing system mentioned in an embodiment of the present application. DETAILED DESCRIPTION
[0069] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0070] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.
[0071] like Figure 1 As shown, an embodiment of the present application provides a dual-active redundant logic voting processing system, which includes: an acquisition input unit, a logic operation processing unit and an output drive unit.
[0072] The acquisition input unit is connected to the logic operation processing unit; the output drive unit is connected to the logic operation processing unit; the acquisition input unit, the logic operation processing unit and the output drive unit all adopt FPGA technology.
[0073] The acquisition input unit includes: a channel A input module and a channel B input module; the channel A input module and the channel B input module are both connected to the logic operation processing unit.
[0074] The acquisition input unit is used to obtain information data; the information data includes: signal data of channel A input module and signal data of channel B input module; the signal data includes: switch quantity data and analog quantity data; the switch quantity data and analog quantity data both correspond to acquisition data, quality bit and status information.
[0075] The logic operation processing unit is used to perform logic processing according to the information data to obtain output control data; the logic processing includes: logic operation, logic voting and data comparison.
[0076] The output driving unit is used to output data according to the output control data.
[0077] The logic operation processing unit includes: a channel A control module, a channel B control module and a redundant controller module; the channel A control module is connected to the channel A input module; the channel B control module is connected to the channel B input module; the channel A control module and the channel B control module are also connected to the redundant controller module; the redundant controller module is connected to the output drive unit.
[0078] The channel A control module is used to parse and process the signal data of the channel A input module based on the quality bit to obtain the channel A processing data; the channel A control module is also used to transmit the first control data to the redundant controller module; the first control data includes: the diagnostic status information of channel A and the channel A processing data.
[0079] The channel B control module is used to perform analysis and processing based on the quality bit according to the signal data of the channel B input module to obtain channel B processing data.
[0080] The channel B control module is also used to transmit second control data to the redundant controller module; the second control data includes: diagnostic status information of channel B and channel B processing data.
[0081] The redundant controller module is used to perform logic operation based on the diagnostic status information of channel A and the diagnostic status information of channel B based on a set logic operation processing mechanism to obtain logic operation information.
[0082] The redundant controller module is used for performing data comparison according to the channel A processing data and the channel B processing data to obtain comparison data.
[0083] The redundant controller module is used to perform logic voting processing based on the set voting mechanism, according to the comparison data and the logic operation information, and obtain the voting processing information; the voting processing information is channel mutual cutting or channel locking.
[0084] The redundant controller module is also used to control the channel A control module and the channel B control module, perform channel processing according to the voting processing information, and determine output control data according to the processed channels.
[0085] The output drive unit includes: a channel A output drive module and a channel B output drive module.
[0086] The channel A output driver module is connected to the channel A control module; the channel B output driver module is connected to the channel B control module; the channel A output driver module and the channel B output driver module both output data according to the set output principle and the output control data.
[0087] In one embodiment, the dual-active redundant logic voting processing system further includes: a redundant bus.
[0088] The acquisition input unit, the logic operation processing unit and the output driving unit are all based on a redundant bus and adopt a bus communication network determined by a predefined token bus time slot method for communication transmission.
[0089] The embodiment of the present application also provides a dual-master redundant logic voting processing method, which is implemented by a dual-master redundant logic voting processing system. The dual-master redundant logic voting processing method includes:
[0090] Acquire information data; the information data includes: signal data of channel A input module and signal data of channel B input module; the signal data includes: switch quantity data and analog quantity data; the switch quantity data and the analog quantity data both correspond to the acquisition data, quality bit and status information.
[0091] Logical processing is performed on the information data to obtain output control data; the logical processing includes: logical operation, logical voting and data comparison.
[0092] Data output is performed according to the output control data.
[0093] Among them, logical processing is performed according to the information data to obtain output control data, which specifically includes:
[0094] According to the signal data of the channel A input module, analysis is performed based on the quality bit to obtain the channel A processing data.
[0095] According to the signal data of the channel B input module, the channel B processing data is obtained by performing analysis based on the quality bit.
[0096] According to the diagnostic status information of channel A and the diagnostic status information of channel B, a logical operation is performed based on a set logical operation processing mechanism to obtain logical operation information.
[0097] Data comparison is performed based on the data processed by channel A and the data processed by channel B to obtain comparison data.
[0098] Based on the set voting mechanism, logical voting processing is performed according to the comparison data and logical operation information to obtain voting processing information; the voting processing information is channel mutual cutting or channel locking.
[0099] Control channel A control module and channel B control module, perform channel processing according to the voting processing information, and determine output control data according to the processed channels.
[0100] In addition, data comparison is performed based on the channel A processing data and the channel B processing data to obtain comparison data, specifically including:
[0101] If the signal data is switch data, a numerical comparison is performed based on the input value of the collected data according to the channel A processing data and the channel B processing data to obtain comparison data.
[0102] If the signal data is analog data, a difference calculation is performed based on the input signal of the collected data according to the channel A processing data and the channel B processing data to obtain a first difference.
[0103] It is determined whether the first difference is not greater than a preset tolerance deviation threshold value to obtain a first determination result.
[0104] If the first judgment result is yes, the second difference and the third difference are obtained by respectively performing difference calculations with the first difference based on the channel A processing data and the channel B processing data and the input signal of the collected data.
[0105] The second difference value is numerically compared with the third difference value, and the channel A processed data and the channel B processed data corresponding to the smaller value are used as comparison data.
[0106] If the first judgment result is no, then there is an error level difference in the analog data.
[0107] If the signal data is switch data, the voting mechanism is set to include:
[0108] If the input value of the collected data in the channel A processing data is the same as the input value of the collected data in the channel B processing data, the channel A control module adopts the input value of the collected data in the channel A processing data, and the channel B control module adopts the input value of the collected data in the channel B processing data.
[0109] If the input value of the collected data in the channel A processing data is different from the input value of the collected data in the channel B processing data, and the quality bit of the channel A processing data is poor, or the diagnostic status information of channel A is abnormal, the channel A control module adopts the input value of the collected data in the channel B processing data, and the channel B control module adopts the input value of the collected data in the channel B processing data.
[0110] If the input value of the collected data in the channel A processing data is different from the input value of the collected data in the channel B processing data, and the quality bit of the channel B processing data is poor, or the diagnostic status information of channel B is abnormal, the channel A control module adopts the input value of the collected data in the channel A processing data, and the channel B control module adopts the input value of the collected data in the channel A processing data.
[0111] If the diagnostic status information of channel A and the diagnostic status information of channel B are both abnormal, or the quality bits of the channel A processing data and the quality bits of the channel B processing data are both poor, the fail-safe value is output according to the pre-configured processing method.
[0112] If the signal data is analog data, setting the voting mechanism specifically includes:
[0113] If the input data in the channel A processing data is the same as the input data in the channel B processing data, the channel A control module adopts the input signal of the data collected in the channel A processing data in the comparison data, and the channel B control module adopts the input signal of the data collected in the channel B processing data; the input data is data that meets the first judgment result.
[0114] If the input data in the channel A processing data is different from the input data in the channel B processing data, and the quality of the channel A processing data is poor, or the diagnostic status information of channel A is abnormal, the channel A control module adopts the input signal of the collected data in the channel B processing data in the comparison data, and the channel B control module adopts the input signal of the collected data in the channel B processing data.
[0115] If the input data in the channel A processing data is different from the input data in the channel B processing data, and the quality bit of the channel B processing data is poor, or the diagnostic status information of the channel B is abnormal, the channel A control module adopts the input signal of the collected data in the channel A processing data in the comparison data, and the channel B control module adopts the input signal of the collected data in the channel A processing data.
[0116] If the diagnostic status information of channel A and the diagnostic status information of channel B are both abnormal, or the quality bits of the channel A processing data and the quality bits of the channel B processing data are both poor, the fail-safe value is output according to the pre-configured processing method.
[0117] As an optional implementation mode, the dual-active redundant logic voting processing method further includes:
[0118] According to the set output principle, data output is performed according to the output control data.
[0119] The purpose of this application is to combine the requirements of standard IEC61508-6, while taking into account comprehensive factors such as security, availability, scalability and cost, and to achieve dual-active redundant logical voting and degradation processing by increasing the number of channels and introducing channel interaction mechanisms and voting mechanisms on the basis of the 1oo1D architecture.
[0120] Its design consists of a redundant system with diagnosis. The system includes functional modules of acquisition input unit, logic operation processing unit, and output drive unit. The modules of each unit are all implemented with FPGA technology, which is responsible for input / output, interface, program execution, online diagnosis and processing, redundant processing, etc. FPGA technology with parallel execution function can minimize the probability of common cause failure of software compared with embedded software with serial execution function.
[0121] Among them, the typical single-channel 1oo2D architecture is as follows Figure 2 As shown in the figure, it includes an acquisition input unit, a logic operation processing unit, and an output drive unit. The modules of the three units all interact with each other on a custom safety-level redundant bus. The bus topology architecture is shown in the figure below. Figure 3 , each unit module occupies a predefined redundant bus time slot, see Figure 4 .
[0122] The first step is a typical single-channel 1oo2D architecture:
[0123] a) Collection input unit.
[0124] The input modules of two channels are channel A input module and channel B input module. Both channel A input module and channel B input module can collect signal data, and the signal data includes: switch quantity data, namely switch quantity input DI and analog quantity data, namely analog quantity input AI.
[0125] Collection input unit corresponding Figure 2 Input module AI / DI in channel A; input module of channel A corresponds to Figure 2 AI / DI-A in channel B input module corresponds to Figure 2 AI / DI-B in.
[0126] like Figure 2 As shown, the field sensor collects information data and inputs it to the input module AI / DI through the input terminal module, that is, the collection input unit. The collection input unit is used to obtain information data.
[0127] The acquisition input unit transmits the collected information data, such as sensor data, i.e., acquisition data and diagnostic quality bits, to the redundant controller module (controller module) and two controller modules, i.e., channel A control module (NP-A) and channel B control module (NP-B) in the logic operation processing unit through the safety-level redundant bus (AI / DI-ABUS A&B and AI / DI-B BUS A&B) in its sending time slot, and performs 1oo2D voting in the logic operation processing unit to obtain a set of voting results.
[0128] 1) For switch data:
[0129] The sensor signal, i.e. the collected data, is processed and sent to the channel A input module and the channel B input module respectively. The channel A input module and the channel B input module collect the conditioned signals respectively, and then send the collected data, quality bit, and status data of the input module to the redundant controller module through the backplane customized safety-level redundant bus. The input voting mechanism of the DI signal, i.e. the switch signal, is divided into three cases:
[0130] 1. If the input values are the same, the sub-channel controller modules, namely the channel A control module (NP-A) and the channel B control module (NP-B), respectively adopt the input values of their respective channels.
[0131] 2. If the input values are different, and the quality bit of the input value of a certain channel is poor, or a channel input module is diagnosed to be faulty, both channels use the input value transmitted from the other channel (the channel with good quality bit).
[0132] 3. If it is diagnosed that both channel input modules fail at the same time or the input value quality bits are both wrong, the controller module processing method can be pre-configured according to the configuration to output the fail-safe value.
[0133] Specifically, the DI signal voting mechanism of single-channel 1oo2D is shown in Table 1.
[0134] Table 1 Voting mechanism table of DI signal
[0135]
[0136] 2) For analog data:
[0137] Analog data cannot be directly judged as identical or different, so an algorithm is required to judge whether the data is identical or different. The judgment instructions are as follows:
[0138] 1. Set the maximum tolerable deviation value of the analog input of the two channels through device configuration, that is, the preset tolerance deviation threshold Dt.
[0139] 2. Channel A control module (NP-A) and channel B control module (NP-B) collect analog input signals Da and Db of their respective channels respectively and exchange them between the controller modules.
[0140] 3. The channel A control module (NP-A) and the channel B control module (NP-B) respectively calculate the difference Dd between the input signals Da and Db; the calculation formula is Dd = |Da-Db|.
[0141] 4. For a single-channel control module, that is, any one of the channel A control module (NP-A) and the channel B control module (NP-B): if Dd<=Dt, the input data is considered valid, and then the differences between Da, Db and Dd are calculated respectively: Dad and Dbd, where Dd=|Da-Db|, Dd=|Da-Db|; Da or Db corresponding to the smaller value of Dad and Dbd is selected as the output value, which is the comparison data mentioned above.
[0142] 5. For a single-channel control module, if Dd>Dt, it is considered that there is an error level difference in the input data and the channel is diagnosed as faulty.
[0143] For analog data, the input voting mechanism is divided into three cases:
[0144] 1. If the algorithm determines that the input values of the two channels are the same, the channel A control module and the channel B control module adopt their respective input values.
[0145] 2. If the algorithm determines that the input values are different and the quality bit of the input value of a certain channel is wrong, or a fault is diagnosed in the input module of a certain channel, the two channel control modules will use the input value transmitted from the other channel.
[0146] 3. If it is diagnosed that both channel input modules fail at the same time or the input value quality bits are both wrong, the controller module processing method can be pre-configured according to the configuration to output the fail-safe value.
[0147] Specifically, the AI signal of a single-channel 1oo2D, i.e., the analog data voting mechanism, is shown in Table 2.
[0148] Table 2 Voting mechanism of AI signal
[0149]
[0150] In order to ensure the validity of the input data and minimize the deviation, for analog data, the input acquisition unit collects the input signal based on the FPGA periodic cycle and performs mean filtering. The FPGA collects ADC data n times, removes the maximum and minimum values, and calculates the average value of the remaining n-2 data to improve the reliability of the input data.
[0151] b) Logical operation processing unit.
[0152] The control module of the logic operation processing unit (channel A control module, channel B control module) receives the collected data, quality bit and status information sent by the input module of the acquisition input unit of this channel, performs logic operation and voting, and sends the processing results to the output module, i.e., the output drive unit, through the backplane customized safety-level bus.
[0153] In each operation cycle, the channel A control module and the channel B control module will send the control status information, output status information, and output data of their own channels to the redundant channel, that is, the redundant controller module, and then independently perform logical operations, logical voting, and output data comparison; the two channel controller modules, namely the channel A control module and the channel B control module, compare the output data. If the output data is inconsistent within multiple controller operation cycles, an inconsistent output data alarm will be issued. When a fault occurs in the output driver module of channel A, the output of the channel will be actively cut off, and the status information will be reported to the channel control module; when the controller module of the redundant channel B, that is, the channel B control module, detects a fault in the output driver module of channel A, the output of the output driver module of channel A will be cut off. The specific logic operation processing mechanism is shown in Table 3.
[0154] Table 3 Logical operation processing mechanism table
[0155]
[0156] The control module of each channel performs quality bit processing on the input data, parses the input module data and network data, and calls the user algorithm execution program to process the data. The processed data is finally sent to the redundant channel. The two channel control modules perform voting and data comparison to determine the consistency of the two channel data, and at the same time perform functions such as mutual cutting processing and output locking processing.
[0157] 1) Voting process:
[0158] When a channel control module fails, the output is configured according to the project. The redundant controller module sends a mutual cut command to the redundant channel, that is, the other channel except the failed channel, to shut down the failed channel. When the communication between channel control modules fails, the controller module, that is, the logic operation processing unit, reports the link failure, and the output of each channel is output according to the engineering logic requirements. The logic operation processing unit determines the locking state of the redundant channel during operation. If the channel control module of the redundant channel is in the output locking state, it will degenerate to 1oo1D and no voting will be performed.
[0159] 2) Data comparison:
[0160] The received redundant channel data is processed for inconsistency alarm. If the switch data of the two channels are inconsistent continuously within three operation cycles or the module quantity difference exceeds the maximum allowable deviation value, i.e., the preset tolerance deviation threshold, for three consecutive times, an alarm is processed and the output data is output normally.
[0161] c) Output drive unit.
[0162] The output drive unit of the 1oo2D architecture requires two channels for output voting. When one of the channels enters a safe state due to a safety fault, the entire system performs the safety function by the other channel, and the system degenerates into a 1oo1D architecture.
[0163] The output drive unit, that is, the channel A output drive module (AO / DO-A) and the channel B output drive module (AO / DO-B) in the output module AO / DO, outputs according to the following principles:
[0164] 1. The switch data is voted and output through the 1oo2 voting module.
[0165] 2. The analog data is output in the form of dual module redundant backup.
[0166] 1) For DO signal, the output of switch signal:
[0167] The output drive unit uses the output channel and the diagnostic channel to be connected in series, and the A / B redundant output modules are connected in parallel. In actual applications, the channels are connected in series through the channel output control switch K1 and the diagnostic control switch K2. The diagnostic control signals come from the FPGA output channel control, the watchdog FPGA, the redundant channel, and the FPGA power supply abnormality. During normal operation, the A / B channels perform independent diagnosis. When one of the redundant channels fails, the faulty channel is disconnected. The disconnection signal can come from the cut-off signal of the channel, the cut-off signal of the redundant peer end, the cut-off signal when the watchdog reset detects an FPGA abnormality, and the FPGA power supply abnormality cut-off signal, which degenerates to 1oolD at this time.
[0168] 2) For AO signal, that is, the output of analog data:
[0169] The 1oo2D architecture analog output can adopt a dual AO hot standby redundant configuration design.
[0170] Dual AO hot standby redundant configuration is used for simultaneous output. One module is responsible for the control value output function, and the output switch of the other standby module is disconnected. When the working module fails, it automatically switches to the standby module.
[0171] In order to reduce the disturbance time during the switching process, AOs can also achieve switching synchronization through FPGA, that is, the two modules exchange switching instructions with each other, and the output is updated and the module channel is switched only when both modules receive the switching instructions.
[0172] The second step is redundant bus topology architecture.
[0173] The redundant backplane BUS is used for communication, and the bus reliability can be improved according to the IEC 61508 custom safety-level bus protocol.
[0174] The third step is to predefine the redundant bus token time slots.
[0175] The redundant bus token time slots based on FPGA technology are predefined. The controller module and each IO module (input and output) use a custom bus communication network. Based on the predefined token bus time slot method, all modules on the bus predefine the bus time slots and the order, and take turns to be the master node. The time Δt occupied by each time slot is fixed. Through the received data packets, the module and time slot currently occupying the time slot are determined, and the bus time slot occupied by itself is calculated. The bus is occupied in turn to send data packets, so as to achieve independent communication between each module, reduce interference between modules, and respond quickly to shorten the response time. For the specific processing process, see Figure 4 and Figure 5 .
[0176] The effective data in each data packet of the bus communication network is 64 bytes. The AO module (for the output of analog data) is designed with 8 channels, each channel is 2 bytes, and the total output is 16 bytes. The DO module (for the output of switch data) has 16 channels, each channel is 1 byte, and the total output is 16 bytes. The predefined controller occupies 12 time slot IDs and sends 12 packets of data. The 64 bytes of data sent by each ID can support the output of 4 output-type AO / DO modules, and can support the output of up to 48 output-type modules. Predefine 1 time slot ID for each IO module. See Table 4 for details.
[0177] Table 4 Bus communication network communication table
[0178]
[0179] The redundant outputs of the output drive unit can obtain the values sent by the redundant controller to it and the redundant module for voting and selection, and no additional synchronization link design is required between the redundant output modules.
[0180] In view of the problems of high cost and reliability availability in the existing nuclear industry safety-level control system, the present invention adopts three-level 1oo2D, thereby reducing the cost and ensuring reliable communication, and improving availability.
[0181] At the same time, the FPGA-based custom safety-level bus is a communication based on "hard" logic, with high reliability and integrity. The hardware architecture based on FPGA technology is used to implement the main control and communication functions, and the stable operation of the system does not rely on microprocessors and software. It has the following advantages:
[0182] Reliability: 1oo2D architecture safety-level DCS platform can put the power plant in a safe state when the DCS fails. The safety integrity of the DCS can reach SIL3 level and has high reliability.
[0183] Availability: 1oo2D is downgraded to 1oo1D to improve availability.
[0184] Determinism: FPGA chips implement the time determinism of communication systems in the form of pure hardware circuits. The execution of hardware circuits is more deterministic than that of software and operating systems.
[0185] Sustainability and economy: CPU chips are updated faster than FPGA chips, which means that the life of a DCS system platform based on CPU technology is shorter than that of a DCS system platform based on FPGA technology. As CPU chips are updated, it is difficult to port the existing software code in the original CPU chip to the new generation of CPU chips. On the contrary, FPGA technology makes future system upgrades easier. FPGA logic code and register-level design compiled using hardware description language can be ported to new FPGA chips. New FPGA chips only need to use new software tools to re-synthesize and layout the existing code and design, and the investment in software design can be retained to the greatest extent.
[0186] Take the configuration of columns A and B of a nuclear power test reactor as an example (see Figure 6 ), columns A and B are redundant and have exactly the same configuration. The functional modules of each column include: 1 control module A, 1 control module B (A and B are redundant), 12 AI / DI input modules, 12 AO / DO output modules, 2 communication modules, a total of 28 modules. In this case, it can be concluded that the two columns include at least 6 chassis, 56 functional modules, corresponding terminal adapter modules, and cables. Large size and high cost.
[0187] If the 1oo2D high-security DCS platform architecture based on FPGA technology of the present application is adopted, Column A and Column B are integrated (see Figure 7 ), only 4 chassis and 2 controller modules are required. According to the IO point capacity, there are no more than 48 IO modules, and there are no point-to-point modules. The volume is reduced and the cost is reduced.
[0188] For the voting of the 1oo2D architecture, assume that the AI modules (4 - 20 mA, accuracy of 0.1%) of Channel A and Channel B are in slot 8 and slot 9 in the chassis respectively, and the corresponding transmission time slot IDs are 25 and 26. Each channel sends the collected data Da = 12.000 mA, Db = 12.012 mA and the quality bit (good) to the redundant controller module through the predefined time slot bus. The maximum tolerable deviation value Dt of the analog input is 0.016 mA.
[0189] Dd = |12.012 - 12.000| = 0.012 mA < 0.016 mA.
[0190] Dad = |Da - Dd| = 11.988 mA.
[0191] Dbd = |Db - Dd| = 12 mA.
[0192] Since Dad < Dbd, the redundant controllers both select Da for logical operation.
[0193] For the voting process of the redundant controllers, Controller A outputs an AO value of 10.100 mA, Controller B's fault output is locked, Controller A degrades to 1oo1D, outputs an AO value of 10.100 mA, and the quality bit is good.
[0194] For the redundant AO voting output, the value output by Controller A to the redundant AO is received through the custom bus. When both redundant AOs are normal, by default, AO A output drives, and the other is used as a backup. When an AO fails, the output is automatically switched.
[0195] It can be seen that by adopting the 1oo2D high-security DCS platform architecture based on FPGA technology proposed in the present application, the volume becomes smaller, the cost is reduced, the reliability is improved, and the availability is improved after fault degradation.
[0196] The technical features of the above embodiments can be combined arbitrarily. For the sake of brief description, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combinations of these technical features do not conflict, they should all be considered as the scope recorded in this specification.
[0197] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the system, method and core ideas of this application; at the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.
Claims
1. A dual-master redundant logic voting processing system, characterized in that: The dual-master redundant logic voting processing system includes: an acquisition input unit, a logic operation processing unit and an output drive unit; The acquisition input unit is connected to the logic operation processing unit; the output drive unit is connected to the logic operation processing unit; the acquisition input unit, the logic operation processing unit and the output drive unit all adopt FPGA technology; The acquisition input unit includes: a channel A input module and a channel B input module; the channel A input module and the channel B input module are both connected to the logic operation processing unit; The acquisition input unit is used to acquire information data; the information data includes: signal data of channel A input module and signal data of channel B input module; the signal data includes: switch data and analog data; the switch data and the analog data both correspondingly include acquisition data, quality bit and status information; The logic operation processing unit is used to perform logic processing according to the information data to obtain output control data; the logic processing includes: logic operation, logic voting and data comparison; The output driving unit is used for performing data output according to the output control data.
2. The dual-active redundant logic voting processing system according to claim 1, characterized in that: The logic operation processing unit includes: a channel A control module, a channel B control module and a redundant controller module; The channel A control module is connected to the channel A input module; the channel B control module is connected to the channel B input module; the channel A control module and the channel B control module are also connected to the redundant controller module; the redundant controller module is connected to the output drive unit; The channel A control module is used for: According to the signal data of the channel A input module, the signal data is analyzed based on the quality bit to obtain the channel A processing data; Transmitting first control data to the redundant controller module; the first control data includes: diagnostic status information of channel A and processing data of channel A; The channel B control module is used for: According to the signal data of the channel B input module, the signal data is analyzed based on the quality bit to obtain the channel B processing data; Transmitting second control data to the redundant controller module; the second control data includes: diagnostic status information of channel B and processing data of channel B; The redundant controller module is used for: According to the diagnostic status information of channel A and the diagnostic status information of channel B, a logical operation is performed based on a set logical operation processing mechanism to obtain logical operation information; According to the data processed by channel A and the data processed by channel B, data comparison is performed to obtain comparison data; Based on the set voting mechanism, logical voting processing is performed according to the comparison data and the logic operation information to obtain voting processing information; the voting processing information is channel mutual cutting or channel locking; Control the channel A control module and the channel B control module to perform channel processing according to the voting processing information, and determine output control data according to the processed channels.
3. The dual-active redundant logic voting processing system according to claim 2 is characterized in that: The output drive unit includes: a channel A output drive module and a channel B output drive module; The channel A output driver module is connected to the channel A control module; the channel B output driver module is connected to the channel B control module; The channel A output driving module and the channel B output driving module both output data according to the set output principle and the output control data.
4. The dual-active redundant logic voting processing system according to claim 1, characterized in that: The dual-master redundant logic voting processing system further includes: a redundant bus; The acquisition input unit, the logic operation processing unit and the output driving unit are all based on the redundant bus and adopt a bus communication network determined by a predefined token bus time slot method to perform communication transmission.
5. A dual-master redundant logic voting processing method, characterized in that: The dual-active redundant logic voting processing method is implemented by using the dual-active redundant logic voting processing system described in any one of claims 1 to 4; The dual-active redundancy logic voting processing method includes: Acquire information data; the information data includes: signal data of channel A input module and signal data of channel B input module; the signal data includes: switch data and analog data; the switch data and the analog data both correspondingly include acquisition data, quality bit and status information; Performing logic processing on the information data to obtain output control data; the logic processing includes: logic operation, logic voting and data comparison; Data output is performed according to the output control data.
6. The dual-active redundant logic voting processing method according to claim 5, characterized in that: Performing logical processing according to the information data to obtain output control data specifically includes: According to the signal data of the channel A input module, the signal data is analyzed based on the quality bit to obtain the channel A processing data; According to the signal data of the channel B input module, the signal data is analyzed based on the quality bit to obtain the channel B processing data; According to the diagnostic status information of channel A and the diagnostic status information of channel B, a logical operation is performed based on a set logical operation processing mechanism to obtain logical operation information; According to the data processed by channel A and the data processed by channel B, data comparison is performed to obtain comparison data; Based on the set voting mechanism, logical voting processing is performed according to the comparison data and the logic operation information to obtain voting processing information; the voting processing information is channel mutual cutting or channel locking; Control the channel A control module and the channel B control module to perform channel processing according to the voting processing information, and determine output control data according to the processed channels.
7. The dual-active redundant logic voting processing method according to claim 6 is characterized in that: According to the data processed by channel A and the data processed by channel B, data comparison is performed to obtain comparison data, which specifically includes: If the signal data is switch data, a numerical comparison is performed based on the input value of the collected data according to the channel A processing data and the channel B processing data to obtain comparison data; If the signal data is analog data, a difference calculation is performed based on the input signal of the collected data according to the channel A processing data and the channel B processing data to obtain a first difference; Determine whether the first difference is not greater than a preset tolerance deviation threshold, and obtain a first determination result; If the first judgment result is yes, then according to the channel A processing data and the channel B processing data, based on the input signal of the collected data, difference calculation is performed with the first difference value respectively to obtain a second difference value and a third difference value; Compare the second difference value with the third difference value, and use the channel A processed data and the channel B processed data corresponding to the smaller value as the comparison data; If the first judgment result is no, then there is an error level difference in the analog data.
8. The dual-active redundant logic voting processing method according to claim 6 is characterized in that: If the signal data is switch data, setting the voting mechanism specifically includes: If the input value of the collected data in the channel A processing data is the same as the input value of the collected data in the channel B processing data, the channel A control module adopts the input value of the collected data in the channel A processing data, and the channel B control module adopts the input value of the collected data in the channel B processing data; If the input value of the collected data in the channel A processing data is different from the input value of the collected data in the channel B processing data, and the quality bit of the channel A processing data is poor, or the diagnostic status information of the channel A is abnormal, the channel A control module adopts the input value of the collected data in the channel B processing data, and the channel B control module adopts the input value of the collected data in the channel B processing data; If the input value of the collected data in the channel A processing data is different from the input value of the collected data in the channel B processing data, and the quality bit of the channel B processing data is poor, or the diagnostic status information of the channel B is abnormal, the channel A control module adopts the input value of the collected data in the channel A processing data, and the channel B control module adopts the input value of the collected data in the channel A processing data; If the diagnostic status information of channel A and the diagnostic status information of channel B are both abnormal, or the quality bits of the channel A processing data and the quality bits of the channel B processing data are both poor, the fail-safe value is output according to the pre-configured processing method.
9. The dual-active redundant logic voting processing method according to claim 7, characterized in that: If the signal data is analog data, setting the voting mechanism specifically includes: If the input data in the channel A processing data is the same as the input data in the channel B processing data, the channel A control module adopts the input signal of the data collected in the channel A processing data in the comparison data, and the channel B control module adopts the input signal of the data collected in the channel B processing data; the input data is the data that satisfies the first judgment result; If the input data in the channel A processing data is different from the input data in the channel B processing data, and the quality bit of the channel A processing data is poor, or the diagnostic status information of the channel A is abnormal, the channel A control module adopts the input signal of the data collected in the channel B processing data in the comparison data, and the channel B control module adopts the input signal of the data collected in the channel B processing data; If the input data in the channel A processing data is different from the input data in the channel B processing data, and the quality bit of the channel B processing data is poor, or the diagnostic status information of the channel B is abnormal, the channel A control module adopts the input signal of the collected data in the channel A processing data in the comparison data, and the channel B control module adopts the input signal of the collected data in the channel A processing data; If the diagnostic status information of channel A and the diagnostic status information of channel B are both abnormal, or the quality bits of the channel A processing data and the quality bits of the channel B processing data are both poor, the fail-safe value is output according to the pre-configured processing method.
10. The dual-active redundant logic voting processing method according to claim 5, characterized in that: The dual-active redundancy logic voting processing method also includes: According to the set output principle, data output is performed according to the output control data.